Data classification

ISO/IEC 27002:2022 splits the topic across three controls: 5.12 (classification of information according to confidentiality, integrity, availability and relevant interested-party requirements), 5.13 (labelling, according to the classification scheme) and 5.14 (information transfer rules). The scheme itself is a small ordered set of levels, typically three to five, each defined by the harm that unauthorised disclosure or modification would cause, and each mapped to handling rules: who may access, whether encryption is mandatory at rest and in transit, whether external sharing, printing or removable media is allowed, retention and secure disposal. Classification is performed by the information owner, and the level should be reviewed as information ages, since a press release is confidential until it is published.

Public-sector and community schemes show the range. The Danish security circular for classified information uses TIL TJENESTEBRUG, FORTROLIGT, HEMMELIGT and YDERST HEMMELIGT, aligned with NATO and EU classified information (RESTREINT UE/EU RESTRICTED up to TRÈS SECRET UE/EU TOP SECRET). The Traffic Light Protocol, TLP 2.0 from FIRST (2022), is not a classification but a sharing marking for threat intelligence: TLP:RED, TLP:AMBER, TLP:AMBER+STRICT, TLP:GREEN and TLP:CLEAR. Most companies use simpler levels such as public, internal, confidential and strictly confidential.

Legal categories are an overlay, not a replacement. GDPR special categories (Art. 9) and criminal-offence data (Art. 10), and in Denmark CPR numbers, which the Data Protection Act (databeskyttelsesloven) § 11 regulates separately, usually force at least a confidential level, but a document can be highly confidential without containing personal data, for example a tender price or source code. Mapping each legal category to a minimum level keeps the two systems consistent.

Labels are only useful if machines can read them. Sensitivity labels stored in document metadata, such as Microsoft Purview labels, drive encryption, watermarking, DLP policies at the mail gateway and in endpoints, and CASB rules for cloud uploads. Automatic classifiers based on regular expressions (for example CPR-number patterns), fingerprinting or trained models help with the large volume of existing data, but produce false positives and cannot judge context. The typical failure modes are over-classification, where everything becomes confidential so the label carries no signal and staff route around it, and under-classification by default, where unlabelled data inherits no protection. Classification also underpins retention and deletion, discovery for data-subject access requests, and scoping of backups and encryption, which is why it pairs so directly with encryption and personal-data handling.