Data Classification
Also known as: information classification, data sensitivity classification, data labelling, information governance
Data classification is the process of organizing an organization's data into categories based on how sensitive it is and how much harm its unauthorized disclosure, modification, or loss would cause.
Each classification level is assigned a set of handling requirements -- who can access it, how it must be stored and transmitted, how long it must be retained, and how it must be disposed of. Common levels include Public, Internal, Confidential, and Restricted, though specific labels and the number of tiers vary by organization.
Data Classification, explained at three levels
At home
Data classification is about deciding how important different types of information are and treating them accordingly. Your name and the company's office address might be public information anyone can know. Your salary, your medical records, or a new product design are private and need protecting. By sorting data into categories -- like 'public', 'internal', 'confidential' -- your organization knows which files need extra security and which do not.
At work
Data classification allows your organization to apply security controls proportionate to the risk each type of data carries. Without classification, organizations either over-protect everything (expensive and obstructive) or treat all data the same (leaving sensitive information exposed). A classification policy defines the categories, who is responsible for classifying data, how data should be labelled, and what handling requirements apply to each category.
At home
A four-tier classification scheme is common: Public (information intended for general release -- press releases, product descriptions), Internal (intended for employees only -- internal procedures, org charts), Confidential (sensitive business information -- contracts, financial forecasts, personnel records), and Restricted (highest sensitivity -- cardholder data, patient records, trade secrets, authentication credentials). Data should be classified at the point of creation and reclassified when its sensitivity changes.
At work
Effective data classification requires both a policy framework and a practical labelling mechanism. Technology tools include: persistent data labels applied by data owners using tools like Microsoft Purview Information Protection, automated content inspection using DLP tools that identify PII or payment card patterns and apply labels automatically, and file system permissions that map to classification levels. Labels should be persistent and travel with the data -- an email classified as Confidential should retain that label when the recipient saves the attachment.
At home
Regulatory requirements often impose their own data categories on top of organizational classification. GDPR defines 'special categories of personal data' (health, race, religion, sexual orientation, biometrics) requiring heightened protection. PCI DSS defines cardholder data and sensitive authentication data. HIPAA defines PHI. An organization operating under multiple frameworks needs a classification scheme that maps to all relevant regulatory categories -- typically Restricted covers all regulated categories.
At work
From a practitioner standpoint, the most common classification failure is the data owner gap: technical tools can classify data based on content patterns, but only the data owner can make accurate sensitivity judgments for contextual information that automated tools cannot detect. A contract document may be Confidential because it covers pre-announcement merger terms, not because it contains structured data patterns. A pragmatic classification program combines automated scanning for known patterns with periodic manual reviews by data owners for high-value business information.
Real-world examples
At home
Priya's employer sent her home with a laptop that had Microsoft Purview installed. When she drafted a document containing employee salary information and tried to email it to herself, the DLP tool blocked the transfer and explained that salary data was classified as Confidential and could not be sent to personal email addresses.
At work
The information security team at Harrington Legal implemented a four-tier classification scheme. After training staff, a data discovery scan identified 12,000 unclassified documents in shared drives containing client names and case details. These were retrospectively labelled Confidential, access was restricted to the relevant practice groups, and an alert was configured for any attempt to move them to an unencrypted medium.
How it compares
| Classification Level | Typical Contents | Who Can Access | Key Controls |
|---|---|---|---|
| Public | Press releases, published reports, product descriptions | Anyone | Integrity controls; accuracy before release |
| Internal | Internal procedures, org charts, general business information | All employees | Basic access controls; no external sharing without approval |
| Confidential | Contracts, HR records, financial forecasts, client data | Role-based access only | Encryption at rest and in transit; DLP rules; need-to-know access |
| Restricted | Cardholder data, patient records, credentials, trade secrets | Strictly controlled, individually authorized | Strongest encryption; access logging; strict disposal; regulatory compliance |
The classification level determines the security investment applied to a piece of data. Restricted data carries the most regulatory and financial risk and requires the strictest controls. Public data requires attention to accuracy and integrity rather than confidentiality.
For analysts
Data classification is a foundational input for almost every security-related requirement a BA will document. Before specifying data storage, transmission, access control, or retention requirements for any system, ask what classification level the data belongs to -- this determines the encryption standard, the access control model, the DLP requirements, and the disposal method. When eliciting requirements for a new system, work with the data owner to classify each data element before designing the data model. Useful requirement: 'The system must enforce access controls that restrict Confidential data to users with a documented business need, with access requests approved by the data owner and reviewed quarterly.'
History & origin
Formal data classification has its roots in government and military information security, where classification levels (Unclassified, Confidential, Secret, Top Secret) were developed during World War II to control access to sensitive intelligence. These were codified in US Executive Order 10290 (1951) and updated through subsequent orders. Private sector data classification gained momentum in the 1980s and 1990s as organizations built corporate security programs. Regulatory requirements -- PCI DSS, HIPAA, ISO 27001 -- accelerated adoption by requiring organizations to identify and protect specific categories of sensitive information.