Glossary term
Data Classification
Subject: Technology, Cyber and Data, IT and Data Governance
Also known as: Information Classification, Data labelling
Data classification is the practice of sorting information into categories by sensitivity and value, such as public, internal, confidential and restricted, so that each category gets matching handling and protection rules.
Explanation
Not all data deserves the same protection, and treating it all alike is either wasteful or dangerous. Classification gives each item a label based on the damage its exposure, change or loss would cause, and the labels trigger rules. A restricted label might require encryption, limited access, no use of personal email and shorter retention, while a public label needs none. Schemes often use three to five levels. An owner usually decides the label, and tools can apply or suggest labels automatically by scanning for patterns such as card numbers. Labels travel with documents so that email filters, data loss prevention tools and access controls can act on them. Legal duties also shape the scheme, for example for personal data or trade secrets. Without classification, controls are applied by guesswork, and staff cannot tell what they are allowed to share.
Example
A consulting firm labels its documents as public, internal, client confidential or restricted. A draft merger analysis is marked restricted, so only the named project team can open it, and the mail system blocks it from being sent outside the firm. A marketing brochure, labelled public, can be shared freely.
Not to be confused with
- Data Governance
- Governance is the wider system of ownership and policy for data; classification is one tool within it that labels data by sensitivity.