10/8/2026 • 5 min read
You can only protect what you know. This is the fundamental principle of data classification: identifying what an organization holds, understanding its sensitivity, and applying the right controls at the right level. Without classification, security operates blindly. Too broad, and it hinders productivity. Too weak, and it allows data leaks to slip through. This article explains why classification is the foundation of any data protection strategy.
In 2024, 35% of breaches documented by IBM involved data stored in unmanaged sources, known as “shadow data” (IBM, Cost of a Data Breach Report 2024). This data, whose existence or location may be unknown to security teams, inevitably creates blind spots in their protection strategy.
Classification directly addresses this problem. According to Thales' 2024 report, 70% of companies can classify only 50% or less of their data. As a result, a significant amount of data is moved, copied, shared, and stored without a clearly identified sensitivity level.
Scale is another challenge. The volumes of data generated by a modern organization cannot be handled document by document. Automated classification is not simply a convenience; it is essential for applying security policies effectively across all data.
Key takeaway. Without classification, it is impossible to tailor the level of protection to the sensitivity of the data.
A classification framework does not need to be complex to be effective. Most organizations rely on four levels, notably recommended by ANSSI, the French National Cybersecurity Agency, in its guidance published in 2025.
Public: Information that can be freely disclosed without consequences. Examples include press releases and marketing brochures.
Internal: Information intended for employees, which is not particularly sensitive but is not meant to be shared outside the organization. Examples include organizational charts and routine meeting minutes.
Confidential: Information whose unauthorized disclosure could harm the organization. Examples include customer data, contracts, unpublished financial information, and intellectual property.
Restricted: Highly sensitive information whose compromise could have serious consequences. Examples include health data, regulated data, trade secrets, and sensitive personal data under the GDPR.
A four-level framework that business teams understand is better than an eight-level framework that no one follows. Complexity is not a guarantee of rigor; it is often the enemy of adoption.
Beyond these organization-wide levels, classification can also be organized by business use case. A marketing team will classify its data differently from an HR team or a finance department, not because their sensitivity levels are fundamentally different, but because the data itself, its context of use, and the associated risks differ. Classifying data by use case enables tailored policies for each business area, without imposing a uniform framework that does not reflect operational realities.
Assigning a classification level to a document can be done using two complementary approaches, each suited to different situations.
Context-based classification relies on indirect signals associated with a document: where it is stored, where it came from, what it is called, its file extension, or the application that created it.
A document stored in the “Customer Contracts” folder on the legal department's SharePoint does not need to be opened to be classified as “Confidential.” An .xls file exported from payroll software will be classified differently from an .xls file created in a personal spreadsheet application. A document downloaded from a law firm's extranet will be treated differently from a file obtained from a public institution's website.
This approach also makes it possible to classify AI-generated content, including documents, images, and Excel files, based on their origin and the application that generated them. It therefore contributes to the traceability of AI-generated content and compliance with the AI Act's transparency requirements.
Content-based classification analyzes the document itself: it looks for patterns, regular expressions, keywords, and data structures characteristic of sensitive information.
A social security number follows a recognizable format. So does an IBAN. A document containing terms such as “trade secret” or “confidential,” or structured medical data, can be detected automatically.
In practice, the two approaches complement each other. Context-based classification quickly handles large volumes and straightforward cases. Content-based classification takes over for ambiguous, poorly named, or misplaced files, as well as sensitive data whose context does not reveal its nature.
Classification is not an end in itself. It is a prerequisite for other security mechanisms that cannot work effectively without it.
A DLP policy without classification is like asking a system to block “sensitive files” without defining what sensitive means. It generates either too many false positives, disrupting employees' work, or too many false negatives, allowing genuine risks to go undetected. With operational classification, DLP rules become precise: documents classified as “Restricted” cannot be sent to external domains, copied to removable storage, or shared through an unapproved SaaS tool.
The same reasoning applies to access rights management. “Confidential” data should be accessible to the teams that need it, not to the entire organization. Without classification labels, this level of granularity is impossible to maintain at scale. With them, access policies can be applied automatically at the data level, rather than only at the folder or application level.
Classification also helps organizations meet regulatory requirements precisely rather than excessively. The GDPR requires measures proportionate to the sensitivity of the data. NIS2 requires the protection of critical information. Without classification, compliance often means either overprotecting everything, which is costly and unmanageable, or underprotecting what truly matters.
Classification is not a one-time project. Data is constantly moved, copied, transformed, and shared throughout an organization's information systems. A sensitive document may be moved from one server to another, copied to a workstation, or shared over a network drive.
To remain useful, classification must follow these activities rather than depend solely on the file's original location. The goal is to preserve consistent sensitivity information as data moves throughout the organization's environment.
This is precisely Daspren's approach: continuously map sensitive data, automatically classify it based on its content and context, and maintain that classification as it moves across monitored environments. This approach enables organizations to retain control over their sensitive data, regardless of where it is stored.
Classifying your data means answering two simple questions: what are we protecting, and why? Without those answers, security tools lack context. With them, access controls, DLP, and monitoring can be applied more precisely and proportionately.
As data volumes grow and use cases multiply, the ability to identify, understand, and handle data according to its sensitivity becomes an essential foundation for a coherent protection strategy.
Want to learn more? Contact us today to discuss your data protection challenges.
