Home / Knowledge hub / Data classification
Knowledge hub
Data classification
Labelling data by how sensitive it is so each kind gets the right protection.
What it means
Data classification is the practice of sorting your information into a few named levels based on how sensitive it is, and attaching rules to each level. A common set is public, internal, confidential and restricted. Each label stands for a different level of harm if the data leaks.
The level says what happens next: who may see it, whether it must be encrypted, where it may be stored, how long it is kept, and whether it can be sent to a supplier. Without labels, those decisions are made case by case, and unevenly.
Why it matters
Treating everything as top secret is unworkable, and treating everything as ordinary leaves the valuable parts exposed. Classification lets you spend effort where harm would be greatest. Customer payment details and health records get strong controls. The public price list does not need them.
It also underpins compliance. Laws such as the GDPR and standards such as ISO 27001 expect you to know what data you hold and protect it in proportion. NIST's FIPS 199 does this by rating the impact of loss of confidentiality, integrity and availability as low, moderate or high.
How it shows up
You meet it in a policy with a short table of levels and examples, in labels on documents and storage buckets, in database columns tagged as personal data, and in access rules that depend on the label. Good practice keeps the number of levels small, because people will not apply six.
The usual gaps are data nobody has classified, copies in logs, exports and test environments that escape the controls of the original, and labels that are never enforced. Start with an inventory of where personal data lives. Then link each level to a real control, such as access limits or masking in non-production systems.
Questions people ask
Data classification, answered
How many classification levels do we need?
Three or four is typical. For example public, internal, confidential and restricted. More levels make the scheme hard to apply and rarely add protection.
Each level should lead to different handling rules.
Who decides the classification of data?
The data owner, the person or team accountable for it, usually decides, guided by policy and legal duties. Security sets the framework and helps with edge cases.
Engineers should not have to guess in the middle of a project.
Is data classification the same as data discovery?
No. Discovery finds where data lives and what it looks like. Classification decides how sensitive it is and what rules apply. Discovery is often the first step.
Tools can suggest labels, but a person should agree them.
Does classification apply to test data?
It should. Copies of real data in staging or analytics carry the same sensitivity as the original. Use masked or synthetic data where possible.
Test environments are a frequent source of leaks.
How does classification help during an incident?
It tells you quickly how bad an exposure is. If the affected store held restricted data, you move to a higher response level and check notice duties.
Without labels you must work this out from scratch.
Related
Terms that sit next to this one
PII
Any data that points at a specific human being.
Data masking
Hiding part of a value, such as card digits, so most people only see a safe version.
Data minimisation
Collecting and keeping only the personal data you actually need.
Need to know
Limiting information to the people whose work actually requires it.
Data loss prevention
Tools and rules that stop sensitive data leaving where it should stay.
Where does your sensitive data show up?
Sensitive records often leak through search, export and detail views. We check what each signed-in account can reach that it should not, and report it with proof. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.