Classified information in the United Kingdom is a system used to protect information from intentional or inadvertent release to unauthorised readers. The system is organised by the Cabinet Office and is implemented throughout central and local government and critical national infrastructure. The system is also used by private sector bodies that provide services to the public sector.

The current classification system, the Government Security Classifications Policy, replaced the old Government Protective Marking Scheme in 2014. Since classifications can last for 100 years many documents are still covered by the old scheme.

Classified information in the United Kingdom

Policy

Policy is set by the Cabinet Office. The Security Policy Framework (SPF) superseded the Manual of Protective Security and contains the primary internal protective security policy and guidance on security and risk management for His Majesty's Government (HMG) Departments and associated bodies. It is the source on which all localised security policies are based.

Classified information in the United Kingdom

The classification system was formerly included in the Manual of Protective Security (MPS) which specified the impact of release and protection level required for each classification. Departments issued localised versions of the content of the MPS as appropriate to their operational needs.

Classified information in the United Kingdom

Government Security Classifications Policy

The Cabinet Office issued the Government Security Classifications Policy (GSCP) in 2013; it came into effect in 2014. It replaced the old Government Protective Marking Scheme (GPMS). Classifications must be capitalised and centrally noted at top and bottom of each document page, save at OFFICIAL where the document marking is optional. All material produced by a public body in the UK must be presumed to be OFFICIAL unless it is otherwise marked. Like the GPMS, which it superseded, the GSCP classifications are applied only to the confidentiality of the data under classification.

TOP SECRET Information marked as TOP SECRET is that whose release is liable to cause considerable loss of life, international diplomatic incidents, or severely impact ongoing intelligence operations. Disclosure of such information is assumed to be above the threshold for prosecution under the Official Secrets Act 1989. SECRET This marking is used for information which needs protection against serious threats, and which could cause serious harm if compromised—such as threats to life, compromising major crime investigations, or harming international relations. OFFICIAL All routine public sector business, operations and services is treated as OFFICIAL. Many departments and agencies operate exclusively at this level. It is often incorrectly assumed that the OFFICIAL classification replaces the GPMS markings of PROTECT, RESTRICTED and CONFIDENTIAL, however this is not the case, since the criteria on which GPMS markings were applied bear no relationship to the criteria used for GSCP classifications. It is quite possible, and not uncommon, for data within an OFFICIAL classification to have serious impacts including serious injury in the event of unauthorised disclosure. This is one of the characteristics of the GSCP which differs significantly from the Protective Marking Scheme which it replaced. At the OFFICIAL classification there is a general presumption that data may be shared across Government, however where a need to know principle is identified data may be marked as "OFFICIAL-SENSITIVE"; "OFFICIAL-SENSITIVE COMMERCIAL"; "OFFICIAL-SENSITIVE LOCSEN" or "OFFICIAL-SENSITIVE PERSONAL". All OFFICIAL-SENSITIVE data must be marked and contain handling instructions identifying why the data is deemed sensitive, how it must be held, processed and transferred.

Government Protective Marking Scheme

The older system used five levels of classification, supplemented with caveat keywords. The keyword was placed in all capital letters in the centre of the top and bottom of each page of a classified document and described the foreseeable consequence of an unauthorised release of the data (a ‘breach of confidentiality’). In descending order of secrecy, these are: