Data classification assigns a sensitivity level to information so that protection is proportionate - strong controls where they matter, light controls where they do not. It underpins access control, encryption, retention, DLP and incident severity. Get it wrong and you either over-protect everything (and people route around you) or under-protect the material that matters.
Four tiers, not six
Schemes fail when they are too granular for people to apply. Four levels is the practical sweet spot:
- Public - approved for release. Marketing material, published documentation, job adverts. Impact of disclosure: none.
- Internal - the default for everyday business information. Org charts, internal processes, general project material. Impact: minor.
- Confidential - customer data, personal data, contracts, financials, source code. Impact: significant - regulatory, contractual or competitive harm.
- Restricted - the small set where disclosure is severe: credentials and keys, special category personal data, payment card data, merger and acquisition material, security vulnerability details.
Make Internal the default. If nothing is chosen, information should land somewhere sensible rather than in the most permissive tier.
Handling rules per tier
A classification with no consequences is decoration. Define, for each tier:
- Storage - which systems are approved; whether encryption at rest is required.
- Transmission - encryption in transit, approved channels, whether external email is allowed.
- Access - role-based, need to know, whether approval is required, review frequency.
- Sharing externally - NDA required, approval authority, permitted platforms.
- Retention - how long it is kept and what triggers deletion.
- Disposal - secure deletion or destruction requirements.
- Incident severity - a Restricted data exposure should automatically be a SEV1.
Connect classification to your actual controls
GRC Copilot links your classification scheme to the controls and evidence that enforce it - access reviews, encryption, retention and DLP - across every framework you report against.
Try GRC Copilot free Generate an AI-powered assessment Download the template Book a demo
Who classifies, and when
- The information owner - the business function that creates or is accountable for the data - assigns the classification.
- Classify at creation, not retrospectively. Retrospective classification projects rarely finish.
- Inherit by container where possible: a repository, site or database gets a classification and its contents inherit it. This is what makes the scheme survivable at scale.
- Reclassify on change - and remember classification can fall as well as rise, for example when financial results are published.
- When combining data sets, apply the highest classification present.
Making it stick
- Keep the scheme to one page people can actually remember.
- Use concrete examples from your own business, not abstractions.
- Automate labelling where your tooling supports it, and use the labels to drive DLP and access policy.
- Start with Restricted data - find it, protect it, prove it. Do not attempt to classify everything at once.
- Train on it once at onboarding and once a year, with examples.
The test of a classification scheme is not whether it is comprehensive. It is whether an engineer can look at a file and say, without checking a document, which tier it belongs to.
Frequently asked questions
How many classification levels should we use?
Three or four. Beyond that, people cannot reliably distinguish the tiers and default to guessing, which produces inconsistent handling.
Is classification required by ISO 27001?
Yes - information classification and labelling are Annex A controls, and the NCA ECC, SAMA CSF and most other frameworks expect equivalent practice.
Do we need automated labelling tools?
Not to start. A clear scheme with container-level inheritance delivers most of the benefit. Automated labelling helps at scale and enables DLP enforcement.
What about personal data specifically?
Personal data usually sits in Confidential, with special category data in Restricted. Classification supports privacy obligations but does not replace your record of processing activities.
Key takeaways
- Four tiers, with Internal as the default.
- Every tier needs concrete handling rules or the scheme is decoration.
- Classify at creation and inherit by container to stay scalable.
- Start with Restricted data rather than trying to classify everything.