A data classification policy is in place to ensure confidential data is properly protected and restricted to authorised personnel.