Data Classification and Sensitivity Labelling

A support-ticket table has a column called notes. The catalogue marks it Internal. A customer writes that they missed a payment because they were in hospital for chemotherapy. That column is now health data, the embedding index built over it for a retrieval assistant is health data, and the assistant answering an agent's question is serving health data to whoever can reach it. Every access policy downstream trusted a label that was correct the day it was assigned.

Classification decides how sensitive information is. Labelling attaches that decision to the thing itself so systems can act on it. ISO/IEC 27001:2022 separates them as two controls, 5.12 (classification of information) and 5.13 (labelling of information), and the separation is useful: most failures are not a wrong scheme but a right scheme whose labels did not follow the data. Access Control for Analytical Data covers the policies that read labels; this concept is about producing labels worth reading.

A scheme that can be computed

Schemes vary in vocabulary (Public, Internal, Confidential, Restricted is common) but the useful ones share two properties: the levels are ordered, and each asset can be scored on more than one dimension. FIPS 199 scores confidentiality, integrity and availability separately as low, moderate or high, and defines a system's category as the per-dimension maximum over the information types it holds, which it calls the high water mark (NIST, 2004, FIPS 199: Standards for Security Categorization of Federal Information and Information Systems). Its own example: contract information at (moderate, moderate, low) and administrative information at (low, low, low) yield an acquisition system at (moderate, moderate, low).

How many levels is a design choice with a cost on each side. In April 2014 the UK government collapsed a six-tier protective marking scheme (UNCLASSIFIED through TOP SECRET) into three classifications, OFFICIAL, SECRET and TOP SECRET, trading granularity for levels people could apply consistently.

Propagation is the real system

Treat labels as a lattice with order \(\ell_1 \le \ell_2 \le \dots \le \ell_n\). For any derived asset \(y\) computed from inputs \(x_1, \dots, x_m\), the default rule is

This is the high water mark applied along lineage, and it is only enforceable if lineage is captured at column level (see Column-Level Lineage). A worked case: a feature table joins customers (Confidential), web_events (Internal) and regions (Public). It is Confidential. A model trained on it inherits Confidential, as do the vector index of its embeddings, cached predictions, and evaluation dumps. Commercial tooling has adopted the same rule for generative assistants: when Copilot in Word, PowerPoint or Outlook drafts from several labelled files, the new content inherits the highest-priority label, though a user can override it (Microsoft Learn, Use Microsoft Purview to manage data security & compliance for Microsoft 365 Copilot & Microsoft 365 Copilot Chat).

The max rule has a known pathology. Applied faithfully, labels only ratchet upward and, within a few pipeline hops, most of the platform is Confidential. Declassification has to be explicit: a transformation that genuinely reduces sensitivity, such as aggregation with a minimum group size or a differentially private release, is registered as a rule that lowers the output label, with an owner who signs for it.

Sensitivity is not a property of columns alone

Two effects push sensitivity above the max of the inputs. The first is aggregation: US classification policy allows compilations of individually unclassified items to be classified if the compilation reveals an association that is not revealed by any item alone (Executive Order 13526, 2009, §1.7(e)). A table of badge swipes is mundane; the same table joined to shift rosters maps who is where at night. The second is inference. The Court of Justice of the EU held that data from which a person's sexual orientation can be deduced, here a published partner's name, falls under the special-category protections of GDPR Article 9 even though it is not sexual-orientation data on its face (CJEU, C-184/20, OT v Vyriausioji tarnybinės etikos komisija, 1 August 2022). A classifier that labels columns by their content will miss both.

When it breaks

Over-classification destroys the signal. If, say, 80% of assets are Confidential, the label no longer distinguishes anything, users route around controls to get work done, and the genuinely restricted 2% hide in the crowd. Practitioners disagree on the remedy: one camp defaults new assets to the most restrictive level and requires justification to lower it, which is safe and produces label creep; the other defaults to Internal and relies on scanners to raise it, which is usable and fails open when scanners miss.

Automated scanners have recall, not certainty. Illustrative arithmetic: a platform with 40,000 columns of which 3% (1,200) hold personal data, scanned at 90% recall, leaves 120 sensitive columns unlabelled, and they are disproportionately the free-text fields like notes where pattern matching is weakest.

Labels decay while data changes. A column's content drifts with product changes; a label assigned at creation is rarely re-evaluated. Periodic rescans and owner attestation are the defence, and both are routinely unbudgeted.

Models blur the boundary. Whether weights trained on Confidential data must carry that label is contested. Treating weights as derived Confidential assets is consistent with the max rule and with evidence that models memorise training records; treating them as non-sensitive is what makes model sharing practical. The EDPB's position that a model trained on personal data is not anonymous by default, but only after a case-by-case assessment, sides with inheritance unless someone demonstrates otherwise (EDPB, 2024, Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models).