Data Classification and Labelling Programme

Last updated: April 29, 2026

A Mumbai BFSI implemented “data classification” by emailing a 4-tier policy to all staff. Two years later, an audit found the policy existed but no document, file, or database was actually labelled. Their DLP couldn’t enforce anything because the data didn’t carry the labels the policy referenced. This module covers data classification as an operational programme.

What classification actually does

Data classification labels every piece of data with a sensitivity tier. The labels then drive controls — encryption, access, retention, sharing rules, monitoring. Without classification, you can’t apply differentiated controls; everything is either over-protected or under-protected.

The tier model

Three tiers is sufficient for most organisations; four for regulated. More than four creates confusion.

The technical implementation

Classification labels must be machine-readable to drive controls. The major implementations:

• Microsoft Purview Information Protection (formerly AIP) — labels in M365 (email, SharePoint, OneDrive, Teams). Native enforcement.
• Google Workspace Data Loss Prevention — equivalent in Google ecosystem.
• Custom file metadata — for non-Microsoft / non-Google environments.
• Database column tagging — for structured data.

# Microsoft Purview label setup
1. Define labels in Purview compliance portal
2. Configure label policies (which users see which labels)
3. Configure auto-labelling rules (based on content matching)
4. Enable mandatory labelling (users must apply label before sharing)
5. Configure DLP rules referencing labels
6. Monitor label usage; tune rules

Auto-classification

Manual labelling fails at scale. Modern programmes use auto-classification:

• Pattern matching — credit card numbers (PCI), Aadhaar (12-digit), PAN (5-letter+4-digit+1-letter), email patterns
• ML-based classifiers — content analogous to known sensitive content
• Context-based — documents in specific folders, emails to specific recipients

Auto-suggest + user-confirm is the practical default. Pure auto-apply has too many false positives; pure manual scales poorly.

The Mumbai BFSI’s 12-month rollout

• Months 1-2: Define tier model with stakeholders. Three tiers chosen. Examples documented per tier.
• Months 3-4: Deploy Microsoft Purview labels in sandbox environment. Train pilot users.
• Months 5-6: Auto-classification rules tuned (Aadhaar, PAN, payment-data patterns). Pilot in one business unit.
• Months 7-9: Org-wide rollout. Mandatory labelling on email send. DLP rules active in audit mode.
• Months 10-11: DLP rules to enforce mode. Block external sharing of Restricted-labelled content.
• Month 12: 95%+ of new content correctly labelled. Audit-evidence ready.

Indian compliance mapping

• DPDP Act — sensitive personal data classification implicit; sector-specific data (financial, health, child) needs differentiated handling
• RBI Cyber Framework — data classification explicit requirement
• SEBI CSCRF — data classification per Q-RE / MII annexure
• ISO 27001:2022 A.5.12, A.5.13 — classification, labelling, handling

Common mistakes

• Policy without technical implementation — labels exist on paper, not in data
• Too many tiers (8-10) — users don’t know which to apply
• No auto-classification — manual labelling fails at scale
• DLP rules without labels — controls can’t differentiate
• Labels without enforcement — Restricted content shared externally without block

Try this in your organisation

1. Pick 5 documents with PII / financial data. Are they labelled?
2. Try to email a Restricted document externally. Does anything happen?
3. Pull DLP logs. Are they keyed to classification labels?
4. Without classification driving controls, every other data-protection control is partial.

Data classification is foundational. DLP, access control, retention, encryption, sharing rules — all reference labels. Get classification right; the downstream controls become tractable. Skip it; everything stays generic and inadequate.