Data Classification: A Practical Guide

Data classification is the habit of answering two questions:

• How sensitive is this? If it leaks, who is harmed and how?
• How important is this? If it is unavailable or wrong, what breaks?

NIST frameworks are designed to be risk-based: classification and categorization are how you decide which controls matter.

A common example in California: someone attaches an email chain to a calendar invite. The attachment includes a first name, last name, job title, phone number, and email address.

Under common definitions, that combination may constitute personally identifiable information (PII) depending on context. California's Consumer Privacy Act (CCPA) and Privacy Rights Act (CPRA) use broad definitions of personal information, including identifiers such as a real name and email address.

The point is not to turn every meeting invite into a compliance project. The point is to recognize that everyday tools (email, calendars, chat) often contain sensitive information and should be treated accordingly.

If this kind of data leaks, consequences often show up as a mix of contractual obligations, customer trust issues, and in some cases notification requirements. The exact thresholds vary by jurisdiction and the data involved.

Most organizations classify systems, but forget the workflows:

• Email and calendars: attachments, forwarded chains, meeting notes, contact lists.
• File sharing: shared drives, SharePoint/Drive folders, public links, guest access.
• Phones and laptops: cached attachments, photos, saved passwords, offline files.
• SaaS apps: exports, integrations, API tokens, audit logs, admin consoles.
• Accounting and payroll: invoices, W-9s, bank info, payroll exports.

Related: SaaS sprawl governance and BYOD data protection.

Start with three tiers, then add overlays for regulated data types:

Overlays are the labels that change handling rules. Common examples: Personally Identifiable Information (PII), Protected Health Information (PHI), and Controlled Unclassified Information (CUI).

NIST approaches are designed to be risk-based. In plain terms:

1. Inventory: understand what systems and workflows process data.
2. Categorize: determine impact and sensitivity.
3. Select controls: choose safeguards that match the category.
4. Operate and monitor: keep logs, review access, and update as systems change.

This is why classification matters so much: it drives scope and control selection.

Controls scale. The goal is to be deliberate, not maximal.

• Public: basic access control; protect against unauthorized changes; avoid public write access.
• Internal: prefer Single Sign-On (SSO); require Multi-Factor Authentication (MFA) for admins; reduce oversharing links.
• Restricted: MFA for all access paths, least privilege, stronger sharing rules, encryption where applicable, and audit logging with retention.

Related: approving new applications and SaaS tools, DLP, and RBAC.

Data classification is not an "enterprise-only" practice. Any small business can hold data that matters: customer contact details, invoices, payment instructions, employee records, and client-owned documents.

The specifics vary by industry, but the pattern is the same: everyday tools (email, calendars, phones, file shares) accumulate sensitive data. If you do not classify it, it gets copied, forwarded, overshared, and retained in places nobody controls.

Concrete examples

• Construction subcontractor: jobsite addresses, photos inside homes, customer contact lists, change orders, and invoices.
• Professional services: client documents in email threads, file shares, and calendar attachments.
• Nonprofits: donor/contact data, volunteer access, and shared spreadsheets that persist for years.

Data classification helps you set simple rules like: what is okay to text, what cannot be emailed externally, where sensitive files can live, and who is allowed to share them.

If you do nothing else, start by reducing email risk (phishing and payment diversion). See BEC and email authentication.

1. List your data: customer contacts, employee records, invoices, photos, contracts.
2. List where it lives: email, calendars, phones, file shares, SaaS apps, accounting tools.
3. Pick a tier: Public / Internal / Restricted, plus overlays like PII.
4. Write three rules: where Restricted data can live, who can share it, and how offboarding works.
5. Implement one control: MFA for email and admin accounts.

Then iterate: add logging and retention, reduce unmanaged sharing, and tighten access by role.