Data Classification and Labelling Programme

Last updated: April 29, 2026

A Mumbai BFSI implemented “data classification” by emailing a 4-tier policy to all staff. Two years later, an audit found the policy existed but no document, file, or database was actually labelled. Their DLP couldn’t enforce anything because the data didn’t carry the labels the policy referenced. This module covers data classification as an operational programme.

What classification actually does

Data classification labels every piece of data with a sensitivity tier. The labels then drive controls — encryption, access, retention, sharing rules, monitoring. Without classification, you can’t apply differentiated controls; everything is either over-protected or under-protected.