Data Classification & Retention Policy

1 · Purpose

This policy defines how Nxt7a classifies, handles, retains and disposes of information, so that protection is proportionate to sensitivity and data is kept no longer than needed.

2 · Scope

Applies to all information in any form – digital or physical – created, received or held by Nxt7a, including platform, client, partner, Indigenous community and personal data.

3 · Policy Statements

Classification levels. Information is classified into four levels:

Handling. Storage, access, sharing and encryption requirements scale with classification. Confidential and Restricted data are encrypted in transit and at rest, access-controlled per the Access Control Policy, and not placed in unapproved tools or AI systems.

Indigenous knowledge. Certain traditional knowledge and community data may be Restricted regardless of other factors, and is governed by the Data Sharing & Indigenous Data Sovereignty Policy and any applicable Traditional Knowledge (TK) Labels.

Retention. Information is retained only as long as required for business, legal, regulatory or contractual reasons. Default retention schedules are maintained by the owner; personal data is kept no longer than necessary, consistent with privacy law.

Disposal. Data at end of life is securely deleted or destroyed. Backups and immutable stores are managed so that retention and disposal obligations are met without compromising integrity or legal holds.

Legal holds. Where litigation or investigation is reasonably anticipated, relevant data is preserved and normal disposal suspended.

4 · Roles & Responsibilities

• Data/system owners classify their information and set retention.
• Information Security Officer maintains the scheme and handling rules.
• All personnel apply classifications and handle data accordingly.

5 · Compliance, Monitoring & Breach

Mishandling of Confidential or Restricted data is a security incident. Compliance is checked through reviews and audits.

6 · Related Documents

Information Security Policy · Access Control Policy · Privacy Policy · Incident Response Policy · Data Sharing & Indigenous Data Sovereignty Policy.

7 · Standards Mapping

• B Corp: Customers.
• ISO/IEC 27001:2022: A.5.12–5.13 (classification, labelling); A.5.33 (protection of records); A.5.34 (privacy & PII).
• ISO/IEC 42001:2023: A.7 (data for AI systems).
• Statutory: Privacy Act 1988 (Cth) and applicable data-protection laws.

Review note. Set concrete retention periods per data type with [COO or delegate]; these are legally sensitive.

8 · Version History