Data Classification: Why It’s Important and How To Do It

by Tori Thurmond / November 27th, 2023

What Is Data Classification?

Data classification systematically categorizes information based on sensitivity and importance to determine its level of confidentiality. This process helps apply appropriate security and compliance measures to ensure each category receives proper protection. As a result, sensitive information is safeguarded while less critical data is allowed appropriate flexibility.

Why is Classifying Data Necessary?

Knowing how to classify data is critical given today’s advancing cyber threats. With over 422 million individuals affected by data compromises, including data breaches, leakage, and exposure in 2022, classifying your data is essential if you want to know how to secure it and prevent security incidents at your organization.

How to Classify Data

Determining specific data classification strategies depends on your industry and the type of data your organization collects, uses, stores, processes, and transmits. For healthcare organizations, this could be PHI such as patient names, dates of birth, Social Security numbers, medical data and histories, or prescription information. For financial services organizations, this could be CHD, PINs, credit scores, payment history, or loan information.

Regardless of the type of data, there are a few key considerations to make when classifying data, including:

1. What data does your organization collect from customers and vendors?
2. What data does your organization create?
3. What is the level of sensitivity of the data?
4. Who needs access to the data?

4 Data Classification Types

Depending on the sensitivity of the data an organization holds, there needs to be data classification levels to determine elements including who has access to that data and how long the data needs to be retained. Typically, there are four classifications for data: public, internal-only, confidential, and restricted. Let’s look at examples for each of those.

Public Data

This type of data is freely accessible to the public (i.e. all employees/company personnel). It can be freely used, reused, and redistributed without repercussions. An example might be first and last names, job descriptions, or press releases.

Internal-only Data

This type of data is strictly accessible to internal company personnel or internal employees who are granted access. This might include internal-only memos or other communications, business plans, etc.

Confidential Data

Access to confidential data requires specific authorization and/or clearance. Types of confidential data might include Social Security numbers, cardholder data, M&A documents, and more. Usually, confidential data is protected by laws like HIPAA and the PCI DSS.

Restricted Data

Restricted data includes data that, if compromised or accessed without authorization, which could lead to criminal charges and massive legal fines or cause irreparable damage to the company. Examples of restricted data might include proprietary information or research and data protected by state and federal regulations.

Common Data Classification Standards and Requirements

Many frameworks and legal regulations have specific requirements that encourage organizations to classify data. While this isn’t an exhaustive list of the requirements and laws, these are quite common. It should be noted that these requirements vary depending on the types of data your organization collects, uses, stores, processes, or transmits.

• SOC 2: The SOC 2 Trust Services Criteria requires that service organizations who include the confidentiality category in their audit demonstrate that they identify and maintain confidential information to meet the entity’s objectives related to confidentiality.
• HIPAA: PHI is considered high-risk data. As such, HIPAA Security Rule requires that all covered entities and business associates implement administrative safeguards that ensure the confidentiality, integrity, and availability of PHI. In addition, the HIPAA Privacy Rule limits the uses and disclosures of PHI, forcing covered entities and business associates alike to establish procedures for classifying the data they collect, use, store, or transmit.
• PCI: In order to comply with PCI DSS Requirement 9.6.1, entities must “classify data so that sensitivity of the data can be determined.”
• GDPR: Organizations that handle the personal data of EU data subjects must classify the types of data they collect in order to comply with the law. Additionally, GDPR categorizes certain data – race, ethnic origin, political opinions, biometric data, and health data – as “special” and therefore it is subject to additional protection. This not only means that organizations need to know what types of data they hold, but they also need to be able to label that data as public, proprietary, or confidential.

Partner with KirkpatrickPrice to Make Sure Your Data Is Secure

What processes does your organization have in place for classifying data? Do you need help determining which types of data you collect, use, store, process, or transmit? With the threat to your organization’s data growing every day, it can feel overwhelming to try to protect it. If you need help establishing your data classification procedures or have questions about your organization’s data, connect with a KirkpatrickPrice expert. Data classification doesn’t have to remain a mystery. Start working towards your security and compliance goals today.

More Resources

Best Practices for Data Retention

How to Build an IT Asset Management Plan

How Much is Your Data Worth to Hackers?

About the Author

Tori Thurmond

Tori Thurmond has degrees in both professional and creative writing. She has over five years of copywriting experience and enjoys making difficult topics, like cybersecurity compliance, accessible to all. Since starting at KirkpatrickPrice in 2022, she's earned her CC certification from (ISC)2 which has aided her ability to contribute to the company culture of educating, empowering, and inspiring KirkpatrickPrice's clients and team members.