Data Classification.

The process of labeling data by sensitivity and value so that the right protection, handling, and retention controls can be applied consistently. It belongs to the Privacy & Data Protection category of cybersecurity.

The process of labeling data by sensitivity and value so that the right protection, handling, and retention controls can be applied consistently.

Data classification assigns labels (for example public, internal, confidential, restricted) to information based on regulatory requirements, business impact, and contractual obligations. Classifications drive downstream controls such as encryption, access management, DLP rules, retention schedules, and incident-response severity. Programs typically combine an authoritative policy, a labeling taxonomy, training, and tooling that supports user-driven, automated, or hybrid tagging in Microsoft 365, Google Workspace, or data platforms. Effective classification is anchored in a data inventory and a record of processing activities aligned to GDPR Article 30, ISO/IEC 27001 Annex A.5.12 and NIST SP 800-60, ensuring sensitive data is identified, tracked, and protected throughout its lifecycle.

Defences for Data Classification typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Information Classification, Data Labeling.