Classifying Data

You cannot protect what you have not categorized. Data classification labels information by sensitivity so the right controls, access rules, and DLP policies apply. It is the foundation of DLP and most compliance programs.

A common four-tier scheme:

• Public: safe to share freely.
• Internal: for employees, low harm if leaked.
• Confidential: sensitive, restricted access.
• Restricted / Secret: highest sensitivity, strict controls.

Tie tiers to concrete examples so staff know where data fits:

• Public: marketing brochures.
• Internal: org charts, meeting notes.
• Confidential: customer PII, contracts.
• Restricted: card data, health records, secrets.

Some data carries legal weight:

• PII: personally identifiable information (GDPR).
• PCI: cardholder data.
• PHI: protected health information (HIPAA).

These usually map to Confidential or Restricted.

Classification becomes useful when it is labeled, attaching the category to the data so tools can act on it.

• Metadata labels stored with the file.
• Visual markings in headers/footers.
• Headers/tags in emails and documents.

Two approaches, often combined:

• Manual: the author picks a label at creation; accurate but inconsistent.
• Automated: tools scan content and apply labels by pattern; scalable but needs tuning.

Most organizations already have unlabeled data everywhere. Data discovery tools crawl file shares, databases, and cloud storage to find and classify existing sensitive data.

The label determines the handling rules:

• Restricted: encrypt, log access, block external sharing.
• Confidential: restrict to need-to-know.
• Public: no restrictions.

DLP policies reference labels to decide whether to block a transfer.

Each class should define how data is stored, transmitted, shared, and how long it is kept. Restricted data may require encryption and short retention; public data has none. Document this in a data handling standard.

Data sensitivity changes over time. A confidential earnings report becomes public after release. Define when and how data is reclassified or downgraded so controls stay proportionate.

Classification programs fail when:

• Too many tiers confuse users (keep it 3-4).
• Labels are not enforced by tooling.
• Legacy data is never discovered and labeled.
• No clear owner maintains the scheme.

Apply the classification tiers.

Classification is the foundation of data protection:

• Use a simple tiered scheme (Public to Restricted).
• Label data via metadata, markings, and tags.
• Combine manual and automated classification plus discovery.
• Let the label drive handling, retention, and DLP controls.