- Template version
- AGK-STD-A02 v1.0
- Format
- Word · 20 KB
- Used by
- Data Protection Officer, IT Security
- When
- Week 2, with the acceptable use policy
- Document type
- Standard (Mandatory)
- Owner
- [Data Protection Officer]
- Approved by
- [AI Governance Committee]
- Review cycle
- Annual
- Parent document(s)
- AGK-POL-02, AGK-POL-03
- Adoption tier
- Lite: Required · Standard: Required · Regulated: Required
AGK-STD-A02_AI_Data_Handling_Standard_v1.0.docx
1. Purpose
This standard sets out which categories of [CLIENT NAME] data may be used with which AI tools, and how AI inputs and outputs shall be handled, so that staff can use AI productively without exposing confidential, personal or regulated data.
2. Scope
All data created, received or processed by [CLIENT NAME], including client and third-party data held under contract.
All use of AI tools by staff, contractors and agents acting for [CLIENT NAME], whether through chat, file upload, connectors, browser/computer-use agents or APIs.
3. Definitions
| Data label | Description and examples |
|---|---|
| Public | Approved for public release. Published website content, press releases, public filings. |
| Internal | For staff use; low impact if disclosed. Internal procedures, general meeting notes, non-sensitive project plans. |
| Confidential | Business-sensitive; disclosure could cause harm. Pricing, contracts, unreleased plans, small volumes of business-contact personal data, [source code — unless Restricted]. |
| Restricted | Highest sensitivity. Personal data at scale, sensitive personal data (health, financial, NRIC/ID numbers, biometrics), regulated data, client secrets under NDA, M&A and price-sensitive information, [source code if designated]. |
| Secrets | Credentials, passwords, API keys, tokens, private keys, connection strings. Never entered into any AI tool. |
| Tool tier | Description |
|---|---|
| T0 Unapproved / consumer | Personal accounts, free or consumer AI tools, any tool not approved by [CLIENT NAME]. |
| T1 Approved enterprise | Approved platform configured per AGK-STD-A01: SSO, contractual no-training, audit logs. |
| T2 Hardened enterprise | T1 plus retention set, DPIA/transfer assessment completed, encryption/key controls or in-region processing where required. |
| T3 Agentic with actions | AI with action permissions: write-capable connectors, browser/computer use, autonomous agents. Scoped per approved agent; human approval for irreversible actions. |
4. Requirements
Data label × tool tier matrix
The following matrix is mandatory. “Conditional” means permitted only when the stated conditions are met.
| Data label | T0 Unapproved | T1 Approved | T2 Hardened | T3 Agentic |
|---|---|---|---|---|
| Public | Allowed | Allowed | Allowed | Allowed |
| Internal | Prohibited | Allowed | Allowed | Allowed within the agent’s approved scope |
| Confidential | Prohibited | Allowed for business need | Allowed | Conditional: approved agent scope; write/send actions need human approval |
| Restricted | Prohibited | Prohibited | Conditional: approved use case (AGK-PRC-01), DPIA done, minimum necessary data | Conditional: as T2, plus autonomy no higher than [A2] unless AIGC approves |
| Secrets | Prohibited | Prohibited | Prohibited | Prohibited (agents use managed credentials, never pasted secrets) |
| Control ID | Requirement | Applies to |
|---|---|---|
| AGK-STD-A02-C01 | Users shall classify data before using it with an AI tool and shall only use data with a tool tier permitted by the data label × tool tier matrix in this standard. | All tiers |
| AGK-STD-A02-C02 | The [AI Governance Lead] shall maintain the list of approved AI tools and their tier in AGK-TPL-01 AI System Register and publish it to staff. | All tiers |
| AGK-STD-A02-C03 | Where the label of data is unclear, users shall treat it as the higher label until confirmed by the data owner. | Standard + Regulated |
| AGK-STD-A02-C04 | Secrets shall never be entered into prompts, files, project knowledge, custom instructions or skills. Accidental entry shall be reported and the secret rotated within [24 hours]. | Standard + Regulated |
The rest of this section and 5 sections are in the download
You have read about 29% of this document. The editable Word file comes with the free Lite pack.
Get the full document