---
{
  "title": "Data classification",
  "summary": "Match handling to sensitivity, business value, and obligations.",
  "topic": "grc",
  "level": "Beginner",
  "updated": "2026-10-12",
  "units": [
    1
  ],
  "aliases": [],
  "sources": [
    {
      "title": "NIST: Cybersecurity Framework 2.0 FAQs",
      "url": "https://www.nist.gov/cyberframework/faqs"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## The idea

Data classification groups information according to its sensitivity and required handling. Labels should support decisions about access, sharing, storage, retention, and recovery. The scheme must be understandable and applied consistently. Classification is not solely confidentiality: criticality and integrity requirements matter too. Assign data owners who can resolve uncertainty and make appropriate handling decisions. Avoid collecting or sharing sensitive examples just to illustrate a label.

## In practice

An organization distinguishes public website copy from confidential employee records and applies different sharing and access rules.

## A common misunderstanding

A label alone does not enforce protection. Controls and workflows must implement the handling requirements.

## Check your understanding

What makes a classification scheme usable?

**Think it through:** Clear definitions, examples, ownership, and practical rules people and systems can apply.


## Classify information so handling can change

Classification groups information according to factors such as sensitivity, business importance, and obligations. The categories should lead to practical handling rules. If every label produces identical access, sharing, storage, and disposal behavior, the scheme may add effort without improving decisions. Keep it understandable enough for the people who use it.

An organization might distinguish public information from internal working material and more restricted records, but labels and boundaries vary. A file's format does not determine its sensitivity: a spreadsheet can contain public event dates or private assessment results. Context, purpose, and content matter more than the application used to create it.

## A fictional shared folder

An academy stores promotional brochures and student-support records in the same broadly shared folder. Classification helps the team recognize that these materials need different access and sharing arrangements. It separates the restricted records, assigns an owner, and explains the handling expectations to staff. Applying a label without changing access would not resolve the exposure.

Classification can change over time. A draft announcement may become public after release, while an aggregated dataset may remain sensitive if individuals can still be identified. Review the actual information and applicable obligations rather than assume that removing names always makes data anonymous.

## Classify with a reason

Create three fictional documents: a published course outline, an internal staffing plan, and an assessment record. Assign categories using a simple scheme you define. For each, explain the reason and one handling consequence, such as sharing restrictions or access approval. Then identify who can resolve uncertainty. A useful classification exercise produces a defensible action, not merely a colored label.

## Keep exploring

- [[cia-triad]]
- [[data-minimization]]
- [[access-control]]
- [[cloud-storage-security]]