Data Classification Basics

Information only — not legal advice.

Data classification gives people a practical way to decide how information should be handled. A label is useful only when it changes an action: where information may be stored, who may receive it, how it may be shared or how disposal is controlled.

Begin with the consequence of inappropriate disclosure, alteration or loss of availability. Sensitivity is not limited to personal data: tender prices, credentials, site-security details and unpublished designs can also need protection.

Use a small, understandable scheme

An illustrative scheme might distinguish Public, Internal, Confidential and Restricted information. These are example labels, not universal legal categories. Your organisation should define the meaning and handling rules before using them.

For each level, specify permitted audiences, approved storage and sharing methods, external-release authority and any additional safeguards. Make the rules short enough for users to apply without interpreting a policy document every time they send a file.

Avoid classifying everything at the highest level. Excessive restrictions can obstruct legitimate work and encourage uncontrolled workarounds.

Classify the actual package

Consider all content being released, including attachments, comments, hidden spreadsheet sheets, embedded metadata and linked records. A harmless cover page does not determine the sensitivity of the package behind it.

Assign an owner who can resolve ambiguity and authorise a change of classification. Review labels when the purpose or circumstances change. Information approved for public release may move to a different handling category, while combining several ordinary datasets can create a more sensitive result.

Example: sharing a supplier comparison

A fictional project team prepares a comparison of tender submissions. The internal working file includes prices, named evaluators, negotiation notes and bank details copied from source documents.

The external recipient needs only the approved technical comparison. The owner prepares a separate release containing the necessary fields, checks comments and hidden content, confirms the release authority and records the version sent. Changing the filename to “public” would not remove the sensitive information.

This is also a data-minimisation decision: it is often better to share less information than to send a larger package with a warning label.

Connect labels to controls

Where the tools support them, classification can inform access groups, sharing restrictions or review prompts. Check the actual behaviour with an authorised test account. A label displayed on a document is not itself an access control, and a downloaded copy may leave the original system's controls.

Teach users the difficult boundary cases with examples from their work. Provide a clear route for exceptions rather than forcing them to improvise.

Keep classification and retention separate

A confidential record may need to be retained for a legitimate obligation; a public draft may no longer be useful. Classification describes handling needs, while retention addresses how long information is kept and on what basis. Review both.

The NIST Cybersecurity Framework provides a broader risk-management context. For personal data, the GDPR applies principles including minimisation and storage limitation; a classification label alone does not demonstrate compliance. Continue with secure file sharing and retention and deletion.

Important information

This article provides general information and does not constitute legal advice or replace a qualified professional's assessment of your circumstances. Laws, official guidance, standards and product features can change. Check current primary sources and the requirements applicable to your jurisdiction, contract and project before making decisions. Examples illustrate the discussion; they are not official rulings or instructions for a particular case. For legal decisions, consult a qualified lawyer; for technical or other specialist matters, consult the responsible professional.