# What is Data Classification?

> Data classification is the process of assigning data to categories based on its sensitivity, criticality, legal or contractual requirements, and value to the organization.

- Canonical URL: https://yellowcube.eu/glossary/data-classification/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

The category or label should drive practical handling rules such as who may access the data, where it may be stored, how it may be shared, and when it should be deleted.

A workable classification scheme is understandable to the people and systems that use it. Organizations commonly combine owner-applied labels, contextual rules, content discovery, and inherited metadata. Automated tools can assist, but accountable owners must define meaning and resolve ambiguity.

### Key points

- **Possible criteria:** Confidentiality impact, business criticality, personal data, regulated content, intellectual property, contractual limits, and safety relevance.
- **Policy outputs:** Access, encryption, sharing, retention, monitoring, backup, disposal, and incident-handling requirements.
- **Good design:** Use a small number of distinct categories, clear examples, default handling, and a process for relabeling data as context changes.
- **Important limitation:** A label does not protect data by itself, and inaccurate or stale labels can drive both unsafe sharing and unnecessary restriction.

### Related terms

[Data loss prevention (DLP)](<https://yellowcube.eu/glossary/data-loss-prevention/>) · [Data governance](<https://yellowcube.eu/glossary/data-governance/>) · [Data exfiltration](<https://yellowcube.eu/glossary/data-exfiltration/>) · [Encryption](<https://yellowcube.eu/glossary/encryption/>) · [Data retention](<https://yellowcube.eu/glossary/data-retention/>) · [Data-centric audit and protection (DCAP)](<https://yellowcube.eu/glossary/data-centric-audit-and-protection/>)

### Sources

[NIST SP 1800-39 initial public draft: Data Classification Practices](https://csrc.nist.gov/pubs/sp/1800/39/ipd) · [NIST: Data Classification Practices project description](https://csrc.nist.gov/pubs/pd/2021/07/22/data-classification-practices-datacentric-security/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.