Data classification

Data classification means labelling information according to how serious it would be if it were lost, altered or leaked. A common scheme has four levels: public, internal, confidential and restricted (for example, health data or credentials).

Each level comes with concrete rules: who can access it, whether it must be encrypted, whether it can be sent outside, whether it can be entered into an external AI tool and how long it must be kept before deletion.

The Data Owner decides it, and it is applied in the catalogue and in access permissions. It is the basis for complying with the GDPR (minimisation and storage limitation) and NIS2, and for writing an AI use policy that clearly says which data must never go into a chatbot.