data classification

The process of categorizing data by sensitivity level — typically Public, Internal, Confidential, and Restricted — to determine how it should be stored, accessed, and transmitted. Classification is the foundation that makes data governance, retention policies, and access controls enforceable.

When you'd see it: Data governance programs, privacy audits, new product data design, vendor security questionnaires.

Why it matters: Without classification, organizations can't enforce appropriate controls — teams either over-protect everything (friction) or under-protect sensitive data (risk).

Common mistakes: Creating a classification scheme without connecting it to access controls or retention policies, making the taxonomy theoretical rather than actionable.

Related data governance, PII, GDPR, access control