# Data Protection Guide

Protect sensitive data throughout the infrastructure lifecycle.

## Data Classification

### Classify Data

```nickel
{
  data_classification = {
    public = {
      description = "Available to everyone",
      encryption_required = false
    },
    internal = {
      description = "Internal use only",
      encryption_required = true
    },
    confidential = {
      description = "Limited distribution",
      encryption_required = "at-rest-and-transit"
    },
    restricted = {
      description = "Highly sensitive",
      encryption_required = "aes-256",
      access_logs_required = true
    }
  }
}
```

## Encryption Requirements

### At-Rest Encryption

```bash
# Enable for all resources
provisioning encryption enable --scope all --algorithm aes-256-gcm

# Verify
provisioning encryption status
```

### In-Transit Encryption

```nickel
{
  security = {
    tls = {
      enabled = true,
      minimum_version = "1.3",
      certificate_source = "letsencrypt"
    },
    mtls = {
      enabled = true,
      require_client_cert = true
    }
  }
}
```

## Data Retention

```nickel
{
  data_retention = {
    logs = { retention_days = 90 },
    backups = { retention_days = 30 },
    audit_logs = { retention_days = 365 }
  }
}
```

## Related Documentation

- [Encryption Guide](./encryption.md)
- [Secrets Management](./secrets-management.md)
- [Audit Logging](./audit-logging.md)
