Data Classification and Sensitivity Labeling

Executive summary

Every protection decision about data presupposes a classification decision. Encryption, access policy, monitoring intensity, masking, retention and the permission to share all depend on knowing how sensitive an item is and which obligations attach to it. Without classification, a platform can apply only one setting to everything, which is either too weak for regulated data or too expensive for the rest. Classification makes the decision explicit, and labeling records it on the data itself so that every system the data passes through can read it.

This paper argues for a small scheme with consequences: a handful of harm-based sensitivity levels, a separate set of categorical tags for the regimes that impose specific rules, and labels that trigger automated controls from the first wave rather than after the whole estate has been inventoried.

• Four levels (Public, Internal, Confidential and Restricted) serve most organizations, provided each has a written test so that two people classify the same item the same way.
• Categorical tags such as personal data, special categories, protected health information, cardholder data and export-controlled data identify which rules apply. Tags combine, and the strictest applicable rule wins.
• No single discovery method is sufficient. Pattern matching, exact data matching and machine-learning classifiers each have a distinct error profile, and owner declaration and lineage inheritance supply the context that scanners cannot see.
• Labels must persist in file metadata, platform tags and catalog entries, and follow data into copies, exports, data products and machine learning training sets.
• Access policies, dynamic masking, data loss prevention, encryption, retention and sharing controls should all read the label; a label that triggers no control is documentation, not protection.

The later sections divide the work among owners, stewards, security and privacy teams and platform engineers, list the events that should trigger reclassification, define four metrics and lay out a staged roadmap in which enforcement begins with the first wave.

Why classification comes first

You cannot protect, retain or share data correctly if you do not know what it is, where it is and which rules apply to it.

Every downstream control assumes that a classification decision has already been made. Four disciplines depend on that one decision:

• Security needs sensitivity to decide encryption, access and monitoring.
• Privacy obligations attach to personal data and special categories wherever they are copied.
• Retention and disposal depend on the record category and on any legal holds that apply.
• Sharing and AI use depend on knowing what a dataset contains before it leaves its home.

Without a label, a platform cannot tell regulated data from routine data. Privacy obligations under the General Data Protection Regulation (GDPR) follow personal data into every copy, so an organization must know which fields and files contain it in order to answer data subjects' access requests (Article 15), maintain records of processing activities (Article 30) and apply security appropriate to the risk (Article 32). Defensible disposal depends on knowing each asset's record category, and sharing with partners, publishing data products and training or grounding machine learning models all require knowing what a dataset contains before it leaves the environment where it was created.

Established frameworks treat classification the same way. ISO/IEC 27002, which gives guidance on the information security controls referenced in ISO/IEC 27001, includes controls for classifying information according to its protection needs and for labeling it in line with the adopted scheme. DAMA-DMBOK treats classification as a core data security activity, in which confidentiality levels and regulatory categories are assigned as metadata that security controls then use. The rest of this paper shows how to do it well.

Designing the scheme

A classification scheme has three parts: sensitivity levels that say how much care an item needs, categorical tags that say which specific rules apply, and handling rules that turn both into required behavior. Keeping the parts separate is what keeps the scheme small enough to use.

Four sensitivity levels are usually enough

Sensitivity levels express how much harm disclosure would cause, and that is the only question they should answer. Four levels serve most organizations: Public, Internal, Confidential and Restricted. Three is workable for smaller estates, and five is a practical maximum, because beyond that users cannot distinguish adjacent levels and begin to classify arbitrarily.

Each level needs a written test with examples, so that two people classify the same item the same way, and the default for unlabeled business information should be Internal. Restricted should be earned by a documented reason, because every Restricted item carries handling cost, and a scheme in which everything is Restricted protects nothing in particular. DAMA-DMBOK distinguishes confidentiality levels from regulatory categories, and this paper follows that split: the level says how much care an item needs, and the categorical tags described below say which specific rules apply. Impact-based schemes in the public sector follow the same harm-based logic. In the United States, FIPS 199 has federal agencies categorize information and information systems as low, moderate or high impact according to the potential harm from a loss of confidentiality, integrity or availability.

The written test works best as a short sequence of questions that an owner can answer in a minute, asked in order of severity, as in the illustrative test below. The examples attached to each question matter as much as the wording, and they should be drawn from the organization's own data.

Handling rules by level

Handling rules are what make a level meaningful. For each level the organization states, as policy, how data may be stored and whether it must be encrypted, with whom it may be shared and through which channels, how long it is retained and how often access is reviewed. The table below shows an illustrative set. Each organization sets its own, its security and privacy policies are authoritative, and they will add detail such as approved systems, key management and logging.

Two design points matter. First, the rules should be enforceable by platforms rather than by goodwill, which is the subject of the section on labeling and enforcement. Second, categorical tags refine the rules. A Confidential dataset that also carries cardholder data inherits the PCI DSS requirement that stored primary account numbers be rendered unreadable, and a Restricted dataset containing export-controlled technical data limits access by nationality and location as well as by role. Exceptions must be requested, approved, time-limited and recorded, so that a departure from a handling rule is a visible decision rather than a silent gap.

Categorical tags carry the rules

Categorical tags identify the specific regime that applies, independently of the sensitivity level. The table below lists the tags most organizations need; sector and jurisdiction add others.

Personal data, under GDPR Article 4(1), is any information relating to an identified or identifiable natural person. Article 9 lists the special categories in full: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to uniquely identify a person, health data, and data concerning a person's sex life or sexual orientation. They may be processed only where one of the conditions in Article 9(2) applies, such as explicit consent, obligations under employment and social protection law, or substantial public interest, and Article 10 limits processing of personal data relating to criminal convictions and offences to official authorities or to processing authorized by law with appropriate safeguards.

Protected health information is individually identifiable health information that HIPAA covered entities (health plans, health care clearinghouses and health care providers that transmit health information electronically in connection with standard transactions) and their business associates hold or transmit in any form. Cardholder data under PCI DSS is the full primary account number, alone or together with the cardholder name, expiration date or service code. Sensitive authentication data, such as full magnetic stripe or chip data, card verification codes and PINs, is a separate category that must not be stored after authorization, even if encrypted.

Financial, intellectual property, export-controlled and third-party tags capture obligations from securities law, trade secret protection, export regulations and contracts. Trade secret law in both the United States and the European Union protects information only where its holder has taken reasonable steps to keep it secret, so classification and labeling also serve as evidence that those steps were taken. Export controls such as the US International Traffic in Arms Regulations (ITAR) and Export Administration Regulations (EAR) treat the release of controlled technical data or technology to a foreign person, even within the United States, as an export, which is why the tag restricts access by nationality and location. Organizations in other sectors add tags for their own regimes, such as nonpublic personal information under the Gramm-Leach-Bliley Act for US financial institutions, education records under the Family Educational Rights and Privacy Act (FERPA), or Controlled Unclassified Information for organizations that handle US federal information. Tags combine, and the strictest applicable rule wins.

Discovery and classification

Classification depends on finding the data first and then deciding what it is. Automated discovery scales across the estate but sees only content; owners, lineage and review supply the context that content alone cannot reveal.

Three families of automated discovery

Automated discovery uses three families of technique, which differ in what they can see and how often they are wrong.

Pattern matching applies regular expressions, checksums and keyword dictionaries. It is cheap, fast and explainable, and it works well for formatted identifiers such as payment card numbers (whose check digit can be validated with the Luhn algorithm), national identifiers and email addresses, but it produces false positives on numeric columns and misses names and free text. Exact data matching compares content against hashes of known values from a source of truth, such as the customer master or the employee register, and finds copies of those records anywhere in the estate with very high precision. Because the reference values can be hashed before they are loaded, the scanning service need not hold a readable copy of the source, but the method cannot recognize data it has never seen and depends on a secure, current reference set. Document fingerprinting applies a similar idea to documents, detecting files that match the structure or text of a known form or original. Machine-learning classifiers, whether trained in-house or pretrained, assess content and context and can identify sensitive material in documents and mixed fields without a fixed pattern, at the cost of labeled examples, threshold tuning and ongoing review for drift.

Most programs combine all three and treat their outputs as evidence to be weighed rather than as verdicts. A column whose values match a card number pattern, pass the checksum and sit in a table that serves payments is strong evidence; a single pattern hit in a free-text field is a candidate for review.

Methods the scanners cannot replace

Scanners see content; they do not know purpose, contract or provenance. Four complementary methods fill the gap.

Owner declaration works because the accountable person knows what scanners cannot: why the data was collected, under which contract and what exposure would cost; disagreements between owner and scanner go to a steward. Inheritance is the default for anything derived, using lineage captured from pipelines and catalogs, because a common classification failure is not a mislabeled source but an unlabeled copy: the extract, the report or the training set.

Downgrades deserve particular care. Aggregation and masking can genuinely reduce sensitivity, but pseudonymization lowers risk without removing the personal data tag: under the GDPR, pseudonymized data that can be attributed to a person by using additional information remains personal data for anyone who holds, or can reasonably obtain, that information. A downgrade review therefore records the technique, the residual re-identification risk and which tags, if any, are removed, rather than simply lowering the level. For unstructured content, optical character recognition and natural language processing bring scanned images and free text within reach of inspection, defaults cover the volume inspection cannot reach quickly, and labeling at creation keeps new content from adding to the backlog.

Tuning for precision or recall

Every classifier trades precision against recall. Precision is the share of items labeled sensitive that really are; recall is the share of truly sensitive items that were labeled. Raising a confidence threshold improves precision and lowers recall, and the right balance depends on the costs of the two errors, which differ by category.

For protected health information, cardholder data and special categories, a missed item can mean a reportable breach, so recall is favored and owners downgrade on review. For ordinary internal documents, a flood of false alarms teaches users to ignore labels and buries analysts, so precision is favored. Where both costs are high, automation casts a wide net and routes uncertain hits to human review before controls fire. Where both are low, default labels by location and owner, verified by periodic sampling, are enough.

Precision and recall should be measured from sampled audits per category, because tuning without measurement is guesswork. Estimating recall requires sampling items the classifier did not flag as well as those it did, since missed items are by definition absent from the labeled set; a reviewer classifies the sample independently, and the disagreements yield both measures.

Labeling and enforcement

A classification decision has value only if it travels with the data and causes something to happen. Labeling is the mechanism for the first and enforcement for the second.

Where labels live

A label is useful only where the data goes, so persistence is the central design requirement. The figure below shows the places a single classification decision has to reach.

Document and email sensitivity labels, applied by productivity suites, are stored in the file's metadata for supported formats, so they survive renaming, copying, attachment and download, and they can carry encryption and usage restrictions with the item. Column- and table-level tags live in the data warehouse, lakehouse or catalog and follow the object through views, clones and derived tables only when the platform or the lineage service propagates them, which is worth testing rather than assuming. Exports, extracts and downloads either carry the label into the target or are blocked when the target cannot hold one, and data products and application programming interfaces (APIs) expose the label in their contracts. Mechanisms differ by product; the requirement that the decision travels with the data does not.

Structured data and unstructured content

Structured data and unstructured content need different labeling mechanics, and most organizations run both. The table below compares them.

The decisive feature on the structured side is that policy binds to the tag rather than to the object: masking, row filters and access grants are written once against a tag, so a table that receives the tag is protected on creation. On the unstructured side, the label protects the item itself wherever it travels, which matters because documents leave governed repositories far more often than tables do. Legacy content on both sides is labeled in priority order, starting with the locations most likely to hold regulated data.

From discovery to enforcement

The work forms a loop of five stages rather than a one-time project.

Discovery covers shadow copies in file shares and personal workspaces as well as the systems of record, because nothing can be classified that has not been found. Classification draws on scanners, owner declaration and inheritance, with low-confidence results routed to review. Labeling writes the decision to the object itself: policy tags on columns, sensitivity labels on files and catalog metadata for search. Enforcement is where value is realized, as access, masking, data loss prevention, encryption and retention policies act on the label without a manual step. Monitoring measures coverage, accuracy and violations, rescans assets when they change and feeds corrections back into classifiers and decision trees. The loop never finishes, which is why the operating model and review triggers described later matter as much as the initial scan.

Controls that a label can trigger

Labels earn their cost through the controls they trigger. Six kinds of control can read a label directly.

Attribute-based access control (ABAC), as described in NIST SP 800-162, decides each request by evaluating attributes of the subject, the object and the environment against policy, which is exactly what a label makes possible. The label is an object attribute, so a rule such as "Restricted data requires an approved purpose and a managed device" can be enforced without maintaining a separate grant for every table. Dynamic masking leaves data usable for analytics while hiding raw values from roles without a need to see them; where hashing is used, it should be keyed, because unkeyed hashes of predictable values such as account or national identification numbers can be reversed by trying every possible value.

Data loss prevention (DLP) is most effective when it reads labels rather than re-inspecting content at every boundary, and its actions (block, warn with a justification, or log) should be graduated by level so that users are not trained to click through warnings. Retention triggers matter for a different reason: when archival and disposal run from the same metadata that drives protection, the organization keeps one record of what each asset is. Each control should be wired to a label before the program scales coverage, because labels that change nothing decay.

A label that triggers no control is documentation, not protection.

This principle is the test for every classification investment. An inventory of labeled assets is valuable for audits, records of processing and risk assessments, but it does nothing to stop an incident until a control reads the label automatically. Programs that spend their first year labeling and defer enforcement to a later phase usually find that the labels have decayed by the time enforcement arrives, and that users have learned to treat labels as decoration. The better sequence is narrow and complete: label a bounded set of systems and categories, wire each label to at least one automated control, prove that the control fires, and then expand. Enforcement also improves classification quality, because owners take labels seriously once labels change who can see what.

Operating model, review and metrics

Classification fails when it is assigned to a single team. Security cannot know the purpose of every dataset, owners cannot run scanners, and platform teams cannot decide what the rules should be. The operating model divides the work so that each group does what only it can do.

Who classifies, who curates, who enforces

Data owners classify because they know the purpose, the contracts and the consequences of exposure, and they answer for misclassification in their domain. Data stewards curate: beyond resolving conflicts between scanner output and owner declarations, they map tags to business glossary terms so that a tag means the same thing in every domain. Security, privacy and records teams define the rules and approve changes to thresholds and exceptions, while platform and security engineering enforce them and report coverage, accuracy and violations. Each role needs a named person for every crown-jewel system, meaning the small set of systems whose compromise would do the most damage.

Review cadence and reclassification triggers

Classification is a continuous process, and the table below lists the events that should trigger a review.

The triggers fall into three groups. Time-based triggers (periodic review and retention milestones) keep labels from aging silently. Change-based triggers (new obligations, data movement and derivation) catch the moments when labels are most often lost. Evidence-based triggers (incidents, audit findings and falling scanner confidence, visible in sampled accuracy) turn failures into tuning. Each trigger has a named role, and the catalog records every review, so that the organization can show when a label was last confirmed.

Measuring the program

Four metrics are enough to run the program.

Coverage is reported separately for structured and unstructured data, because unstructured repositories usually lag: their volume is larger and their content is harder to assess. Long times to classify indicate that labeling happens after the fact rather than at creation or registration. Violations should trend down as behavior adapts, although a rise immediately after a control is switched on is expected. All four should be reported to leadership quarterly, alongside incident metrics, so that the capability stays funded after the project phase ends.

Pitfalls, readiness and roadmap

Pitfalls and their countermeasures

The same pitfalls recur in most classification programs, and each has a known countermeasure.

None of these countermeasures requires new technology; they require sequencing and ownership. The most damaging combination is the second and third pitfalls together: a program that labels for a year before enforcing anything spends its credibility before it delivers any protection.

Readiness checklist

Handling rules must be approved as policy, because platforms enforce policy, not intentions. The inventory defines the denominator for coverage, and a control reading each label before rollout gives labels consequences from the first day.

A staged roadmap

The roadmap sequences the work so that enforcement begins early. Durations are indicative and vary with the size of the estate and the tooling already in place.

The first wave scans for regulated categories such as personal data, health information and cardholder data, and wires the first controls to those labels, typically masking and access policies in the main data platform and DLP for email and file sharing. The expansion phase reaches unstructured repositories in priority order and turns on lineage inheritance, so that derived data is covered automatically. The sustain phase runs continuous rescans and tuning against the four metrics. The sequence, and especially the early enforcement, matters more than the months.

Where to start

Four actions start the program.

1. Approve the scheme. Agree a four-level scheme and the categorical tags with security, privacy and legal, and publish the handling rules as policy.
2. Label the first wave. Inventory and label the crown-jewel systems and the regulated data in a first wave small enough to finish.
3. Wire the controls. Connect masking, access and data loss prevention policies to those labels before expanding coverage, so that the first labels have consequences.
4. Report the metrics. Report coverage, accuracy, time to classify and violations each quarter to the governance council and the security committee.

Classification is the metadata decision on which every protection, privacy and retention control depends. Organizations that keep the scheme small, combine discovery methods, make labels persist and wire them to controls know what they hold and can prove it. Knowing what it holds is the precondition for every promise an organization makes about its data.

Glossary

Data classification

The assignment of a sensitivity level and any applicable categorical tags to a data asset.

Sensitivity level

A grade, such as Public, Internal, Confidential or Restricted, that expresses how much harm disclosure would cause.

Categorical tag

A label identifying a specific regulatory, contractual or business regime that applies to data, such as personal data or cardholder data.

Sensitivity label

The machine-readable record of a classification decision, attached to a file, message, table or column.

Policy tag

A tag on a column or table that masking and access policies evaluate at query time.

Crown-jewel system

One of the small set of systems whose compromise would cause the organization the most harm.

Exact data matching

A discovery technique that compares content against hashes of known values from a source of truth.

Precision

The share of items labeled sensitive that really are sensitive.

Recall

The share of truly sensitive items that were labeled as sensitive.

Lineage inheritance

The propagation of labels from source data to the tables, extracts, reports and models derived from it.

Pseudonymization

Processing personal data so that it can no longer be attributed to a specific person without additional information that is kept separately and protected.

Data loss prevention (DLP)

Controls that inspect data in use or in motion and block, warn or log according to its label and destination.

Dynamic data masking

Masking, tokenizing or hashing values at query time for users who do not need to see the raw data.

Attribute-based access control (ABAC)

Access control that grants or denies requests by evaluating attributes of the subject, the object and the environment against policy.

Special categories of personal data

The types of personal data listed in GDPR Article 9, whose processing is prohibited unless a specific condition applies.