A practical data classification scheme
By Sam Rivera, Founder, SentinelPanda · June 19, 2026 · 1 min read · Compliance
Four tiers is plenty. The mistake is a beautiful classification scheme that nobody applies to actual data.
Why classify at all
You cannot apply "appropriate" controls until you know what is sensitive. Data classification is the input that tells access control, encryption, retention, and monitoring how hard to work for a given dataset. Frameworks expect it because it is what makes the rest risk-based instead of uniform.
Keep the tiers few
Four tiers covers almost everyone: Public (intended for release), Internal (default business data), Confidential (customer data, secrets), and Restricted (the crown jewels — card data, health data, credentials). More tiers than people will actually use is a scheme that gets ignored.
Attach handling rules
- Each tier gets concrete rules: who can access it, whether it must be encrypted, where it can live, how long it is kept, and how it is disposed of.
- Restricted data drives the strictest controls and usually the smallest scope — concentrate and guard it.
- Make the default tier safe (Internal, not Public) so unclassified data is not accidentally exposed.
Apply it to real data
The failure mode is a polished policy that never touches an actual datastore. Tag your real systems and data stores with their tier, and let that drive the controls. SentinelPanda ties classification to the data-handling controls so the scheme does work instead of sitting in a wiki.