Classification is how an organisation decides that some information needs more care than other information. Done well, it drives handling rules, access, retention and breach response. Done badly, it is a label in a footer that nobody reads.
Classify by consequence
Most schemes classify by confidentiality alone. For personal dataPersonal dataAny information relating to an identified or identifiable living person, including identifiers and combinations of data that single someone out., add the dimensions that change the legal position:
| Dimension | Why it matters |
|---|---|
| Personal or not | Engages the UK GDPR at all |
| Special category or criminal offence data | Needs a condition, raises the security and DPIADPIAData protection impact assessment: a structured risk assessment required before processing likely to result in a high risk to people. bar |
| Children’s data | Engages higher protection and the design code |
| Volume | Large scale changes DPIA, DPO and breach analysis |
| Identifiability | Pseudonymised data is still personal data; anonymised data is not |
| Legal restriction | Data protected by an enactment, privilege or confidence |
A workable scheme
Keep the levels few enough to remember. Three or four is typical, for example Public, Internal, Confidential and Restricted, with personal data defaulting to at least Confidential and special category or large-scale personal data to Restricted. Then attach rules to each level:
- who can access it, and with what approval;
- where it can be stored and whether it can leave the organisation;
- encryption at rest and in transit;
- retention and disposal;
- how to report its loss.
Make it automatic where possible
People mislabel. Classify at the system and dataset level, recorded in the record of processing and the data catalogue, so a document inherits its classification from where it lives. Use data loss prevention to detect personal data in the wrong place, such as national insurance numbers in email.
Classification and breaches
When something goes wrong, classification answers the first questions fast: what kind of data, how much, and how sensitive. That is the basis of the risk assessment for the 72-hour notification decision.
Classification and FOI
For public authorities, classification is not an FOI exemption. A document marked “Official Sensitive” can still be requested, and the exemptions apply to its content, not its label.