Product guide

Data Classification

Define sensitivity categories and the patterns that assign them, so DLP and DSPM agree on what sensitive means.

What Classification Is#

Classification is the shared definition of what sensitive means in your organisation. DLP uses it to decide whether content should be blocked, and DSPM uses it to rank which data is riskiest.

Because two modules depend on it, a change here has a wide effect. Treat classification definitions as carefully as you treat policies.

Data classification signatures screen — Classification signatures with regex/keyword patterns, target extensions, and risk severity.

Sensitivity Categories#

Four categories are enough for most organisations. More categories rarely improve decisions and often stall the assignment process:

Category	What it covers
Public	Content that may be shared without restriction.
Internal	Content intended for the organisation but not for outsiders.
Confidential	Business content whose exposure would cause material harm.
Restricted	Personal data, financial records, and credentials governed by regulation or contract.

Fewer categories, clearer decisions

If two categories always receive the same treatment, merge them. Classification only helps when it changes what the platform does.

Patterns and Rules#

Rules are how a category is assigned. Four rule types are available:

Rule type	How it works
Pattern	A structured value such as a national ID number, a payment card number, or an API key format.
Keyword and phrase	Terms that identify a document type, such as a contract heading or a project codename.
Document metadata	Classification labels and properties already present in the file.
Combination	A rule that only matches when several conditions are true at once, which reduces false positives.

Applying Classification#

1
Start from the built-in patterns
Use the patterns the platform already provides for common regulated values, then narrow them to your organisation.
2
Add organisation-specific terms
Add keywords that only make sense in your business, such as internal project names and document headings.
3
Prefer combination rules
A single pattern matches too much on its own. Combine a pattern with a keyword or a document type to raise precision.
4
Measure before you enforce
Run the classification in audit mode and review the matches before the category is used by a blocking policy.

False positives have two costs

A rule that matches too broadly blocks legitimate work in DLP and inflates the PII finding list in DSPM. Both costs land on the same team, so fix the rule once.

Frequently Asked Questions#

Where is classification used?

DLP policies use it to decide what is sensitive, DSPM uses it to rank PII findings, and reports use it to group data by sensitivity.

Why does one pattern match too much?

A pattern that describes a common value, such as a ten-digit number, also matches values that are not sensitive. Combination rules are how you keep precision high.

Can I change a category later?

Yes, but treat the change as a policy change. Incidents and findings recorded under the previous definition keep their original classification.

Who should own the classifications?

The team accountable for the data, not the team operating the platform. Classification is a business decision that the platform records and enforces.