Data classification

Data classification is the practice of categorizing data, usually at the field or dataset level, by sensitivity or type, public, internal, confidential, restricted, or more specific tags like "PII" or "financial," so that handling, access, and protection rules can be applied consistently rather than decided case by case. Classification can be done manually by data owners, automatically through pattern-matching tools that scan for things that look like credit card or national ID numbers, or both.

Classification is the input that makes other controls actually operable: it determines which fields need data masking in non-production environments, which tables require role-based access control restrictions, and which categories of data are subject to specific handling under a privacy regulation. Without it, those controls have to be applied by guesswork or blanket rules that either over-restrict harmless data or under-protect sensitive data.

Classification matters because most organizations' data volume makes manual review of every field impractical, and because downstream compliance work, showing which systems hold personally identifiable information, for instance, depends on it being tagged reliably somewhere. It's typically stored and maintained as part of metadata management and reviewed under data governance. The common pitfall is classifying data once at creation and never re-running it as new columns and tables are added, so classification coverage quietly decays over time even as the underlying policies stay intact.