Discover and Classify Your Data

Provide your data with the protection it deserves.

Analyst Perspective

Keep data classification simple.

Safayat Moahamad

Research Director
Security and Privacy
Info-Tech Research Group

Data classification is crucial for organizations to protect sensitive information, comply with regulatory requirements, and enhance operational efficiency. It supports better data governance, enabling organizations to optimize storage, improve data accessibility, and enhance decision-making processes.

However, organizations are overwhelmed with data, and securing it is a growing challenge. Business and IT leaders can ensure that critical data is protected without wasting resources by keeping data classification simple. Focus on:

• Taking incremental steps; don’t try to classify everything immediately.
• Identifying and securing the most critical, high-sensitivity data first.
• Collaborating with data owners to help prioritize key assets.

To streamline the process, integrate data classification into daily workflows, allowing users to label information as they create it. This approach reduces the burden on employees while improving compliance and governance over time. Understanding where critical data resides and how it is protected enables organizations to justify security investments through data analysis and enhance overall data protection and governance strategies.

Executive Summary

Your Challenge

• You have compliance requirements to identify, classify, and protect high-risk data.
• Your AI initiatives require an understanding of which data is sensitive and how it should be handled.
• Existing data handling procedures don’t properly address the sensitivity of your data.
• Your data classification program is ad hoc or dated, and the scheme isn’t applied consistently

Common Obstacles

• You have a large data backlog and don’t know where to start the classification project.
• You have a limited budget. You need to understand where the most protection against data breaches is required so you can save on storage costs.
• End users are the weakest link in the data security chain. They need significant awareness and training to accurately classify sensitive information.

Info-Tech’s Approach

• Formalize the data classification initiative with policies, standards, and a structured steering committee to ensure accountability and consistency.
• Identify where your data lives and implement controls to protect it. Ensure the protection is proportional to its sensitivity and criticality.
• Understand what tools are available to implement an efficient data classification program.

Info-Tech Insight

Avoid analysis paralysis. Classifying all your data at once may not be feasible. Start small, quantify your results, report them to management, and then go back and tackle a larger portion.

Your Challenge

This research is designed to help organizations design a process to discover and classify their data.

• Data classification is the process of organizing data into relevant categories. Classification helps improve information security and privacy by enabling the assignment of access permissions and the implementation of protection measures for different kinds of data.
• Without a consistent process to discover and classify sensitive or critical data, you won’t be able to identify what data is at high risk of being leaked or stolen. Prioritize risk mitigation initiatives to prevent a data breach or determine how to scale investment in data loss prevention tools.

Data discovery and classification is the first step in protecting high-risk data from malicious actors.

Average data breach costs rose to a historic high of $4.88M in 2024, before declining in 2025, driven in part by AI and automation. Nevertheless, costs for organizations with lower security maturity still averaged $5.52M, which is well above 2024’s record high.

Source: IBM, 2025

Common obstacles

Data discovery can be daunting. Avoid analysis paralysis.

• Large data backlogs can make it difficult to figure out where to start. Classifying all your data at once may not be feasible.
• You have a limited budget. You need to understand where you need the most protection against data breaches so you can save on storage costs.
• The dynamic nature of data complicates matters. The criticality of a piece of data shifts over time. Your data classification program will need to incorporate reassessments to prevent over protecting the data.

Focus the program to classify what matters. The classification program should be measurable, auditable, and manageable.

Data Visibility Remains Elusive

Only a third of organizations have full knowledge of where their data is stored.

39%

Fewer than four in 10 organizations report being able to classify all of their data.

Source: Thales, 2026.

Understand how data discovery & classification supports your data practice

Explore Info-Tech’s Data Research Center to see how our research can support your data practice.

Visit Data Research Center

The Data Value Trinity

• Data strategy tells you what you need to achieve to be successful.
• The data operating model aligns resources, processes, measures, stakeholders, value streams, and decision rights to enable the delivery of your strategy and priorities.
• Data governance ensures the alignment of data initiatives and organizational outcomes.

A change in one necessitates a change in the others

Enable AI projects through data discovery and classification

Successful and responsible AI requires effective data governance. Effective data governance requires a foundation of known and well-classified data.

AI systems require reliable data with high data quality to deliver value without exposing the organization to unnecessary risk. You cannot enforce controls or meet compliance requirements if your data has no labels to act on.

Data discovery gives organizations visibility into what data they have, and data classification helps them decide which data is fit to train on or expose to AI tools.

In other words, data discovery and classification is a cornerstone upon which effective data governance and subsequent AI initiatives are built.

What if you deploy AI without classifying your data?

• Sensitive data may be unintentionally exposed through AI tools.
• Uncertain data quality will make it difficult to confidently use data for AI.
• Governance cannot be effectively enforced since controls require proper data labels to act on.

Download this blueprint

90%

Most organizations have sensitive files exposed to all employees via Microsoft Copilot.

Source: Varonis, 2025.

Insight summary

Provide your data with the protection it deserves.

Avoid analysis paralysis.

• Classifying all your data at once may not be feasible. Start small, quantify your results, report them to management, and then go back and tackle a larger portion.

Keep it simple.

• Leave as little ambiguity as possible for an easy-to-follow classification program. Clearly define the roles and responsibilities of everyone involved, from data custodians to data users.

Data, by its nature, does not stay static.

• A piece of data’s criticality will peak, but strategic reassessment will eliminate under/overprotection of data. Data classification must be a program, not a one-time project.
• Successful risk mitigation is dependent on knowing your data’s criticality and where it lives. While data discovery can be overwhelming, strategic interviews with data owners, in addition to the use of technology, are starting steps to mapping data.
• This information leads to more accurate threat modeling and security controls investments.

Focus the program on measurable, auditable, and manageable classification.

• Perform data location analysis and security analysis to inform your overall security initiatives. Understand which departments own the most sensitive data and provide training to improve awareness.
• Use the classification distribution visuals to make strategic decisions such as which security controls and processes your organization should expand, and which repositories it should consolidate.

Measure the value of this blueprint

After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.

9.4 / 10

Overall Average Savings

$119,318

Overall Average Days Saved

45

Phase 1

Formalize the Classification Program

Phase 1

1.1 Establish a steering committee

1.2 Formalize data classification policy

Discover and Classify Your Data

This phase will walk you through the following activities:

• Develop a steering committee charter
• Create a data classification policy
• Develop a data classification standard
• Assign roles and responsibilities in the data classification program

This phase involves the following participants:

• Security leader
• Data steward
• Data custodian
• Data owners
• Legal representative
• Data user representative

Outcomes of this step

• Identify compliance regulations
• Build steering committee
• Define roles and responsibilities
• Formalize requirements and definitions
• Document data handling requirements and procedures

Data classification defined

Data classification is the process of identifying and classifying data based on sensitivity and the impact the information could have on the company if the data is breached. The classification initiative outlines proper handling procedures for the creation, usage, storage, disclosure, and removal of data.

Data classification is the first step in security initiatives that mitigate the risk of loss of data integrity, availability, and confidentiality.

47%

Less than half of sensitive cloud data is properly protected with encryption.

Source: Thales, 2026

Why do we need data classification?

With the increase in data and digital advancements in communication and storage (e.g. cloud), it becomes a challenge for organizations to know what data exists and where it lives. A classification scheme must be properly implemented and socialized to help ensure appropriate security measures are applied to protect that data appropriately.

Without data classification, an organization treats all information the same.

• Sensitive data may have too little protection.
• Less sensitive data may have too much protection.

Strategically classifying data will allow an organization to implement proper controls where necessary.

Data classification will benefit your organization

Effective data classification will help you:

In identifying and assessing the risk of organizational data, appropriate resources must be allocated so that proper security mechanisms can protect the business’ most sensitive data.

Maintain compliance

In most cases, data classification is the foundation to complying with regulatory requirements such as GDPR, HIPAA, NIST, and PCI DSS.

Companies that do not comply with such mandates can be subjected to fines and/or penalties.

Improve operational efficiency.

Data classification enables the identification of data that is not needed, cutting storage costs and increasing overall data management and search efficiency.

As a result, companies can focus on proportionally deploying data security measures on the data assets that are most sensitive.

Empower end users.

Preestablished categorizations enable users to select appropriate classifications.

Overall, this promotes organizational involvement and accountability in the protection of data.

Challenges of data classification

Amount of data

Huge volumes of different data types stored in many places. Consider data across all business platforms.

An ongoing, iterative process

Classification schemes will evolve with organizational goals, communication and storage technologies, and new data collected. Analyze data flows regularly to ensure appropriate use and storage of data.

There is no one-size-fits-all

The specific categorizations you use will be dependent on several factors, such as the organizational goals, data interactions, and governance priorities.

End-user awareness

All employees must know how to classify, maintain, and handle the data they interact with in order for the program to be successful.

Data management and responsibility

Documenting information flow and process accountabilities is difficult. Establish clear roles and responsibilities in the data classification steering committee (DCSC) to ensure good governance.

Understand data types

What is a data type?

A data type is any data, or logical collection of data, which is used for a specific business purpose.

Examples include:

• Client data
• Employee files
• Source code
• Press releases

Some data types may be the subjects of other data types. For example, performance assessment data is a subset of employee data.

When determining how granular to get in defining data types, consider whether the data type is used and stored independently of the higher-level data type.

What is data?

Data is raw information, in any format, representing qualitative or quantitative values.

Review types of data

Structured

Structured data adheres to a fixed, predefined format, typically quantitative and highly organized, requiring minimal or no reformatting.

An example is a database containing customer details such as names, addresses, phone numbers, email IDs, and billing information.

Semi-Structured

Semi-structured data is a type of structured data that does not strictly follow traditional database schemas. It uses metadata tags or markers to provide some organization.

For example, a tab-delimited file with marketing leads, or a social media post with user comments is semi-structured.

Unstructured

Unstructured data is qualitative and requires preprocessing prior to conducting analytics.

Examples include raw IoT data, network logs, multimedia files, and social media posts.

It is typically stored in data lakes. Specialized tools are needed to structure and analyze this data.

Snapshot: Data handling at organizations

31%

Data Strategy

Only 31% of organizations have a data strategy aligned to business objectives.

41%

Data Management

41% of organizations have established a formal data management program.

40%

Data Governance

Four in 10 organizations have a fully operational data governance function.

22%

Data Knowledge

Just one in five organizations report having a mature, consistent understanding of their data.

26%

Data Quality

One in four organizations have operationalized a continuous data quality program.

26%

Data Controls

Only a quarter of organizations have mature data risk management operations and controls.

Source: EDM Association, 2026.

Types of sensitive data

Sensitive data generally falls into one of the following four categories:

1. Personally identifiable information (PII)

   E.g. social security number, driver’s license number, financial account number with security code/password

2. Protected health information (PHI)

   E.g. medical history, health insurance numbers, biometric identifiers

3. Payment card industry (PCI) data

   E.g. cardholder name, expiration date, PIN, magnetic strip contents

4. Intellectual property (IP)

   E.g. trade secrets, merger and acquisition plans, product plans

Regulatory obligations

Data classification is often driven by legal, regulatory, and contractual obligations.

• Your data classification program may be directly or indirectly mandated depending on your organization’s industry and/or location.
• Your organization may deal with more types of data than you think. Work with the legal department to learn which regulations apply to your data. They can help reinforce the importance of the data classification initiative with upper management.