Data Classification

The process of organizing data into categories based on sensitivity, regulatory requirements, and business value to determine appropriate handling, security controls, and retention policies. Common classification levels include public (no harm if disclosed), internal (limited distribution within organization), confidential (restricted to specific business need), and restricted (highly sensitive, requiring maximum protection). For privacy compliance, classification often distinguishes personal data, sensitive personal data, children's data, health data, financial data, and other categories requiring specific protections. Data classification informs decisions about encryption, access controls, storage locations, retention periods, and transfer restrictions. Classification should be documented in data inventories and records of processing activities. Effective classification requires understanding regulatory definitions, assessing data sensitivity, considering context, and implementing consistent labeling and handling procedures. Proper classification is foundational for risk-based data protection.