Data Classification: The Prerequisite Everyone Skips

Every DLP deployment assumes a classification scheme exists. Most organisations either have none, or have one written years ago that nobody applies.

The tool cannot supply this. It is the input.

Why schemes fail

Too many levels. A five-tier scheme with subtypes requires people to make a judgement they are not equipped to make, so they either apply the default to everything or ignore it.

Three levels is usually right. Four is the maximum that survives contact with actual users.

Labels with no consequence. If marking something confidential changes nothing about how it can be handled, people stop marking. The classification has to connect to a control — restricted sharing, blocked upload, encryption at rest — or it is decoration.

No default. A scheme that requires an active decision on every document produces unlabelled documents. Set a sensible default and require an active decision only to lower it.

A scheme that works

Public. Cleared for external release. Marketing material, published reports.

Internal. The default. Not harmful if it leaks but not for outside distribution. Most documents.

Confidential. Real consequences if disclosed. Customer data, financials before release, personnel records, contracts.

Restricted, optionally, for the small set where disclosure is severe — deal documents, source code for a core product, security material.

That is enough for most organisations. Adding a fifth level adds ambiguity, not protection.

Classification by content, not by document

The useful mental shift: classify the categories of information, then let that drive document handling.

"Customer contact details are confidential" is a rule people can apply. "Documents in the Sales folder are confidential" is a rule that breaks the moment someone saves a file elsewhere.

Write a short list — one page — of what your organisation actually holds that matters, with a level assigned to each. Personal data of customers. Employee records. Financial results before publication. Product designs. Security configuration. Contracts and pricing.

Most organisations have between six and fifteen such categories. Enumerating them is a half-day exercise that never happens.

Automatic, manual, or both

Automatic classification by pattern works well for structured data with a recognisable form — identifiers, card numbers, record formats. Reliable and cheap.

Manual labelling is necessary for anything unstructured, and it depends entirely on people doing it. Which means it depends on it being easy: one click, at the point of creation, with a sensible default already selected.

Inherited classification — a document created from a confidential source stays confidential — catches a substantial share of what manual labelling misses.

Use all three. Relying on manual alone fails; relying on automatic alone misses everything that matters most.

The uncomfortable part

Classification requires someone to decide what the organisation actually cares about, and that decision is not technical.

It requires the business to say which information would genuinely hurt if disclosed, and to accept the handling constraints that follow. That conversation is slow, involves people who do not want to have it, and is the entire foundation of everything else.

Deployments that skip it end up with a tool configured against generic patterns, generating alerts on data nobody was worried about, while the thing that actually matters — the unstructured document with the strategy in it — goes out unremarked.

Where to start

Pick the three categories that would cause the most damage. Define them precisely. Find where they live. Apply controls to those, well, before extending to anything else.

A programme protecting three things properly is worth more than one nominally covering everything.