Know what your data is — before you decide how to protect it.
Data Classification gives every discovered data asset a clear category, sensitivity level and business context, so consent, retention, rights requests and risk decisions can be applied consistently across the organisation.
- Categorise personal data by type and sensitivity
- Link data to purpose, owner and system
- Feed consent, RoPA and retention workflows
Classification Overview
Finding data is only half the answer.
Discovery tells you where personal data lives. Classification tells you what it is, how sensitive it is and why it exists. Without that context, every data asset looks the same, and privacy teams cannot decide which consent applies, how long the data should be kept or which records need closer review.
Not all data carries the same risk.
A phone number in a CRM and an identity document in a shared drive need different controls.
Purposes depend on categories.
Purpose-wise consent works only when the organisation knows which categories of personal data each purpose uses.
Evidence needs structure.
Auditors and regulators expect organisations to explain what they hold and why, not just that they hold it.
From raw data to governed categories.
Classification works best as a repeatable process rather than a one-time labelling exercise.
- 01
Define the model
Set the categories, sensitivity levels and business attributes that fit your organisation and the DPDP framework.
- 02
Apply classifications
Assign categories to discovered data sources, tables, fields and documents.
- 03
Review and confirm
Route uncertain or high-sensitivity items to data owners for review before they are finalised.
- 04
Link to context
Connect each classified asset to its purpose, owner, system and retention expectation.
- 05
Keep it current
Re-classify as new systems, fields and processing activities appear.
A common language for personal data.
Configure the model around your own data types, sensitivity thresholds and governance needs.
| Category | Description |
|---|---|
| Identity Data | Names, government identifiers, account IDs and other information that identifies a Data Principal. |
| Contact Data | Email addresses, phone numbers and postal addresses used to reach individuals. |
| Financial Data | Bank, payment, transaction and billing information. |
| Children’s Data | Personal data of individuals under 18, which needs verifiable parental consent under the DPDP Act. |
| Location Data | Addresses, device location and other information that places an individual. |
| Behavioural & Usage Data | Activity logs, preferences and interaction history linked to an individual. |
| Employee Data | HR records, payroll and performance information about staff. |
| Business Context | Purpose, owner, system and retention attributes that make every classification actionable. |
More than a label.
Configurable taxonomy
Build categories and sensitivity levels that match your organisation.
Field-level classification
Classify data at the level of sources, tables, fields and documents.
Review queue
Send uncertain or high-sensitivity items to data owners for confirmation.
Purpose mapping
Link each data category to the purposes it supports.
Ownership
Assign accountable owners to classified assets.
Retention tagging
Attach retention expectations to categories and assets.
Classification history
Keep a record of who classified what, when and why.
Dashboards
Track classification coverage, sensitivity spread and pending reviews.
Classification is what makes every other control precise.
Consent
Capture purpose-wise consent against the right categories of personal data.
RoPA
Describe each processing activity with accurate data categories.
Rights requests
Locate and act on the right records when a Data Principal asks for access, correction or erasure.
Retention
Apply deletion and review timelines by category, not by guesswork.
Risk & DPIA
Highlight high-sensitivity processing for closer review.
A governance view.
See which categories of personal data the organisation holds, how sensitive they are and which purposes rely on them.
A systems view.
Know which fields and repositories hold classified data, who owns them and which controls apply.
FAQs
Yes. iDiscover finds where personal data exists. Data Classification adds meaning to that data: its category, sensitivity, purpose and owner.
Yes. The classification model is configurable, so you can match your organisation’s taxonomy and policies.
The DPDP Act does not set out separate sensitivity tiers, but it does place specific obligations on certain data, such as children’s data. Sensitivity levels in iConsent reflect your organisation’s own risk and governance policy.
Purpose-wise consent depends on knowing which categories of personal data each purpose uses. Classification provides that link.
You cannot govern data you have not understood.
See how Data Classification turns discovered data into structured, governed information across your privacy programme.
