An insurer must classify data sensitivity across a growing estate. What makes classification work rather than becoming a stale register?

What makes it work

• Attached at the schema level, in code, reviewed like code — not in a separate register that drifts.
• Three levels at most, with unambiguous examples, so a developer classifies a new field in seconds without consulting anyone. Five or six categories cannot be applied consistently, so the classification becomes arbitrary and so do the controls derived from it.
• Automated consequences per level: encryption requirement, retention period, whether it may appear in logs, whether it may leave a region, who may query it, whether it is masked in non-production.
• Enforcement rather than documentation. A sensitive field appearing in a log statement or a non-production dataset should be rejected by a pipeline check, not discouraged by a policy.
• Defaults that fail safe: unclassified data treated as most sensitive until classified, which makes classification the path of least resistance.
• Propagation through lineage, since a restricted column copied into an aggregate, a model's training set or an export has escaped the policy unless the classification travels with it.

Why registers fail

They are documents rather than mechanisms. A policy defining levels with no automated consequence produces a spreadsheet that is out of date within a quarter and controls that depend on developers remembering.

The consequences that matter most in insurance

• Health data, which carries a stricter regime than financial data in most jurisdictions and which arrives through claim documents that are unstructured.
• What may appear in logs, which is where sensitive data most often leaks and is then retained, replicated to analytics, and read by many people.
• What may go to non-production, fixed by automated masking rather than by policy.
• Retention, which conflicts between regimes — a claim record retained for years alongside personal data subject to erasure.

The document-processing dimension

Unstructured claim documents contain everything, and classification at the field level does not reach inside them. Extraction, classification and redaction of document content is a separate problem with its own error rate, and treating a document store as a single classified asset is the usual simplification — which is defensible only if the whole store is treated at the highest sensitivity present in it.