Domain H · Area H-CA1 · Integrity, scepticism, judgement and escalation

H.4Protect confidentiality, privacy and sensitive information

Working Draft version 1.1

Purpose and scope

This unit covers the capability to identify, classify, access, use, share, store, retain, redact and dispose of confidential, personal, privileged, proprietary, security-sensitive and market-sensitive information used in sustainability reporting. It includes minimum-necessary use, authorised access, secure transfer, consent and purpose limitations, aggregation and anonymisation, incident response and the controlled interface between information protection and reporting transparency.

Applied competency statement

Can protect confidential, personal, privileged, proprietary, security-sensitive and market-sensitive reporting information through appropriate classification, access, handling, disclosure, retention and incident-escalation controls.

Boundary and escalation

This unit owns professional classification, access, use, sharing, retention and protection of sensitive reporting information across all media. G.9 owns how uncertainty, omission and sensitive information are communicated publicly; I.8 owns tool-specific data flows, vendor, security and rights controls; E.9 owns record lineage and integrity. Legal and regulatory determinations require specialists.

Key quality risks

Sensitive files shared through uncontrolled channels; excessive access; personal or grievance information disclosed without need or protection; legal privilege waived; market-sensitive information released early; proprietary or licensed content reused outside permitted terms; confidential information included in evidence packs unnecessarily; weak anonymisation or aggregation; files retained indefinitely or deleted prematurely; security incidents concealed; and confidentiality used as a broad justification to omit required adverse information.

Required knowledge · 6

H.4-K01

Understands confidential, personal, special-category or sensitive personal, privileged, proprietary, licensed, security-sensitive and market-sensitive information and the need for contextual classification.

Knowledge Type: Information categories · Normative Weight: Core

H.4-K02

Understands lawful or authorised purpose, minimum necessary use, need-to-know access, consent where relevant, accuracy, secure transfer, storage, retention, disposal and accountability.

Knowledge Type: Handling principles · Normative Weight: Core

H.4-K03

Understands aggregation, anonymisation, pseudonymisation, redaction, access restriction, delayed publication, alternative disclosure and the risk of re-identification or misleading omission.

Knowledge Type: Disclosure treatments · Normative Weight: Core

H.4-K04

Understands that legal privilege, investigations, inside or market-sensitive information, embargoes and selective disclosure require specialist and authorised handling.

Knowledge Type: Privilege and market sensitivity · Normative Weight: Core

H.4-K05

Understands provider, adviser, translator, platform, cloud, cross-border, data-room, email and portable-storage risks and the need for contractual and technical safeguards.

Knowledge Type: Third parties and systems · Normative Weight: Core

H.4-K06

Understands incident identification, containment, evidence preservation, notification, escalation, remediation, review and the relationship to reporting, legal and public-disclosure decisions.

Knowledge Type: Incidents and governance · Normative Weight: Core

Applied skills · 5

H.4-S01

Identify and classify sensitive information in reporting data, evidence, working papers, drafts, meetings and external submissions.

Skill Type: Core applied capability · Observable Output or Result: Sensitive-information classification and handling plan

H.4-S02

Define authorised users, purpose, access, transfer, storage, retention, redaction, aggregation, disposal and review requirements.

Skill Type: Handling design · Observable Output or Result: Access, transfer, retention and disclosure-treatment record

H.4-S03

Coordinate legal and owner review to protect information while preserving required, balanced and non-misleading reporting.

Skill Type: Disclosure balance · Observable Output or Result: Sensitive-information disclosure assessment

H.4-S04

Apply proportionate safeguards to advisers, translators, platforms, data rooms and other external or digital handling routes.

Skill Type: Third-party and workflow control · Observable Output or Result: Third-party information-handling record

H.4-S05

Contain and escalate suspected loss, unauthorised access or disclosure, preserve evidence and document remediation and reporting implications.

Skill Type: Incident response · Observable Output or Result: Information incident, escalation and remediation record

Professional behaviours · 3

H.4-B01

Does not access, use or share sensitive information beyond the authorised reporting purpose and minimum necessary scope.

Behaviour Type: Confidentiality and respect · Non-compensable Requirement: Yes

H.4-B02

Does not use confidentiality or privilege as an unsupported pretext to suppress required adverse or uncertain reporting information.

Behaviour Type: Protection without concealment · Non-compensable Requirement: Yes

H.4-B03

Does not hide, delay or informally resolve a material information incident outside the authorised response and escalation process.

Behaviour Type: Incident transparency · Non-compensable Requirement: Yes

Typical tasks · 4

H.4-T01

Inventory and classify sensitive information, applicable owners, legal or contractual constraints, users and handling routes.

Primary Output Link: H.4-O01

H.4-T02

Define and operate access, transfer, storage, retention, redaction, aggregation, sharing and disposal controls.

Primary Output Link: H.4-O02

H.4-T03

Coordinate legal, privacy, security and owner review of disclosure treatment and third-party handling.

Primary Output Link: H.4-O02

H.4-T04

Respond to suspected incidents, preserve evidence, contain exposure and document notification, remediation and reporting effects.

Primary Output Link: H.4-O03

Expected outputs · 3

H.4-O01

Sensitive-information classification and handling plan

Output Type: Professional work product

H.4-O02

Access, transfer, retention and disclosure-treatment record

Output Type: Professional work product

H.4-O03

Information incident, escalation and remediation record

Output Type: Professional work product

Proficiency indicators

Level 1 · Foundation

H.4-L1-01

Can follow established classification and handling rules, maintain access and transfer records and identify obvious sensitive-information risks.

Indicator Dimension: Task execution

H.4-L1-02

Can recognise when legal, privacy, privilege, security or market-sensitive review is required and escalate before access, sharing or publication.

Indicator Dimension: Quality, judgement and accountability

Level 2 · Practitioner

H.4-L2-01

Can independently design and operate information-handling controls for a moderately complex reporting workstream involving sensitive data and external contributors.

Indicator Dimension: Task execution

H.4-L2-02

Can determine routine protection and disclosure treatments, respond to incidents and explain residual limitations to owners and reviewers.

Indicator Dimension: Quality, judgement and accountability

Level 3 · Advanced Practitioner

H.4-L3-01

Can design or critically review organisation-wide reporting information-protection governance across complex groups, jurisdictions, channels and providers.

Indicator Dimension: Method design and review

H.4-L3-02

Can coordinate resolution of significant transparency-versus-protection conflicts, challenge overbroad confidentiality and advise governance bodies on incidents, legal review and residual reporting risk.

Indicator Dimension: Leadership and governance

Illustrative evidence · 6

H.4-E01

Sensitive-information classification and handling plan.

Evidence Type: Work product

H.4-E02

Access, transfer, retention and disclosure-treatment record.

Evidence Type: Work product

H.4-E03

Information incident, escalation and remediation record.

Evidence Type: Work product

H.4-E04

Access, redaction, sharing, review, retention, deletion and incident trail.

Evidence Type: Process evidence

H.4-E05

Documented legal, privacy, security, records, market-conduct or management review and the practitioner's response.

Evidence Type: Review evidence

H.4-E06

Observed response to a confidentiality, personal-data or market-sensitive information scenario.

Evidence Type: Observed performance

Assessment · 3

H.4-A-L1

Information-classification exercise, handling scenario and situational judgement

Classification accuracy; minimum necessary use; protection and disclosure balance; escalation.

H.4-A-L2

Integrated sensitive-information case and written professional memorandum

Handling design; legal and privacy interfaces; disclosure balance; incident and third-party controls.

H.4-A-L3

Complex protection-and-transparency case, portfolio and oral defence

Method design; transparency and protection judgement; incident governance; senior communication and oral defence.

Relationships · 12

From	To	Type	Rationale
A.4	H.4	Risk and control linkage	Organisational records may contain confidential, personal or market-sensitive information requiring controlled handling.
B.6	H.4	Risk and control linkage	Sensitive social evidence requires confidentiality, privacy, consent and protected handling.
B.7	H.4	Risk and control linkage	Conduct information may involve privilege, confidentiality, personal data and market sensitivity.
C.4	H.4	Risk and control linkage	Sensitive inputs require confidentiality, consent, privacy and protected handling.
E.4	H.4	Professional conduct and collaboration linkage	Source access and collection may involve confidential, personal or market-sensitive information.
G.9	H.4	Professional conduct and collaboration linkage	Sensitive information requires confidentiality, privacy, privilege and information-protection controls.
H.4	G.9	Disclosure, claims and publication linkage	Sensitive-information treatment should preserve transparent and non-misleading uncertainty and limitation disclosure.
H.4	E.9	Evidence and traceability linkage	Metadata, versions, access and retention support protected and traceable information handling.
H.4	I.8	Digital and technology linkage	Technology-specific privacy, confidentiality and security controls support professional information handling.
H.4	F.4	Evidence and traceability linkage	Working papers and evidence packs require controlled access, retention and sensitive-information treatment.
H.4	H.6	Professional conduct and collaboration linkage	Information incidents, misuse and retaliation-sensitive evidence may require protected escalation.
I.8	H.4	Professional conduct and collaboration linkage	Digital and AI information controls implement confidentiality, privacy and sensitive-information responsibilities.

Role profiles for this unit

Role	Target level	Relevance	Evidence expectation
Corporate Sustainability Reporting Practitioner	Practitioner	Required?	A case or work sample demonstrating independent performance, documented judgement and a reviewable professional output.
Sustainability Reporting Manager or Lead	Advanced Practitioner	Role-defining?	A complex case or verified portfolio, supplemented by oral or observed defence, demonstrating method design, challenge and governance capability.
Sustainability Reporting Adviser or Consultant	Advanced Practitioner	Role-defining?	A complex case or verified portfolio, supplemented by oral or observed defence, demonstrating method design, challenge and governance capability.
Sustainability Data, Systems and Controls Specialist	Advanced Practitioner	Role-defining?	A complex case or verified portfolio, supplemented by oral or observed defence, demonstrating method design, challenge and governance capability.
Assurance Readiness and Reporting Quality Specialist	Advanced Practitioner	Role-defining?	A complex case or verified portfolio, supplemented by oral or observed defence, demonstrating method design, challenge and governance capability.
Investor, Capital Markets and Ratings Disclosure Specialist	Advanced Practitioner	Role-defining?	A complex case or verified portfolio, supplemented by oral or observed defence, demonstrating method design, challenge and governance capability.