Data Classification and Inventory
Data Classification and Inventory tests whether you can apply a classification scheme consistently, derive handling rules that engineers can follow, and maintain an inventory that genuinely supports scoping, retention and privacy obligations. Items tend to hinge on content versus location, and on whether replicas were counted.
Classification drives everything downstream
Most schemes use three to five tiers - public, internal, confidential, restricted. Classification is a business judgement about harm from disclosure, alteration or loss of the data. Labelling is the technical marking that travels with the data. Classification is the decision; the label is a control. Judgement is based on content and context, never on the folder, system or department that holds it.
Derive a handling matrix from the tier: permitted storage locations, encryption requirements, who may approve sharing, transmission rules, retention period, disposal method. If an engineer cannot look up the answer in under a minute, the matrix is not usable.
What an inventory must contain
Minimum fields: system of record, accountable data owner, business purpose, data elements and personal-data categories, all locations including replicas, snapshots, backups and SaaS copies, retention, cross-border transfers, and downstream consumers. GDPR Article 30 requires a record of processing activities; the inventory is usually the same artefact. Inventories describe state; data-flow diagrams describe movement. You need both.
Automated discovery - data scanning, DLP content inspection, cloud data security posture tools - is necessary at scale, but results must be human-validated, because scanners mislabel spreadsheets and miss unstructured stores.
Worked example
A SaaS company finds customers.csv in a cloud bucket that a team described as internal marketing data. Reasoning: classification follows content. Inspection shows names, emails and addresses - personal data - plus full card numbers, which are cardholder data and pull the bucket into PCI DSS scope. Decision: restricted. Because cardholder data is present, either tokenize at capture so the numbers never reach the bucket, or apply full PCI controls to it. Record in the inventory: owner, all replicas, retention, encryption, the named access group, and the cross-border location. Then schedule re-discovery.
Traps that cost marks
Classifying by system or department instead of content. Over-classification that pushes users into shadow IT. Building the inventory once and never refreshing it. Forgetting backups, snapshots, analytics copies and vendor-held copies. Assuming a data-flow diagram satisfies the Article 30 record of processing activities.