How to write a data classification policy

Why classification underpins everything else

You cannot protect data consistently if you have not decided how sensitive it is. A data classification policy assigns information to levels and defines how each level is handled, stored, shared and destroyed. It is the foundation other policies (access control, encryption, retention) build on.

What to include

Classification levels — a simple, usable scale (e.g. Public, Internal, Confidential, Restricted). Fewer levels get used; too many get ignored.
Criteria — clear examples of what belongs in each level.
Handling rules — per level: storage, transmission, encryption, sharing and printing.
Labelling — how documents and data are marked.
Roles — data owners decide classification; everyone applies the handling rules.
Declassification and retention — when data moves down a level or is destroyed.
Third parties — how classification travels to suppliers.

Common mistakes

Too many levels, so people default to the lowest or ignore them.
Defining levels but not the handling rules that make them meaningful.
No owner, so nothing actually gets classified.

Framework alignment

Maps to ISO 27001:2022 Annex A 5.12–5.13 (classification and labelling of information), the SOC 2 confidentiality criteria, and NIST CSF Identify/Protect.

Primary sources

ISO/IEC 27001:2022 — Annex A controls 5.12–5.13 (classification and labelling of information) (iso.org/standard/27001).
NIST Cybersecurity Framework — Identify function, Asset Management (nist.gov/cyberframework).
ENISA — data protection and information handling resources (enisa.europa.eu).

Generate it in minutes

See a sample data classification policy or generate yours free.

Frequently asked questions

How many classification levels should a policy use?

Keep it to a small, usable scale — typically four, such as Public, Internal, Confidential and Restricted. Too many levels get ignored, or everyone defaults to the lowest. Fewer, well-defined levels with clear examples are far more likely to be applied consistently.

What makes a data classification policy actually work?

Defining levels is not enough — you must also define the handling rules per level (storage, transmission, encryption, sharing, printing) and assign data owners who decide classification. Without owners and handling rules, nothing actually gets classified, which is the most common failure.

Why is classification the foundation for other policies?

Access control, encryption and retention all depend on knowing how sensitive data is. Classification assigns information to levels so those policies can apply rules consistently. It maps to ISO 27001:2022 Annex A 5.12–5.13 and underpins the SOC 2 confidentiality criteria.