Data classification and PII

Not all data is equal

A lunch menu and a list of customers' ID numbers are both "data", but losing them is not remotely the same event. Treating every file with the same care is either wasteful or dangerous. Data classification is simply the habit of sorting information by how sensitive it is, so the care you take matches what is at stake.

A simple set of labels

Most schemes use a few plain levels. The names vary; the idea does not.

• Public: meant for anyone, like a brochure or a published price list. No harm if it spreads.
• Internal: fine within the organisation, not for outsiders, like a team schedule.
• Sensitive: limited to specific people, like contracts, salaries or customer records, where exposure would cause real harm.

You do not need a complex system. Even sorting things into "public", "internal" and "sensitive" already tells people how careful to be.

PII: personal data

One category deserves its own name: PII, which stands for personally identifiable information. That is any data that can identify a specific person, on its own or combined with other data. Obvious examples are a full name with an address, an ID or passport number, a phone number, an email, or health and financial details.

PII matters for two reasons. It is exactly what criminals want for fraud and identity theft, and it is protected by law: mishandling people's personal data can bring real legal and financial consequences, not just embarrassment. When PII is involved, "sensitive" is the safe default.

Labels connect to confidentiality

The point of a label is to protect confidentiality: keeping information available only to the people who are meant to see it. A label is a short instruction on how to handle something, so nobody has to guess. "Sensitive" tells you not to forward it, not to leave it on a screen in a cafe, and to think before copying it somewhere new.

• Label things when you create them, so the guidance travels with the file.
• Share on a need to know basis: send sensitive data to the people who actually need it, not to a wide list.
• When unsure, treat it as more sensitive, not less.

Classification is not bureaucracy for its own sake. It is what lets a whole team protect the important things without slowing down over the trivial ones.