AI Data Classification Policy Writing Guide 2026: A Structured Framework for Data Tiering, Labeling Standards, and Access Control

A data classification policy is not a binary declaration that "company data is divided into confidential and public" — it is a data control document that determines what data is what level, who can access what level of data, and how different levels of data are handled. The problem with most data classification policies is that tiering standards are written vaguely ("sensitive data" — what counts as sensitive? customer lists? financial data? employee salaries?) and access control is fuzzy ("restrict access" — who can access? how to authorize? how to audit?). The biggest trap when using AI to write a data classification policy is asking it to "write a standard data classification template" — data sensitivity varies significantly by industry and business. What's useful is quantifying your actual data types, business scenarios, and compliance requirements.

I. The Five-Element Structure of a Data Classification Policy

An enforceable data classification policy contains five elements: Data Tiering (how many tiers — Public/Internal/Confidential/Highly Confidential four tiers; tiering standards), Data Labeling (how to label — file labeling/system labeling/transmission labeling; labeling standards), Access Control (who can access what tier of data — tiered access permissions; authorization process), Data Handling Rules (how different tiers of data are stored/transmitted/shared/destroyed — tiered handling rules), and Violation Handling (tiered penalties for unauthorized access/unauthorized sharing/unlabeled data). The five elements are sequential: without tiering you don't know data sensitivity, without labeling you can't identify, without access control data leaks, without handling rules operations are chaotic, without penalties there's no deterrence.

"I need to write a data classification policy for [company type/industry/data types]. Here are the data types and business scenarios: [paste]. Please organize by five elements: 1.Data Tiering (four tiers: Public — can be publicly released (website information/public marketing materials); Internal — internal use (internal notices/general business data); Confidential — sensitive business data (customer lists/contracts/financial data/employee salaries); Highly Confidential — core trade secrets (core technology/strategic planning/M&A information/unpublished financial reports) — leakage causes severe damage) 2.Data Labeling (file labeling: file header/footer marked with classification (Public/Internal/Confidential/Highly Confidential); system labeling: documents/data in systems labeled with classification tags; transmission labeling: email subject marked with classification; labeling standard: unified labeling format [Classification] + filename) 3.Access Control (Public: anyone can access; Internal: all employees can access; Confidential: relevant departments + authorized personnel can access; Highly Confidential: core team + approval-authorized personnel can access — access requires approval + recording) 4.Data Handling Rules (Public: no restrictions; Internal: no external sending; Confidential: encrypted storage/encrypted transmission/no sending to personal email/sharing requires approval; Highly Confidential: encrypted storage/encrypted transmission/dedicated devices/no external sending/sharing requires compliance director approval/destruction requires shredding or data wiping) 5.Violation Handling (unauthorized access: warning/demotion/termination; unauthorized sharing: demotion/termination + loss recovery; unlabeled: warning/training). Tiering standards must be quantified."

II. Data Tiering: Four-Tier Quantified Standards

Data tiering is the foundation of data classification — without tiering, all data is treated the same, with high-sensitivity data under-protected and low-sensitivity data over-protected. Four-tier classification: Public (data that can be publicly released — website information/public marketing materials/product manuals/published financial reports — leakage causes no damage), Internal (data for internal use — internal notices/general business data/non-sensitive operational data/internal directory — leakage causes minor damage), Confidential (sensitive business data — customer lists/contracts/financial data/employee salaries/supplier information/pricing strategies — leakage causes severe damage (customer loss/competitive advantage loss/legal disputes)), Highly Confidential (core trade secrets — core technology/source code/strategic planning/M&A information/unpublished financial reports/executive compensation — leakage causes exceptionally severe damage (core competitiveness loss/major economic losses/legal liability)). Tiering standard: leakage impact assessment — no damage → Public/minor damage → Internal/severe damage → Confidential/exceptionally severe damage → Highly Confidential. Data owner is responsible for determining data classification, compliance department reviews.

"Here are the data inventory and business scenarios: [paste]. Please detail by four tiers + quantified standards: 1.Public (①definition: data that can be publicly released ②examples: website information/public marketing materials/product manuals/published financial reports/press releases ③leakage impact: no damage ④access control: anyone can access ⑤handling rules: no restrictions) 2.Internal (①definition: data for internal use ②examples: internal notices/general business data/non-sensitive operational data/internal directory/meeting minutes (non-sensitive) ③leakage impact: minor damage (internal management confusion) ④access control: all employees can access ⑤handling rules: no external sending (no sending to personal email/personal WeChat/external cloud drives)) 3.Confidential (①definition: sensitive business data ②examples: customer lists/contracts/financial data/employee salaries/supplier information/pricing strategies/market analysis (non-public) ③leakage impact: severe damage (customer loss/competitive advantage loss/legal disputes/economic losses ≥100K RMB) ④access control: relevant departments + authorized personnel can access — access requires approval (department supervisor approval) ⑤handling rules: encrypted storage (AES-256)/encrypted transmission (TLS 1.2+)/no sending to personal email/sharing requires approval (department supervisor approval)) 4.Highly Confidential (①definition: core trade secrets ②examples: core technology/source code/strategic planning/M&A information/unpublished financial reports/executive compensation/core technical drawings ③leakage impact: exceptionally severe damage (core competitiveness loss/major economic losses ≥1M RMB/legal liability) ④access control: core team + approval-authorized personnel can access — access requires compliance director approval + access records ⑤handling rules: encrypted storage (AES-256)/encrypted transmission (TLS 1.2+)/dedicated devices (dedicated computers/dedicated USB drives)/no external sending/sharing requires compliance director approval/destruction requires shredding or data wiping (DoD 5220.22-M standard)). Generate tiering matrix: data type|classification|leakage impact|access control|handling rules."

III. Access Control and Data Handling: Tiered Controls

Access control is the key to data protection — without access control, data leaks. Tiered access control: Public (anyone can access — no authorization required), Internal (all employees can access — authorized upon onboarding), Confidential (relevant departments + authorized personnel can access — access requires department supervisor approval + access records (who/when/accessed what)), Highly Confidential (core team + approval-authorized personnel can access — access requires compliance director approval + access records + periodic review of access permissions (quarterly review)). Data handling rules tiered: Storage (Public/Internal: ordinary storage; Confidential/Highly Confidential: encrypted storage (AES-256)), Transmission (Public: no restrictions; Internal: company email/internal systems; Confidential/Highly Confidential: encrypted transmission (TLS 1.2+/VPN)), Sharing (Public: no restrictions; Internal: internal sharing; Confidential: sharing requires department supervisor approval + sharing records; Highly Confidential: sharing requires compliance director approval + sharing records + recipient signs NDA), Destruction (Public/Internal: ordinary deletion; Confidential: secure deletion (overwrite deletion); Highly Confidential: physical destruction (shredding) or data wiping (DoD 5220.22-M standard — 7 passes)).

"Here are the organizational structure and data processing flows: [paste]. Please detail by tiered controls: 1.Access Control (①Public: anyone can access, no authorization required ②Internal: all employees can access, authorized upon onboarding ③Confidential: relevant departments + authorized personnel can access — access requires department supervisor approval + access records (who/when/accessed what/access purpose) ④Highly Confidential: core team + approval-authorized personnel can access — access requires compliance director approval + access records + quarterly review of access permissions (whether access is still needed) ⑤access permission management: HR system + IT system integration — employee onboarding/transfer/departure automatically adjusts access permissions) 2.Storage (①Public/Internal: ordinary storage (file servers/cloud drives) ②Confidential/Highly Confidential: encrypted storage (AES-256) — file encryption/database encryption/disk encryption ③backup: encrypted backup — backup data also encrypted) 3.Transmission (①Public: no restrictions ②Internal: company email/internal systems ③Confidential/Highly Confidential: encrypted transmission (TLS 1.2+/VPN/SFTP) — no plaintext transmission ④external sending: Confidential/Highly Confidential no sending to personal email/personal WeChat/external cloud drives — must use company secure channels (encrypted email/secure file transfer platform)) 4.Sharing (①Public: no restrictions ②Internal: internal sharing ③Confidential: sharing requires department supervisor approval + sharing records (shared with whom/what was shared/sharing purpose/sharing period) ④Highly Confidential: sharing requires compliance director approval + sharing records + recipient signs NDA ⑤external sharing: Confidential/Highly Confidential sharing with external parties (suppliers/customers/partners) requires compliance director approval + NDA + minimized sharing (only share necessary data)) 5.Destruction (①Public/Internal: ordinary deletion (recycle bin deletion) ②Confidential: secure deletion (overwrite deletion — file shredding tools) ③Highly Confidential: physical destruction (paper documents shredding — shredder security level ≥P-4) or data wiping (electronic data DoD 5220.22-M standard — 7 passes) ④destruction records: destruction records (what was destroyed/when/who executed/who supervised) retained ≥5 years). Generate control matrix: classification|access control|storage|transmission|sharing|destruction."

IV. Common Mistakes Checklist

• Data tiering written as "confidential and public": binary is insufficient. Fix: four-tier classification (Public/Internal/Confidential/Highly Confidential)
• Tiering standards written as "sensitive data": not executable. Fix: leakage impact quantified assessment (no damage/minor/severe/exceptionally severe)
• No data labeling: can't identify classification. Fix: file labeling + system labeling + transmission labeling ([Classification] + filename)
• Access control written as "restrict access": too vague. Fix: tiered access (Public anyone/Internal all employees/Confidential approval/Highly Confidential compliance director approval)
• No access records: unauthorized access can't be traced. Fix: access records (who/when/accessed what/purpose)
• Sharing without approval: casual external sending. Fix: Confidential sharing department supervisor approval/Highly Confidential compliance director approval + NDA
• Destruction written as "delete": ordinary deletion is recoverable. Fix: Confidential secure deletion/Highly Confidential physical destruction or DoD 7-pass wipe

V. Complete Example

Company: Tech enterprise data classification policy (excerpts tiering + access control + handling rules).
Tiering: ①Public — website information/marketing materials/published financial reports (leakage no damage) ②Internal — internal notices/general business data/internal directory (leakage minor damage) ③Confidential — customer lists/contracts/financial data/employee salaries/pricing strategies (leakage severe damage, customer loss/competitive advantage loss/economic losses ≥100K RMB) ④Highly Confidential — core technology/source code/strategic planning/M&A information/unpublished financial reports (leakage exceptionally severe damage, core competitiveness loss/economic losses ≥1M RMB).
Labeling: File header marked [Classification] + filename; documents in systems labeled with classification tags; email subject marked with classification.
Access Control: Public anyone/Internal all employees/Confidential relevant departments + authorized personnel (department supervisor approval + access records)/Highly Confidential core team + approval-authorized personnel (compliance director approval + access records + quarterly permission review).
Handling Rules: ①Storage — Confidential/Highly Confidential encrypted storage (AES-256) ②Transmission — Confidential/Highly Confidential encrypted transmission (TLS 1.2+), no sending to personal email/WeChat/cloud drives ③Sharing — Confidential department supervisor approval + records, Highly Confidential compliance director approval + records + NDA, external sharing compliance director approval + NDA + minimized sharing ④Destruction — Confidential secure deletion (overwrite deletion), Highly Confidential physical destruction (shredding ≥P-4) or data wiping (DoD 7 passes), destruction records retained ≥5 years.
Violations: Unauthorized access warning/demotion/termination; unauthorized sharing demotion/termination + loss recovery; unlabeled warning/training.

This article focuses on data classification policy writing. When building a complete data protection system, also see AI Data Protection Policy Writing Guide (data protection governance framework), AI Data Governance Policy Writing Guide (data lifecycle management), and AI Information Security Policy Writing Guide (information security control measures).

Frequently Asked Questions

Q1: What classification should employee salary data be?

Employee salary data should be classified as Confidential. Reasons: ①Leakage impact severe — employee salary leakage causes employee dissatisfaction (perceived unfairness)/talent loss (competitor poaching)/labor disputes (pay discrimination lawsuits)/management chaos (employees comparing salaries) ②Legal requirements — some jurisdictions (e.g., EU GDPR) treat salary data as personal data requiring protection ③Access control — salary data should only be accessible to HR department + direct supervisors, not visible to all employees ④Handling rules — encrypted storage (HR system encryption)/encrypted transmission (no plaintext sending)/sharing requires approval (HR director approval). But note: executive compensation is typically classified as Highly Confidential — executive compensation leakage has greater impact (media attention/shareholder questioning/competitor poaching). Regular employee salaries are Confidential; executive compensation is Highly Confidential. Access control: regular employee salaries — HR department + direct supervisors can access; executive compensation — HR director + CEO/CFO can access. Records: salary data access records (who/when/accessed what/purpose) — if an employee frequently queries other employees' salaries, it may be abnormal behavior (HR audit).

Q2: Are customer lists and contracts the same classification?

Usually the same classification (Confidential), but analyze specifically. Customer lists: ①Leakage impact — customer list leakage causes customer loss (competitors directly contacting customers)/competitive advantage loss (customer resources are core competitiveness) — typically classified as Confidential ②But note: if customer lists include customer contact information + purchase records + preferences — leakage impact is greater (targeted marketing/customer harassment), can be classified as Highly Confidential ③If customer lists only include customer names (without contact information) — leakage impact is relatively smaller, can be classified as Confidential. Contracts: ①Leakage impact — contract leakage causes commercial terms exposure (pricing/payment terms/liability for breach)/competitive advantage loss (competitors learn pricing strategies)/legal disputes (contract terms exploited) — typically classified as Confidential ②But note: if contracts involve M&A/major cooperation/strategic planning — leakage impact is greater (affects stock price/competitive landscape), can be classified as Highly Confidential ③If contracts are standard contracts (e.g., standard procurement contracts) — leakage impact is relatively smaller, Confidential suffices. Key: don't look at data type (customer lists/contracts), look at leakage impact — leakage impact assessment (no damage/minor/severe/exceptionally severe) determines classification. Customer lists and contracts typically have severe leakage impact (customer loss/competitive advantage loss), classified as Confidential; if involving core trade secrets (M&A/strategy), classified as Highly Confidential.

Q3: How to ensure departing employees return/destroy all confidential data?

Departure data cleanup process: ①Departure notification — HR notifies IT and compliance department of employee departure ②Access permission revocation — IT immediately revokes all system access permissions (email/file servers/business systems/cloud drives) ③Device recovery — IT recovers company devices (computers/phones/USB drives), checks whether devices contain confidential data ④Data cleanup — IT remotely wipes company data (if employee used personal devices for company data — BYOD policy must include remote wipe clauses) ⑤Document return — employee returns all paper documents (confidential documents shredded or returned) ⑥Confidentiality obligation reminder — employee signs departure confidentiality commitment (committing to continue confidentiality obligations after departure, not to disclose/use company confidential data) ⑦Audit — compliance department audits employee's recent data access records (whether abnormal downloading/external sending of confidential data) ⑧Follow-up monitoring — if employee joins a competitor after departure, monitor whether confidential data is leaked (if leakage discovered, legal action). Key: start monitoring 30 days before departure — if employee downloads/sends large amounts of confidential data before departure, they may be taking data, investigate immediately. Records: departure data cleanup records (access permission revocation/device recovery/data cleanup/document return/confidentiality commitment) retained ≥5 years. If employee refuses to return devices or documents — legal action (trade secret infringement).

Author: UseAIWriter Editorial | Updated: 2026-10-27 | Written by UseAIWriter Editorial. Please cite the source when reposting.