Most businesses hold far more sensitive information than they realize, spread across email, shared drives, cloud apps, laptops and paper files. Data classification is the practice of sorting that information by how much harm its loss or exposure would cause, then handling each category accordingly. It tells you where to spend on encryption and access controls, what you can delete, and what you would have to report if something went wrong.
It is also squarely your job. Microsoft's description of the cloud shared responsibility model lists data, including data classification, protection and encryption decisions, among the responsibilities that always stay with the customer, whatever cloud services you use.
A simple classification scheme
Federal standards offer a useful way to think about impact. NIST's FIPS 199 rates the potential impact of losing confidentiality, integrity or availability of information as low (a limited adverse effect), moderate (a serious adverse effect) or high (a severe or catastrophic adverse effect). Most small and mid-sized businesses do well with four plain-language labels built on the same idea:
| Label | Examples | Handling rules |
|---|---|---|
| Public | Website content, brochures, published price lists | No restrictions beyond approval to publish |
| Internal | Policies, schedules, internal memos, most email | Employees only; no public sharing links |
| Confidential | Customer lists, contracts, pricing, financial statements, bids, employee records | Need-to-know access, encrypted on laptops and in transit, no personal email or personal cloud storage |
| Restricted | Social Security and driver's license numbers, bank and card data, health information, passwords and security keys | Named individuals only, encryption required, multi-factor authentication, logged access, defined retention and secure disposal |
Keep the scheme short enough that employees can apply it without a manual. Four labels are plenty. When in doubt, a file takes the label of the most sensitive item it contains.
Know which data is regulated
Some data belongs in the restricted category because the law says so. The categories most businesses in Washington encounter include:
Personal information
Washington's breach notification law covers a resident's name combined with items such as a Social Security number, driver's license or state ID number, account or card number with any required code or password, full date of birth, passport or military ID numbers, health insurance numbers, medical information or biometric data. A username or email address combined with a password or security answers is covered too.
Payment card data
Businesses that accept cards must protect cardholder data under the PCI Data Security Standard. Our PCI compliance guide explains the basics, including why the best approach is to avoid storing card data at all.
Consumer health data
Washington's My Health My Data Act regulates health data that falls outside HIPAA, including health inferences drawn from purchases. It requires consent for collection and sharing, gives consumers deletion rights that reach archived and backup systems, and applies to small businesses, which had to comply with its main provisions beginning June 30, 2024.
Customer financial information
The FTC Safeguards Rule applies to many non-bank financial institutions, such as mortgage brokers, finance companies, tax preparers and some auto dealers. Since May 13, 2024, covered businesses must notify the FTC no later than 30 days after discovering a breach involving unencrypted information of at least 500 consumers.
Healthcare providers and their business associates also handle protected health information under HIPAA; see our HIPAA compliance guide. If you are not sure which rules apply to you, ask your attorney before an incident rather than after one.
How to classify your data, step by step
- Inventory where data lives. List your systems: email, file shares, cloud storage, accounting, payroll, CRM, point of sale, line-of-business software, backups, and paper files. For each, note what kinds of data it holds.
- Assign an owner. Each system or data set needs a person who decides who gets access and how long data is kept. Usually this is the manager of the function, not IT.
- Apply labels. Start with the restricted category, since that is where the risk concentrates. Many productivity suites can apply sensitivity labels to files and email, and some can detect common patterns such as Social Security or card numbers.
- Set handling rules. For each label, decide where the data may be stored, who may see it, whether it must be encrypted, whether it may be emailed outside the company, and how it is disposed of.
- Set retention periods. Keep data as long as the law, contracts and the business genuinely require, then delete it securely. Data you no longer hold cannot be breached.
- Train and remind. Show employees the labels with real examples from your business. Our article on employee security training covers how to make it stick.
- Review annually and whenever you add a new system, vendor or line of business.
Put the labels to work
Classification only pays off when it drives controls. Tie each label to specific settings:
- Access. Restricted data is limited to named people and reviewed at least annually. Remove access the day someone changes roles or leaves.
- Encryption. Encrypt laptops and phones, and encrypt restricted data in storage and in transit. Under Washington law, as the Attorney General explains it, notice is not required when compromised information is encrypted or otherwise unreadable, unless the key or credential was compromised too.
- Sharing. Block public links for confidential and restricted files, and use secure file transfer instead of email attachments for restricted data.
- Vendors. Know which vendors receive restricted data and require appropriate safeguards in your contracts. See vendor security assessment.
- Backups. Backups contain the same sensitive data as production systems and need the same protection and retention discipline.
- Paper. Lock restricted files and shred them when retention ends.
When something goes wrong
A current classification makes an incident easier to manage. When a laptop is stolen or an account is compromised, the first questions are what data was involved, whose it was and whether it was encrypted. If you can answer them quickly, your attorney and the insurer's breach team can decide on notification faster. Washington generally requires notice to affected residents in the most expedient time possible and within 30 days of discovering a breach, and notice to the Attorney General if more than 500 Washington residents are affected. Our guides to incident response planning and breach notification cover the process.
How classification connects to cyber insurance
Cyber insurers want to know what data you hold and how much. Applications commonly ask about the types and approximate number of sensitive records, whether data is encrypted, and how access is controlled. The number and type of records drive breach costs such as forensic work, notification, credit monitoring and legal defense, so reducing what you keep reduces your exposure.
A cyber liability policy typically helps pay for breach response costs and liability claims after a covered event, and some policies cover regulatory defense and, where insurable by law, fines and penalties. Points to check include whether the policy covers data held by your vendors on your behalf, how it treats paper records, and whether claims under specific privacy statutes are covered or excluded. Forms vary by carrier, so review the wording rather than the summary.
When to call your broker
Call us when you begin collecting a new type of sensitive data, such as health information, biometric data or customer financial information, when you move large amounts of data to a new system or vendor, or when your record count grows substantially. As a broker, we compare cyber options across the market and help match limits to the data you actually hold.
Sources
- NIST — FIPS 199, Standards for Security Categorization of Federal Information and Information Systems
- Microsoft Learn — Shared responsibility in the cloud
- Washington State Office of the Attorney General — Washington's data breach notification laws
- Washington State Office of the Attorney General — Protecting Washingtonians' personal health data and privacy (My Health My Data Act)
- Federal Trade Commission — Safeguards Rule notification requirement now in effect