What is data classification?

• A. A process that categorizes data by impact
• B. A process that categorizes data by size
• C. A process that categorizes data by sensitivity and impact, guiding protection controls and handling requirements
• D. A process that stores data in the cloud

Answer: (C)

Data classification is the process of labeling data according to its sensitivity and the potential impact of exposure or loss, so that appropriate protection controls and handling requirements can be applied. By considering both how sensitive the information is and the potential harm if it is compromised, organizations can tailor safeguards, access controls, encryption, retention, and disposal rules to each data type. This dual focus ensures that more critical data receives stronger protection while less sensitive data can be handled appropriately without unnecessary controls. Categorizing by impact alone misses the sensitivity dimension, and focusing on size or storage location (such as cloud) does not address how data should be protected based on risk.