Data classification

What data classification does

Data classification sorts data into levels by protection need and thereby defines which rules apply to handling it. Instead of deciding for every single record, a handful of levels is defined, and each level brings fixed requirements with it: who may read, where it may be stored, how long it is kept, whether it may be exported.

The benefit is not the scheme itself but the relief it brings. Once it is clear that customer data with addresses sits at a particular level, nobody has to debate access rights case by case. That is the real purpose.

Typical levels

• Public: Content meant for everyone, such as product copy and images.
• Internal: Information for all staff but not outside, such as assortment planning.
• Confidential: Personal data such as name, address and order history, plus prices and contracts.
• Strictly confidential: Special categories under data protection law, such as health data, plus credentials and payment information.

It matters that the level follows the context, not the data type. A delivery address is necessary in the order process and therefore confidential. In an analytics report that same address has no purpose and is a mistake, even though it is the same address in both cases.

Why this matters for analytics and AI

Data flowing into an analytics tool or a language model leaves its original purpose. Copying a customer database into a text generation tool processes personal data for a new purpose, and that needs a legal basis. The usual practice is therefore to reduce data before use, removing names and addresses and keeping only features such as order value, category and region.

The same logic applies to training data. A model learning from customer enquiries sees content that may not have been intended for that. Anyone taking classification seriously decides up front which level may enter training data and which may not. Afterwards, data cannot practically be removed from a trained model.

What an introduction looks like

The first step is an inventory: which data is stored where, who accesses it and what it is needed for. The second step is assigning levels, with a named owner per system. The third step is the rules per level, meaning access, storage location, retention period and deletion path. The fourth step is implementing them in the system so the rule exists somewhere other than a document.

A frequent mistake is a scheme that is too fine grained. Twelve levels will not be applied, four usually suffice. A second frequent mistake is missing automation. When classification is maintained by hand it is out of date within six months. Systems that detect and label data automatically keep the scheme alive, even though detection is never complete.

The value shows when something goes wrong. If you know which data is affected and which duties apply, you can act within hours. Without that overview, every crisis begins with a week of stocktaking.