Data Classification: Public, Internal, Confidential, Restricted

Data classification is the process of organizing data into categories based on its sensitivity and the impact of unauthorized disclosure, modification, or loss. Classification drives every downstream security decision: what encryption is required, who can access the data, how it must be stored and transmitted, and how long it must be retained. Without classification, organizations apply either too many controls (wasting resources) or too few (leaving sensitive data unprotected).

Most commercial organizations use four classification levels. Public data can be freely shared with anyone — marketing materials, press releases. Internal (or Private) data is not secret but should not be shared outside the organization — employee directories, internal policies. Confidential data requires protection because unauthorized disclosure harms the organization — financial reports, contracts. Restricted (or Highly Confidential) data carries the strictest controls — trade secrets, PII, protected health information, credentials.

Government classification systems differ from commercial ones. US government data is classified as Unclassified, Controlled Unclassified Information (CUI), Confidential, Secret, and Top Secret. Top Secret/SCI (Sensitive Compartmented Information) is the highest level, requiring specialized facilities (SCIFs) and background investigations. The Security+ exam tests both commercial and government classification schemes and the clearance processes that accompany government classifications.

The data owner (a senior business role, not the IT team) is responsible for classifying data and ensuring appropriate controls are applied. The data custodian is the IT professional who implements and maintains controls on behalf of the owner. This distinction is important: the owner makes the classification decision; the custodian enforces it. When data owners are not engaged, data often remains unclassified or defaults to the lowest tier, creating hidden risk in high-value datasets.

Once data is classified, labels must be applied so handlers know the requirements. Digital labeling includes metadata tags, file properties, document headers, footers, and watermarks. Physical labeling applies to printed documents, storage media, and equipment. Each classification level carries specific handling rules: Restricted data may require encryption in transit and at rest, dual-person access for backups, shredding rather than recycling, and prohibition on cloud storage services not approved by the security team.

Classification directly determines encryption requirements. Public data typically needs no encryption. Internal data should be encrypted in transit (TLS). Confidential data requires encryption both in transit and at rest, with access logs. Restricted data typically requires strong encryption (AES-256), hardware security modules (HSMs) for key management, field-level database encryption, and regular key rotation. Data Loss Prevention (DLP) tools use classification labels to trigger alerts or block transfers of sensitive data.

Classification informs access control decisions at every layer. Restricted data should only be accessible to individuals with a demonstrated need to know, implemented through role-based or attribute-based access control. Classification also affects privileged access management: a database administrator who could technically access all tables should be restricted from restricted-classification tables unless their role explicitly requires it. Access reviews should re-verify that no user retains access above their need.

PII is any data that can identify a specific individual — name, address, Social Security Number, email, phone, biometric data, or device identifiers. PII typically falls into the Confidential or Restricted classification tier. Organizations must map where PII lives (data discovery), classify it appropriately, apply controls mandated by regulations (GDPR, CCPA, HIPAA), and define retention and disposal rules. Sensitive PII — financial, health, biometric — carries stronger protections than general PII.

PHI is any individually identifiable health information protected by HIPAA. It includes diagnoses, treatment records, billing codes, and any data linkable to a patient. PHI is always classified at the Restricted tier and requires: encryption, audit trails, minimum necessary access, business associate agreements (BAAs) with vendors, and breach notification within 60 days of discovery. A breach of PHI triggers regulatory obligations that a breach of Internal-classified data would not.

Classification applies throughout the data lifecycle. When data reaches the end of its retention period, it must be destroyed according to its classification level. Restricted data requires cryptographic erasure (destroying encryption keys), degaussing (magnetic destruction), physical shredding, or NIST 800-88-compliant purging. Simply deleting files or reformatting drives is not sufficient for confidential or restricted data because file recovery tools can reconstruct it.

Data Loss Prevention (DLP) tools enforce classification policies automatically. Content inspection DLP scans files and network traffic for patterns that match classification criteria (SSNs, credit card numbers, health keywords). Endpoint DLP prevents classified data from being copied to USB drives or uploaded to unapproved cloud services. Network DLP inspects outbound traffic. Machine learning-based classification tools can auto-tag unstructured data like documents and emails based on content analysis.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: data classification organizes data into Public, Internal, Confidential, and Restricted tiers based on sensitivity and impact, data owners make classification decisions while custodians implement controls, and classification drives encryption, access control, and destruction requirements for each tier. Next up we explore GDPR principles and data subject rights.