Back to Module
3 of 3|Data Governance
video 20 min•Data Inventory
Data Classification
Not all data is equal. Classifying data based on sensitivity.
🎯 Learning Objectives
- ▸ Understand the four levels of data classification
- ▸ Learn how to apply controls based on classification
The Classification Levels
Most organizations use a four-tier classification model:
- • Public: Data intended for public consumption (e.g., marketing brochures, public policies).
- • Internal: Data meant for internal use only (e.g., internal memos, org charts).
- • Confidential: Sensitive business data (e.g., financial reports, contracts).
- • Restricted (Personal Data): Highly sensitive personal data (e.g., health records, biometric data, financial data).
Under the DPDPA, "Restricted" data requires the highest level of security, including encryption, strict access controls, and detailed logging.
Applying Controls
Once data is classified, you can apply controls. For example, "Public" data might not need encryption at rest, while "Restricted" data must be encrypted both at rest and in transit, and access should be limited to a need-to-know basis.
📖 Glossary
- Data Classification
- The process of organizing data into categories based on its sensitivity and the level of protection it requires.
🔑 Key Takeaways
- Not all data needs the same level of protection.
- Classifying data helps optimize security spending.
- Highly sensitive data (like health or financial data) requires the strongest controls.
📚 Further Reading
- ISO/IEC 27001 — ISO (2022)
Course Author
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...