Sorting data into classes such as public, internal, confidential, and restricted, with rules for how each class may be handled.
Definition
Data classification is the practice of sorting data into a small number of classes by sensitivity and attaching handling rules to each. A common scheme has four classes: public, internal, confidential, and restricted, where restricted includes personal and health data, credentials, trade secrets, and export-controlled data. For AI use, the rules say which class may go into which kind of tool: a public AI tool, an approved enterprise tool, or a private deployment. Without classes, people cannot follow rules, and without rules, classes do nothing.
History
Classification schemes come from government and military information handling and from information security standards such as ISO/IEC 27001, and are used by most organizations in some form. Privacy law adds its own categories of personal and sensitive data.
When to Use
Define classes before AI use spreads, map them to the tools you approve, and train people with examples of each class from their own work.
Step-by-Step
- Define four or fewer classes with plain-word examples.
- Map each class to each kind of tool: allowed, with approval, or not allowed.
- Assign owners for the main data sets.
- Train with real examples.
- Make it easy to ask about edge cases.
- Review the scheme and the map regularly.
Examples
- Published brochures are public and may go into any tool.
- Customer order lists are confidential and may go only into approved tools with suitable terms.
- Employee health data is restricted and may not go into AI tools unless specifically cleared.
Common Pitfalls
- Too many classes.
- Classes without a tool map.
- Examples from other industries.
- Never updating as tools change.