Data Classification

After this lesson, you will be able to: Classify data into tiers and understand why classification drives every other control.

You can't protect what you haven't categorized. Data classification assigns sensitivity tiers, public, internal, confidential, restricted, and each tier triggers specific controls (encryption, access, retention).

Prerequisites:What is Data Leakage?

The four standard tiers

Public, anyone can see (marketing pages, press releases). Internal, employees only (org charts, internal wikis). Confidential, restricted to specific roles (HR, financial reports). Restricted, strictly need-to-know (PII, source code, M&A docs, encryption keys).

How organizations actually classify

1
1. Define tiers in policy (CEO/CISO sign-off).
2
2. Create labels (Microsoft Purview, Google Drive labels).
3
3. Train employees: every new doc gets a label.
4
4. Use auto-classification (regex/ML) for legacy data.
5
5. Audit, sample documents, check labels match content.

PII, PHI, PCI

PII (Personally Identifiable Information): names, SSNs, emails. PHI (Protected Health Information): governed by HIPAA. PCI (Payment Card Information): governed by PCI-DSS. Each triggers its own legal requirements.

Quick Check

Where would a customer's home address fit?

Choose: Public, Internal, Confidential, Restricted.

←What is Data Leakage?

Back to Data Leakage Prevention

Encryption Fundamentals→