Data Classification

The primary axis for classification is the data's sensitivity and potential impact if compromised. This creates a tiered security model.

• Public: Data intended for open disclosure (e.g., marketing materials).
• Internal: Non-sensitive business data (e.g., internal memos, operational policies).
• Confidential: Business-sensitive data requiring protection (e.g., financial forecasts, strategic plans).
• Restricted: Highly sensitive data whose disclosure could cause severe harm, often regulated (e.g., PII, PHI, payment card data). Automated PII detection scans for patterns like social security numbers or email addresses to apply these labels.

Classification extends beyond security to include the data's role in business operations and decision-making.

• Critical Data Elements: Key identifiers and metrics vital for financial reporting or core processes (e.g., customer ID, transaction amount).
• Regulatory Data: Data subject to specific legal frameworks (e.g., GDPR, HIPAA, CCPA).
• Intellectual Property: Proprietary algorithms, source code, or trade secrets.
• Operational vs. Analytical: Distinguishes data used in live systems from data used for historical analysis and modeling. This dictates retention policies and access latency requirements.

Modern classification relies on automated data profiling tools to scan and label data at scale, eliminating manual effort.

• Pattern Recognition: Identifies formats for credit cards, dates, or national IDs.
• Data Domain Inference: Determines if a column contains 'city names' or 'product codes' based on value analysis.
• Metadata Harvesting: Extracts classification cues from column names, database comments, and existing documentation.
• Machine Learning Models: Train classifiers on labeled examples to identify sensitive or business-critical data in unstructured text and documents.

Classification tags are not merely descriptive; they drive automated policy enforcement.

• Role-Based Access Control: Permissions are dynamically granted based on a user's role and the data's classification level.
• Encryption Mandates: 'Restricted' data may be automatically encrypted at rest and in transit.
• Masking and Redaction: Queries against sensitive data can trigger dynamic masking for unauthorized users.
• Audit Trail Enhancement: All access to high-classification data is logged with greater fidelity for compliance audits.

Classification dictates how data is managed throughout its lifecycle, from creation to archival or deletion.

• Retention Periods: 'Financial records' may have a mandatory 7-year retention, while 'application logs' may be retained for 30 days.
• Archival Tiers: Classified data can be automatically moved from high-performance (hot) storage to low-cost (cold) archival based on its active use case.
• Legal Hold: Data involved in litigation can be flagged to suspend normal deletion processes.
• Secure Disposal: Procedures for the definitive destruction of 'Restricted' data are more rigorous than for 'Public' data.

Classification metadata is stored in a central data catalog, making it discoverable and linking it to broader context.

• Searchable Governance: Users can search for 'all datasets containing PII' or 'critical financial data'.
• Impact Analysis: Data lineage maps show how classified data flows through pipelines, allowing impact assessment if a source changes.
• Provenance Tracking: The catalog records who classified a dataset and when, providing an audit trail for governance.
• Quality Metric Association: Classification can be linked to specific data quality service level objectives (e.g., 'Restricted' data must have 99.9% completeness).

This classification scheme categorizes data based on the potential impact of its unauthorized disclosure, modification, or loss. It is the primary driver for security controls and access management.

• Public: Data intended for open dissemination (e.g., marketing materials).
• Internal: Data for general internal use (e.g., operational procedures).
• Confidential: Data requiring restricted access due to business sensitivity (e.g., financial forecasts).
• Restricted: Highly sensitive data whose breach could cause severe harm (e.g., PII, trade secrets, health records).

Automated PII detection tools scan data to apply these labels, which then trigger encryption, masking, and access policies.

This method tags data according to the organizational domain or process it supports. It enables domain-specific governance and helps data consumers find relevant assets.

Common classifications include:

• Financial Data: Ledgers, invoices, payroll records.
• Customer Data: CRM records, support tickets, purchase history.
• Operational Data: Supply chain logs, manufacturing telemetry, IT system metrics.
• Research & Development Data: Experimental results, prototype designs, intellectual property documentation.

This classification is often derived from data domain inference during profiling, which analyzes column names, values, and patterns to assign a semantic category.

This critical classification identifies data governed by specific legal or industry regulations. It ensures appropriate handling and auditing procedures are applied.

Key regulatory categories include:

• GDPR/CCPA Data: Any information relating to an identifiable natural person.
• HIPAA Data: Protected Health Information (PHI).
• PCI-DSS Data: Primary Account Numbers (PAN), cardholder data.
• SOX Data: Financial records relevant to internal controls and reporting.

Classification here is tightly coupled with data lineage and provenance tracking to demonstrate compliant data flows and retention policies.

This scheme classifies data based on its fitness for use, derived from profiling metrics. It signals trustworthiness and required preprocessing steps.

Classifications include:

• Certified/Golden: Data that has passed rigorous validation, has high completeness, and is the authoritative source.
• Silver/Bronze: Data that is usable but may require cleansing or has known quality issues (e.g., missing values, data skew).
• Raw/Untrusted: Newly ingested data that has not been profiled or validated; use with caution.
• Deprecated: Data that is outdated or superseded by a newer source; flagged for archival.

This classification directly informs data reliability engineering practices and Service Level Objectives (SLOs).

This technical classification is based on the inherent properties and meaning of the data, as discovered through profiling. It informs storage, processing, and modeling decisions.

• Structured: Data conforming to a fixed schema (e.g., database tables).
• Semi-Structured: Data with some organizational properties but variable schema (e.g., JSON, XML).
• Unstructured: Data without a pre-defined model (e.g., text documents, images, audio).
• Time-Series Data: Sequential data points indexed in time order (e.g., sensor readings, stock prices).
• Graph Data: Data representing entities (nodes) and their relationships (edges).

Data type inference and pattern recognition are key profiling techniques used to assign these labels.

This classification tracks data through its useful lifespan, from creation to archival or deletion. It is essential for cost management and regulatory compliance.

Typical stages include:

• Active/Transactional: Data in current, frequent use (e.g., real-time application databases). Requires high performance and data freshness.
• Reference: Stable, read-often data (e.g., product catalogs).
• Archival: Data retained for historical, legal, or analytical purposes but rarely accessed.
• Purge Candidate: Data marked for deletion per retention policies.

This classification interacts with data volume analysis to optimize storage costs and performance across hot, warm, and cold storage tiers.

The automated process of analyzing a dataset to understand its structure, content, and quality. It provides the foundational statistical analysis upon which classification rules and policies are built.

• Purpose: To discover patterns, anomalies, and metadata.
• Outputs: Descriptive statistics, data type inference, and pattern recognition.
• Dependency: Classification relies on profiling results to apply accurate labels and tags.

The automated inference of a dataset's structural metadata, including column names, data types, constraints, and potential relationships. This is a prerequisite step for defining classification schemas.

• Process: Examines raw data to propose a formal schema.
• Link to Classification: Discovered data types (e.g., string, datetime) and constraints inform the initial sensitivity and domain of a data column.

A specialized profiling task focused on automatically identifying columns containing Personally Identifiable Information. This is a direct input into data classification for applying sensitivity labels like 'Confidential' or 'Restricted'.

• Techniques: Uses pattern matching (e.g., for SSNs, credit cards) and machine learning models.
• Compliance: Critical for regulations like GDPR and CCPA. Discovery results are codified as classification tags.

The process of determining the logical category or semantic meaning of a column's values beyond its basic data type. This directly enables business-level classification.

• Examples: Inferring that a string column contains 'email addresses', 'postal codes', or 'product categories'.
• Utility: Allows classification based on business context (e.g., 'Financial Data', 'Customer Data', 'HR Data') rather than just technical sensitivity.

The process of discovering and documenting connections between different data entities, attributes, and tables. Classification policies often propagate based on discovered relationships.

• Impact: If a column containing PII is classified as 'Restricted', related columns (e.g., foreign keys) may inherit similar classification levels.
• Visualization: Often represented as a graph, showing how classification labels flow through connected data assets.

The automated process of collecting descriptive information about data to populate a catalog. Extracted metadata is the primary carrier for classification labels and tags.

• Components: Includes technical metadata (schema), operational metadata (lineage), and business metadata (owner, classification).
• System: A data catalog is the system of record where classification metadata is stored, searched, and enforced.