dataSMC
01Services

Data protection & governance

Know what matters, where it lives and who can touch it.

Some of your data is worth more than the rest: customer records, payment details, contracts, the numbers that run the business. We help you find it, decide how it should be handled, and make sure access and retention follow those decisions — wherever the data travels.

  1. Mailboxes
  2. Shared drives
  3. Applications
  4. ClassificationRead and labelled
  5. Public
  6. InternalStaff only
  7. ConfidentialNamed people only
Found, labelled, handled.Data from every source is read and given a class. Each class carries its own rules: who may open it, and how long it is kept.

01.1Without it

What usually goes wrong.

  • Nobody knows where the sensitive data is.Copies live in inboxes, shared drives and exports that outlived the project they were made for.
  • Access follows folders, not data.Whoever can open the folder can read what is in it, however sensitive it has become.
  • Everything is kept forever.Without retention rules old data piles up, and every extra year is more to protect and more to lose.

01.2What it covers

Four parts of one job.

  • Data classificationSimple labels that say how each kind of information is handled.
  • Access controlsPermissions tied to how sensitive the data is, not to where it happens to sit.
  • RetentionHow long each kind of data is kept, and what happens after.
  • Data lifecycleFrom creation to deletion, handled the same way every time.

Works with what you already run

  • Microsoft Purview
  • SharePoint, OneDrive and Teams
  • Google Workspace
  • File servers and shared drives

Where it hands over

01.3How it runs

Four steps, then it keeps running.

Scoped and priced before it starts: a fixed fee for the first phase, then a monthly fee for what carries on. Stop after the first phase and you keep everything.

  1. 01Find what mattersLocate the sensitive data across systems, drives and mailboxes, and who can reach it.
  2. 02Label it plainlyA few clear classes — public, internal, confidential — that people can apply without a manual.
  3. 03Tie access to the labelControls that follow the data, so confidential stays confidential when it is copied or shared.
  4. 04Keep only what you needRetention periods agreed with the business, applied automatically, with deletion you can prove.

After the first phaseTypically 6–10 weeks

  • A map of your sensitive data: where it lives, who owns it, who can reach it.
  • Three or four plain labels, applied automatically where they can be.
  • Access rules that follow the labels.
  • A retention schedule agreed with the business.

Then, every month

  • New stores of sensitive data found and labelled as they appear.
  • Retention applied, with a record of what was deleted and when.
  • A quarterly look at who can reach what is confidential.

What we need from you

  • An owner for each kind of sensitive data.
  • Admin access to mail, file storage and key applications.
  • Your legal or privacy lead, for the retention decisions.

01.4What you get

What is different afterwards.

  • A map of your critical data.Where it lives, who owns it and who can reach it.
  • Retention you can defend.Rules that match your obligations, applied without anyone having to remember.
  • Access that follows the data, not the folder.Sensitive information protected wherever it ends up.

01.5Where it matters most

Where it carries the most weight.

A case · FinanceEvery login verified. No adviser slowed down.Phishing-resistant sign-in, from managed devices only.A field note · 24 Sept 2026Your customer data lives in more places than you think.4 min read

01.6Straight answers

What people ask about it.