What it means
Classification turns an assessment of data sensitivity and business importance into handling rules. Labels such as public, internal, and confidential are useful only when people understand what each means for access, sharing, storage, retention, and disposal. The scheme should consider harm from alteration or loss as well as disclosure: a public safety schedule may not be secret but still need strong integrity protection. Data owners help make these decisions because they understand its purpose and consequences. Labels should follow copies and exports where the supporting systems allow it.
AN ILLUSTRATIVE SCENARIO
A university separates research datasets
A university publishes aggregate research results but restricts the participant records used to produce them. The research owner identifies which fields could reveal individuals and records who may access the working dataset. Staff use an approved transfer process for collaborators and retain records according to the agreed schedule. Before publishing a chart, they assess whether a small group could expose a participant despite removal of names. Marking a file public is a decision requiring review, not a technical act that removes sensitivity.
Put it to work
- Create a small, understandable set of categories with data-owner input. Define the potential harm each category represents and give recognizable examples from the organization's actual work.
- Connect each category to concrete handling requirements, including permitted recipients, access, storage, sharing, retention, and disposal. Make the approved way to perform common tasks practical for staff.
- Apply labels to important datasets, verify how exports inherit them, and review classifications as use changes. Give staff a route to resolve uncertainty or challenge an incorrect label.
How to check your work
Select one dataset and follow it through creation, sharing, export, and deletion. Ask its owner and a typical user to explain the handling rule, then check that the configured permissions and retention actually match that rule.
Connect the ideas
- DLP
Controls that detect or block sensitive data leaving a channel such as email, web, or endpoint.
- Confidentiality
The property that information is available only to people or systems authorized to see it.
- Integrity
The property that data and processes remain complete and unaltered except by authorized action.