Data Classification

Data classification is the operational bridge between policy ('we treat health data strictly') and systems ('this column is tagged HEALTH and triggers stricter access controls, longer retention, mandatory encryption at rest'). A good schema is small (typically four or five tiers: Public, Internal, Confidential, Restricted, Regulated) and augmented with regulatory labels (PII, SPI, PHI, PCI data, children's data). Each tier maps to concrete handling rules: encryption, access controls, logging, retention, erasure, transfer restrictions.

Under GDPR Article 32, DPDP Section 8(5), PDPA Protection Obligation and sector-specific rules (HIPAA, PCI DSS), classification is a prerequisite for proportionate controls — you cannot apply reasonable safeguards without knowing which assets are sensitive. Automated classification tools scan structured and unstructured data for PII patterns, dictionary matches and ML-identified categories, and tag assets at scale. Classification results feed the data catalog, the DSPM policy layer and the DSR response pipeline.