Cyber Security Academy · Lesson

Data Classification and Minimization

Handling data responsibly.

Data Classification and Minimization is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Classify Data

You cannot protect what you have not categorized. Data classification assigns sensitivity levels so controls match risk: the more sensitive the data, the stronger the safeguards.

Classification drives access control, encryption requirements, retention periods, and breach-response priority.

Classification Levels

A common scheme uses four tiers:

Public: no harm if disclosed
Internal: routine business data
Confidential: customer data, contracts
Restricted: special-category data, secrets, credentials

Each level maps to required controls. Labels should be simple enough that staff actually apply them correctly.

Data Discovery

Before you can classify, you must find the data. Personal data hides in logs, backups, spreadsheets, support tickets, and forgotten databases (shadow data).

Discovery tooling scans stores for patterns like national ID numbers, card numbers, and emails to build an inventory.

# Simple regex sweep for emails and card-like numbers in a codebase/logs
grep -rEn '[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}' ./logs
grep -rEn '\b(?:[0-9]{4}[ -]?){4}\b' ./logs

Data Mapping

A data map traces personal data through its lifecycle: where it enters, where it is stored, who can access it, where it flows, and where it leaves.

Collection points (forms, APIs, SDKs)
Storage systems
Third-party processors
Deletion endpoints

You cannot honor an erasure request if you do not know every place a person's data lives.

The Minimization Principle

Data minimization means collecting and keeping only what is necessary for a specific, stated purpose.

Do not collect a field just because it might be useful someday
Do not log full payloads when an ID suffices
Do not retain data past its purpose

Less data means less breach impact, lower compliance burden, and reduced storage cost.

Minimizing in Practice

Concrete engineering moves:

Store a hash instead of the raw value where you only need to compare
Truncate or mask in logs (show only last 4 digits)
Aggregate analytics rather than storing per-user events
Use ephemeral processing that does not persist

# Mask a card number in application logs, keep only last 4
# 4242 4242 4242 4242  ->  **** **** **** 4242
sed -E 's/[0-9]{4}([ -]?[0-9]{4}){2}([ -]?)([0-9]{4})/**** **** **** \3/g'

Retention and Deletion

Storage limitation requires defined retention periods and actual deletion when they expire. Indefinite retention is a violation, not a convenience.

Set per-category retention schedules
Automate deletion jobs
Remember backups and logs, not just the primary database

# Automated retention: purge support tickets closed over 24 months ago
DELETE FROM support_tickets
WHERE status = 'closed'
  AND closed_at < NOW() - INTERVAL '24 months';

Access Control and Least Privilege

Classification only protects if access matches it. Apply least privilege: people and services get the minimum access needed for their task.

Role-based access tied to classification level
Just-in-time access for sensitive queries
Regular access reviews and revocation on role change

Restricted data should be accessible to as few identities as possible.

Encryption Tied to Classification

Higher classifications demand stronger protection:

Encryption at rest for confidential and restricted data
Encryption in transit (TLS) everywhere
Field-level encryption or tokenization for the most sensitive fields

Encryption also reduces breach-notification obligations: properly encrypted data may not constitute a reportable exposure.

Embedding It in the Pipeline

Classification and minimization work best as defaults in the development pipeline, not periodic audits.

Tag fields with sensitivity in the schema/data catalog
Lint for new PII fields in code review
Block logging of restricted fields via centralized loggers
Review data collection in design (Privacy by Design)

Backups and Shadow Copies

Minimization and deletion must reach beyond the primary store. Personal data persists in places teams forget:

Database backups and snapshots
Log aggregation and analytics pipelines
Cached exports and spreadsheets
Replicas and dev/test environments seeded with production data

An erasure request is not satisfied if the data still lives in last night's backup or a test database.

Quick Check

Test your understanding of minimization.

Recap

You learned responsible data handling:

Classify data into sensitivity tiers to drive controls
Discover and map where personal data lives and flows
Minimize: collect, log, and retain only what is necessary
Enforce retention/deletion, least privilege, and encryption by classification
Embed it all as pipeline defaults

Next: what to do when something goes wrong, breach notification and DPIAs.

Frequently asked questions

Is the “Data Classification and Minimization” lesson free?

Yes — the full text of “Data Classification and Minimization” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Data Classification and Minimization”?

Handling data responsibly. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Data Classification and Minimization” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cyber Security Academy