Data classification

What is data classification?

Data classification is the practice of sorting data by how sensitive it is and how much it matters to the business, and attaching a label that records the answer. A price list might be labelled public, an internal roadmap labelled internal, a customer's medical note labelled confidential, and a set of raw ID numbers labelled restricted. The label then drives how that data may be stored, shared, and protected.

Without classification, every file is treated the same, which means either everything is locked down so hard that work grinds to a halt, or nothing is, and sensitive records leak. Classification lets you match the level of protection to the level of risk. A public brochure and a spreadsheet of bank details do not need the same handling, and classification is how a system knows the difference.

Most organisations settle on a small number of levels. A common set runs public, internal, confidential, and restricted, from least to most sensitive. Microsoft's own starter suggestion uses names like personal, public, general, confidential, and highly confidential. The exact wording matters less than keeping the list short enough that people actually apply it correctly.

What each level decides

The point of a classification level is that a handling rule hangs off it. Once a record is labelled, systems and people know what they are allowed to do with it.

• Access. Who can open it. Restricted data might be limited to a named team, while internal data is open to all staff.

• Sharing. Whether it can leave the organisation, go to a personal email, or be posted to a chat channel.

• Storage and encryption. Whether it must be encrypted, kept in a specific region, or barred from personal laptops.

• Retention and deletion. How long it is kept and when it must be destroyed.

This is why classification is a foundation for data governance rather than a filing exercise. Retention policies, access controls, and data loss prevention all lean on the classification to decide what applies to what.

How data gets classified

Classification can be manual, automatic, or a mix. Manual classification asks the person who creates or owns a document to pick the right level, which works well for judgement calls but depends on people remembering to do it.

Automatic classification scans content and applies a level based on what it finds. Tools like Microsoft Purview use sensitive information types, which are patterns that recognise things like credit card numbers or national ID formats, and trainable classifiers that learn from examples of the kind of document you care about. When a scan finds PII such as an email address or a passport number, it can classify the item without anyone opening it.

In practice the two work together. Automatic scanning catches the obvious sensitive data at scale, and people override or refine the result where the context needs a human decision.

Classification versus sensitivity labels and masking

Classification is the decision about how sensitive something is. A sensitivity label is the tag that records and enforces that decision, and in the Microsoft world the label can also apply protection such as encryption or access limits that travel with the file. Classification is the judgement; the label is the mechanism that carries it around.

Data masking is a separate control that classification can trigger. Once data is marked confidential or restricted, you might mask it, showing only the last four digits of an account number, so people can work with it without seeing the sensitive parts. Classification tells you which data deserves masking; masking is one of the actions the classification sets off.

What to watch out for with data classification

Too many levels defeats the purpose. If people face seven near-identical choices, they guess, and the labels stop meaning anything. Keep the scheme small and the definitions concrete.

A label with no rule attached is decoration. Classifying data only helps if access, sharing, and retention actually change based on the level. If the confidential label does not restrict anything, it is a sticker, not a control.

Classification drifts. Data that was public last year might now combine with other fields to identify a person. Re-scan and review, especially when datasets are joined together.