1. A security policy management device comprising: a policy information storage that stores policy setting information and identification information of a policy in correlation with each other, the policy setting information correlating setting content of the policy to each data type information indicating whether data for which the policy is set is original data or derived data which is created deriving from existing data; a data information storage that stores identification information of data for which a policy is set in correlation with the data and identification information of the policy attached to the data, and that also stores, when the data is the derived data, information for identifying that the data is the derived data; and a searching unit that identifies, in response to a searching request designating identification information of data, identification information of a policy correlated to the data whose identification information is designated in the searching request by referring to the data information storage, identifies whether target data of the searching request is the original data or the derived data, and returns setting content of the policy identified by searching the policy information storage based on the identified identification information of the policy and a data type of the target data of the searching request to an origin of the searching request.