Data Classification

Data classification assigns each dataset or field to categories used as inputs to handling policies. Enforcement also needs approved purposes and rules, retention trigger events, applicable exceptions, and mappings from people to their records and locations. Unclassified data can still be automatically denied access or quarantined under a default policy.

Classification makes policy decisions more repeatable, but a label alone is not a complete decision. Two tables labelled personal may have different approved purposes, retention deadlines, and holds. The label also does not identify which derived rows belong to a particular person; that requires separate identity and location mappings.

Three questions, not one label

Schemes that use a single scale run into trouble quickly, because “sensitive” conflates distinct questions that have different answers and different consequences.

A financial report may be highly confidential without containing personal data. A business contact intentionally published for enquiries may be personal data with little confidentiality in that public context. A private home delivery address can have substantial exposure risk. Personal-data status alone does not determine confidentiality; classify the potential harm and derive access and retention rules from their respective grounds.

Keep the number of levels on each axis small. Three confidentiality tiers with sharp definitions get applied; five with overlapping ones produce guesses, and a guess recorded as a category is worse than a blank because the blank would have prompted a question.

How classification fails

Three failure modes account for most of it, and none produces an error message.

• Classified once, at creation. A field that was innocuous on its own becomes personal data when joined to another. Free-text note fields are the standard case: nothing in the schema says a comment column holds a customer’s medical history, and often it does.
• Applied to sources only. The source table carries labels; the twelve tables derived from it do not. Controls then stop at the first hop, and the copies people actually query are the unlabelled ones.
• Owned by nobody. Classification assigned by whoever built the pipeline reflects what that person knew about the data, not what the business considers sensitive — and there is no one to ask when it looks wrong.

Inheritance is the only scalable answer

Manual classification cannot keep up with a platform where derived tables appear weekly. The mechanism that can is lineage: if a dataset reads a field classified as personal, it inherits that classification by default, and a lower classification has to be recorded as a decision with a reason — the data was aggregated past re-identification, or the field was dropped before the output.

The asymmetry is deliberate. Inheriting upward automatically and downgrading only by decision means the failure mode is over-protection, which someone complains about, rather than under-protection, which nobody notices. And a recorded downgrade is exactly the artefact an auditor asks for, since purpose and accountability obligations require being able to show why data was handled as it was — GDPR Article 5(2) names its principle “accountability” and asks controllers to “be able to demonstrate compliance.”

Automated detection helps and does not substitute. Pattern scanners find card numbers and email addresses reliably, miss personal data in free text and in identifiers only meaningful internally, and cannot tell you whether a dataset is commercially confidential — which is a business judgment, not a pattern. Treat scanner output as a queue of candidates for a person to confirm, and expect it to reduce the work rather than remove it.

Finally, classification is worth nothing if the controls do not read it. Access rules written against classifications rather than table names are what make a new table carrying personal data protected because of what it contains — and the same labels are what a retention schedule and a deletion job consume. Coverage is therefore the measure to track: the share of datasets with an owner and a classification, not the number of datasets registered.

How classification feeds access, retention, and deletion across a platform is worked through in The Copy You Forgot.

References: Regulation (EU) 2016/679 (GDPR), EUR-Lex; ICO, Principle (e): Storage limitation.