5 Data Protection Architecture

Protect information throughout its lifecycle

A data protection architecture safeguards information throughout its lifecycle: creation, use, sharing, storage, retention, and disposal. Strong protection combines classification, access controls, encryption, key management, retention rules, and verified deletion. Encryption alone is not enough: excessive permissions, unmanaged copies, retained backups, or compromised keys can still expose data.

Classify data and set safeguards

Classification assigns labels that communicate data sensitivity and handling requirements. An organization might use labels such as Public, Internal, Confidential, and Restricted. Define each label clearly, including which data belongs in it and what safeguards apply.

Assess potential harm if data loses confidentiality, integrity, or availability. Public information may need little confidentiality protection but still require integrity controls to prevent tampering. Customer identity records may require stronger confidentiality controls and carefully managed access. NIST FIPS 199 uses low, moderate, and high impact levels for these security objectives; its method can inform risk-based classification.

Apply labels consistently across databases, files, exports, backups, logs, and cloud storage. Use them to drive access permissions, encryption, approved storage locations, sharing restrictions, monitoring, and retention periods. Classification is useful only when systems and people act on it. Collect and copy only the data needed for the task, since less data means less to protect.

Encrypt data in use and storage

Protect data in transit, such as between a user, service, or storage system, and at rest, including in databases, disks, object storage, and backups. Where feasible, protect data during processing with techniques suited to the workload and threat model.

Select established cryptographic mechanisms appropriate to the risk and implementation environment. Encryption can reduce exposure when storage or network traffic is accessed without authorization, but it does not replace authentication, authorization, secure configuration, or monitoring. An authorized application—or an attacker who compromises it—may still access decrypted data.

Control the key lifecycle

Keys are sensitive assets and require their own lifecycle controls. Generate and store keys using protected services or cryptographic modules; restrict key use to authorized identities and workloads; separate key administration from routine data access where practical; and audit key operations.

Establish processes for key rotation, backup or recovery where needed, revocation, compromise response, and eventual destruction. Rotation limits continued use of a key, but does not by itself remove plaintext copies already created or make old ciphertext inaccessible if old keys remain recoverable. NIST SP 800-57 provides key-management guidance.

Set retention requirements

Retain information only for an approved business, legal, or operational purpose and the required period. Retention rules should identify the data covered, the retention start point, the period, the responsible owner, and the disposal method. Coordinate the rules with applicable records, privacy, and legal requirements.

A legal hold or other preservation duty may suspend ordinary deletion until it is released. Document exceptions and ensure that backup expiration aligns with policy and recovery needs.

Delete and verify every relevant copy

Implement retention and deletion across the full data estate, not just the primary database. Consider replicas, exports, caches, logs, snapshots, archives, and backups. Deleting a customer record from an application does not complete deletion if a searchable export or long-lived backup still contains it.

When the retention period ends, securely delete or sanitize information using a method suitable for the media, sensitivity, and environment. Depending on the system, this may involve controlled logical deletion, media sanitization, or cryptographic erase. For physical media, choose and verify an appropriate sanitization method. NIST SP 800-88 Rev. 2 provides media-sanitization guidance.

Record deletion outcomes and exceptions, and test that lifecycle controls work as intended. Check that all copies and relevant keys are accounted for, and verify that disposal is effective rather than limited to the primary record.

Use guidance for classification and disposal

NIST FIPS 199 describes low, moderate, and high impact levels for confidentiality, integrity, and availability, and can inform risk-based classification. NIST SP 800-57 provides key-management guidance. NIST SP 800-88 Rev. 2 provides media-sanitization guidance.