What does data classification involve?

• A. Encrypting all data regardless of sensitivity.
• B. Deleting data after a fixed period.
• C. Storing data in a single centralized repository.
• D. Tagging data by sensitivity and applying appropriate protection levels and access controls.

Answer: (D)

Data classification is the process of labeling data by its sensitivity and criticality and then applying appropriate protection levels and access controls based on that classification. By tagging data with a level (for example, public, internal, confidential, or restricted) you establish rules for who can view it, how it should be encrypted, where it can be stored, and how long it should be retained. This creates a tiered security approach so more sensitive information gets stronger protections while less sensitive data can have lighter safeguards. This supports principles like least privilege, regulatory compliance, and risk management.

Encrypting all data regardless of sensitivity isn’t classification—it treats all data the same and ignores the differing protection needs. Deleting data after a fixed period describes a retention policy, not how data is categorized by sensitivity. Storing data in a single centralized repository is a storage strategy and doesn’t involve labeling data or assigning differentiated protections.