Data Classification

This is the most common classification scheme, categorizing data based on the potential impact of its unauthorized disclosure, modification, or destruction. It directly informs security controls and access policies.

• Public: Data intended for open dissemination (e.g., marketing materials, published reports).
• Internal: Data for general employee use but not for public release (e.g., internal policies, non-sensitive project plans).
• Confidential: Data that could cause moderate risk if disclosed (e.g., business plans, employee data, certain customer information). Requires stricter access controls.
• Restricted/Sensitive: Data that would cause severe harm or legal/regulatory penalties if compromised (e.g., Protected Health Information (PHI), financial account numbers, source code). Governed by the highest security and encryption standards.

This scheme tags data based on the specific laws, regulations, and industry standards that govern its use and protection. Classification labels are often mandated by the regulation itself.

• GDPR (Personal Data): Any information relating to an identified or identifiable natural person within the European Union.
• HIPAA (Protected Health Information - PHI): Individually identifiable health information held or transmitted by a covered entity.
• PCI DSS (Cardholder Data): Primary Account Number (PAN), cardholder name, expiration date, and sensitive authentication data.
• CCPA/CPRA (Personal Information): Broadly defined information that identifies, relates to, or could be linked to a California consumer.
• SOX (Financial Reporting Data): Data related to financial statements and internal controls over financial reporting.

This method classifies data based on its importance to business operations and continuity. It prioritizes data for backup, recovery, and availability requirements, often defined by Recovery Time Objective (RTO) and Recovery Point Objective (RPO).

• Mission-Critical: Data essential for core business functions. Loss or unavailability would cause immediate and severe operational/financial impact (e.g., real-time transaction databases, active customer session data). Requires near-zero RTO/RPO.
• Business-Critical: Data important for ongoing operations and decision-making. Loss would cause significant disruption but not immediate failure (e.g., weekly sales reports, product catalogs).
• Important: Data used for analysis, planning, or reference. Loss is inconvenient but not catastrophic (e.g., archived project documents, historical trend data).
• Non-Critical: Data with minimal business value, often transient or easily recreated (e.g., temporary log files, cached web content).

This scheme categorizes data based on its phase in the data lifecycle, which determines its retention, storage, and disposal policies. It is crucial for managing storage costs and legal holds.

• Active/Production: Data currently being created, updated, and queried in operational systems. Requires high-performance storage and frequent access.
• Inactive/Reference: Data no longer actively updated but must be retained for business, legal, or compliance reasons. Often moved to lower-cost, query-optimized archival storage.
• Archival: Data retained long-term for historical, regulatory, or legal discovery purposes. Typically stored on very low-cost, high-latency media with strict retention schedules.
• Destruction-Eligible: Data whose retention period has expired and has no legal hold, approved for secure deletion or anonymization.

This method classifies data based on its role in analytics, machine learning, and business intelligence, focusing on its quality, granularity, and derivability.

• Source/Raw Data: The original, unprocessed data as captured from source systems. Classified by its origin and ingestion method (e.g., transactional logs, IoT sensor streams).
• Derived/Transformed Data: Data created by processing, aggregating, or enriching raw data (e.g., feature tables for ML, aggregated KPI dashboards). Classification includes lineage back to source.
• Gold/Certified Data: High-quality, trusted, and approved datasets serving as the single source of truth for key business entities (e.g., certified customer dimension table). Governed by strict quality SLAs.
• Experimental/Research Data: Data used for prototyping, exploratory analysis, or model training in non-production environments. May have lower quality guarantees.

Central to decentralized architectures like Data Mesh, this scheme classifies data based on the business domain that owns it and is responsible for its quality, governance, and lifecycle.

• Domain Data Product: A packaged, reusable data asset owned by a specific business domain (e.g., Customer, Finance, Supply Chain). Classification includes the domain name, data product owner, and SLA.
• Shared/Cross-Domain Data: Data used and potentially modified by multiple domains. Requires clear contracts and interoperability standards for classification.
• Infrastructure/Platform Data: Data generated by the underlying data platform itself (e.g., pipeline execution logs, catalog metadata, cost usage data). Owned by the data platform team.
• Third-Party Data: Data acquired from external vendors or partners. Classification must include licensing terms, usage restrictions, and refresh schedules.

These are the core engines that crawl data repositories to identify and inventory assets. They use techniques like pattern matching (for credit card numbers, SSNs), natural language processing (NLP) to analyze text content, and machine learning models trained to recognize sensitive context.

• Examples: Scanning for PII patterns in cloud storage (S3, ADLS), on-prem databases, and data warehouses.
• Key Capability: Provides the initial inventory and data profiling necessary for classification.

Centralized interfaces where data stewards and security teams define the classification taxonomy (e.g., Public, Internal, Confidential, Restricted) and the business rules that map data attributes to classes.

• Rule Types: Regex patterns, keyword lists, data dictionary lookups, and proximity analysis.
• Function: Enables consistent application of organizational policy and regulatory frameworks (like GDPR, HIPAA, CCPA).

Once data is classified, these tools attach classification labels as metadata tags to the asset. This metadata is then propagated through data lineage tools, allowing impact analysis.

• Critical Feature: Column-level lineage that shows how a classified column flows through pipelines.
• Benefit: Enables downstream systems (like access control or encryption gateways) to enforce policies based on the tag.

Integrated suites that combine classification with data loss prevention (DLP), access governance, and activity monitoring. They focus on risk reduction and compliance reporting.

• Vendors: Include offerings from major cloud providers (e.g., Microsoft Purview, AWS Macie) and specialized firms like BigID, OneTrust.
• Primary Value: Automating policy enforcement (e.g., blocking downloads of Restricted data) and generating audit trails.

The ultimate action layer, where classification tags trigger automated responses. Role-based access control (RBAC) and attribute-based access control (ABAC) systems use classification tags as key attributes.

• Workflow: A file tagged Confidential can be automatically encrypted or have its access limited to a specific security group.
• Goal: Moves governance from passive labeling to active, policy-based protection.

A centralized repository that defines the structure, meaning, and relationships of data elements within a specific database or system. It focuses on technical attributes like data types, constraints, and physical column names. While a data dictionary provides the structural context, classification adds a governance layer by categorizing those elements based on sensitivity or business criticality. For example, a dictionary defines a customer_ssn column as a VARCHAR(11); classification tags it as PII/Confidential.

A collection of standardized definitions for key business terms, concepts, and metrics (e.g., "Monthly Recurring Revenue," "Active Customer"). It establishes a common vocabulary across the organization. Data classification often uses the business glossary to inform its categories; for instance, a glossary term for "Patient Health Record" would be linked to data assets classified as PHI (Protected Health Information), ensuring consistent handling based on business understanding.

The tracking of data's origin, movement, transformations, and dependencies across systems over its lifecycle. Lineage is critical for understanding the impact of classification. If a source column classified as PII is transformed and propagated through multiple pipelines, lineage maps show all downstream datasets that inherit that classification, enabling comprehensive policy enforcement and audit trails for compliance reporting.

A detailed record of the origin, custody, and processing history of a specific data asset. While lineage shows where data flows, provenance provides evidence of how and by whom it was created and modified. For classified data, provenance is essential for authenticity and trust, answering questions like: "Who created this sensitive dataset?" and "What was the exact ETL job that last transformed this confidential data?" This supports forensic analysis and regulatory audits.

A reusable, high-quality data asset—such as a dataset, model, or API—that is packaged, documented, and managed as a product. A core tenet of the Data Mesh paradigm. Classification is a mandatory component of a data product's contract, explicitly stating the sensitivity level (e.g., Public, Internal, Confidential) and governing its consumption. This ensures consumers understand the handling requirements before they access the product.