1. A security policy management server computer operated by a processor, comprising: a policy information storage that stores policy setting information, identification information of a policy in correlation with each other, and data type information which indicates whether data for which the policy is set is original or derived data which is created by deriving from existing data, the policy setting information including setting content of the policy corresponding to each of the data type information indicating whether data for which the policy is set is original data or derived data which is created deriving from existing data; a data information storage that stores identification information of data for which a policy is set in correlation with the identification information of the policy attached to the data when the data is original data and that stores, when the data is the derived data, identification information of data for which a policy is set in correlation with identification information of the data from which the derived data is created as information for identifying that the data is the derived data; and a searching unit that, in response to a searching request designating the identification information of data, determines that target data of the searching request is the original data when the identification information of the policy correlated to the data whose identification information is designated in the searching request is obtained by referring to the data information storage; determines that the target data of the searching request is the derived data when the identification information of the policy is not obtained; obtains the identification information of the policy correlated to the identification information of the original data identified by identifying the identification information of the original data from which the derived data is created, which is correlated to the identification information of the derived data; and returns setting content of the policy identified by searching the policy information storage based on the identified identification information of the policy and a data type of the target data of the searching request to an origin of the searching request.