# Internal data handling standard

PrivacyBuilt Editorial | Educational working model | 3 November 2026

Obtain security, privacy and business approval. Use real internal contacts and approved systems before adoption. Avoid inserting real personal information into this template.

## Ownership and scope
[Name the policy owner, covered teams, systems, suppliers and approval authority.]
## Classification and collection
[Define classification levels, examples, minimum necessary data and collection approvals.]
## Access and sharing
[Apply role-based access, periodic review, approved sharing channels and recipient verification. Avoid blanket permissions.]
## AI use
[Identify approved AI tools and allowed inputs. Restrict personal or confidential data unless the use case, provider and safeguards are approved.]
## Storage and exports
[Set approved repositories, encryption, export controls and local-device rules.]
## Retention and disposal
[Link each record family to an approved schedule; describe legal holds, backups, disposal and evidence.]
## Incident and rights escalation
[Provide real restricted channels and out-of-hours contacts. Do not paste incidents or rights-request data into public tools.]
## Exceptions and assurance
[Record approver, reason, expiry, monitoring and training. Review on material change.]