Objective
Design a clear, enforceable classification scheme for personal sensitive data to support consistent handling, compliance, and risk mitigation across the data lifecycle (collection, storage, use, sharing, retention, and disposal).
Scope and Definitions
- Personal Data: Any information relating to an identified or identifiable natural person (directly or indirectly).
- Sensitive Personal Data: Personal data that poses elevated risk to individuals if misused or disclosed, or is specifically protected by law or industry frameworks.
- Pseudonymized Data: Personal data processed such that it can no longer be attributed to a specific person without additional information; remains personal data.
- Anonymized Data: Data irreversibly de-identified; not personal data if anonymization is robust and irreversible.
Classification Levels
Use three levels for personal data with criteria, examples, and handling requirements:
Level PD-1 — Personal (Basic)
- Criteria: Identifiers and attributes with lower risk if disclosed; not specifically protected as “sensitive” by law.
- Examples: Name, work title, employer, general contact details (work email, phone), general demographic attributes (age range), device identifiers when not linked to precise location or sensitive context, cookie IDs, user IDs.
- Key handling requirements:
- Access: Role-based access control (RBAC); need-to-know.
- Encryption: In transit mandatory; at rest recommended.
- Masking: Required in non-production environments when feasible.
- Retention: Minimize and document; delete when business purpose ends.
- Sharing: Contracts with processors; data protection addendum.
Level PD-2 — Personal (Sensitive)
- Criteria: Elevated risk of harm, fraud, identity theft, or discrimination; often explicitly defined as sensitive by regulations or industry standards.
- Examples:
- Government IDs (passport, national ID, SSN, driver’s license).
- Financial data (bank account numbers, payment card data subject to PCI DSS).
- Authentication data (passwords, MFA secrets, private keys).
- Precise geolocation (e.g., within ~185 meters).
- Children’s personal data (age thresholds vary by jurisdiction; e.g., under 13 in the US COPPA; under GDPR, member states set 13–16).
- Contact details when combined with identity verification data.
- Key handling requirements:
- Access: Strict RBAC; least privilege; periodic access recertification.
- Encryption: Mandatory at rest and in transit; hardware-backed or FIPS-validated where applicable.
- Masking: Mandatory in non-production; dynamic masking in production for non-administrative users.
- Logging: Full access logging; tamper-evident logs; anomaly monitoring.
- Transfer: Cross-border transfer controls; assess lawful basis and transfer mechanisms (e.g., SCCs under GDPR).
- DPIA: Required where processing is likely high risk (e.g., large-scale tracking, profiling).
- Breach response: Notify per applicable law (e.g., GDPR supervisory authority notification within 72 hours if risk exists; data subject notification when high risk).
- Retention: Strict minimization; time-bound with documented deletion controls.
- Vendor management: Due diligence and security assessments; contractual controls.
Level PD-3 — Personal (Special Category/Restricted)
- Criteria: Highest risk; special categories under GDPR Article 9, criminal offense data (Article 10), or other highly sensitive contexts; significant potential for discrimination or serious harm.
- Examples:
- Special categories: racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data used for unique identification; health data; sex life or sexual orientation.
- Criminal convictions and offenses (treated as restricted even though not part of Article 9).
- Highly sensitive medical records (e.g., diagnostic results, mental health notes).
- Biometric templates used for authentication (face/iris/voice/fingerprint).
- Key handling requirements:
- Access: Explicit data owner approval; segregated environments; break-glass access for emergencies with post-incident review.
- Encryption: Mandatory at rest and in transit; strong key management; separate key domains.
- Isolation: Logical or physical segregation; dedicated datasets; minimize copies.
- Masking/Redaction: Default masked views; disclose fields only when strictly necessary.
- DPIA: Mandatory before new processing; consult privacy/legal.
- Consent/Lawful Basis: Explicit consent or other legally valid basis; document purpose limitation.
- Transfer: Additional safeguards; conduct Transfer Impact Assessments for cross-border flows.
- Audit: Quarterly audits; continuous monitoring; data lineage and traceability.
- Retention: Shortest feasible; strict deletion; prove erasure.
- Incident response: Escalated severity; regulatory and data subject notification per law.
Special Handling Flags (metadata augmentations)
Apply flags to refine controls within PD-2 and PD-3. These do not replace the level; they enhance it.
- ChildrenFlag: Indicates data about minors; enforce age-specific requirements and parental consent where applicable.
- HealthFlag: Indicates regulated health data; align with HIPAA/health laws where relevant.
- PaymentCardFlag: Indicates PCI DSS scope; enforce network segmentation and PCI controls.
- BiometricFlag: Indicates biometric templates or data used for unique identification.
- GeoPreciseFlag: Indicates precise location data.
- CredentialsFlag: Indicates authentication secrets or cryptographic keys.
- CriminalFlag: Indicates criminal convictions/offenses data.
Metadata and Labeling Requirements
- Mandatory fields for each dataset/element:
- DataClass: PD-1, PD-2, or PD-3
- SensitivityFlags: zero or more flags from the list above
- LawfulBasis: consent, contract, legal obligation, legitimate interests, vital interests, public task (as applicable)
- Purpose: specific, documented use case(s)
- DataOwner and DataSteward: accountable roles
- RetentionPeriod and DisposalMethod: defined and approved
- ProcessingLocation(s): regions, hosting environments
- CrossBorder: yes/no and mechanism (e.g., SCCs)
- SourceSystem and Lineage: upstream/downstream systems
- AccessModel: RBAC profiles and approval workflow
Assignment Criteria and Decision Rules
- If any field matches PD-3 characteristics, classify the entire dataset PD-3 unless securely segregated at field level with consistent enforcement.
- If dataset contains PD-2 attributes (e.g., IDs, financial accounts, credentials), classify PD-2 unless PD-3 criteria apply.
- Pseudonymized data inherits the highest sensitivity level of its source attributes.
- Aggregated data remains personal if re-identification risk is reasonable; treat as personal until a formal anonymization assessment confirms PD-0 (non-personal).
- Mixed datasets should use field-level tags plus a dataset-level classification equal to the highest field-level sensitivity present.
Controls Matrix Summary
- PD-1: RBAC, transport encryption, basic masking, documented retention, standard vendor contracts.
- PD-2: Strong encryption at rest and in transit, strict RBAC with recertification, mandatory masking in non-prod, logging and monitoring, DPIA when high risk, stricter retention, vendor due diligence, cross-border safeguards.
- PD-3: Segregation, strong encryption and key management, explicit approvals, default masking/redaction, DPIA mandatory, explicit consent or equivalent lawful basis, enhanced audit, shortest retention, escalated incident response.
Lifecycle Governance
- Collection: Minimize; capture only necessary fields aligned to documented purpose and lawful basis.
- Storage: Segregate by classification; apply encryption and access controls per level.
- Use: Enforce purpose limitation; restrict analytics on PD-3 unless approved by data owner and privacy/legal.
- Sharing: Use data sharing agreements; apply data processing addenda and transfer assessments.
- Retention/Deletion: Enforce time-bound retention; automate deletion; verify and log erasure events.
- Quality: Validate identifiers (format, checksum), deduplicate, maintain accuracy especially for PD-2/PD-3 to reduce harm risk.
- Monitoring: Continuous control testing; periodic audits; track data lineage and access patterns.
Roles and Responsibilities
- Data Owner: Approves classification, access, use cases, retention; accountable for compliance.
- Data Steward: Maintains metadata, data quality, and control adherence.
- Data Custodian: Implements technical controls (encryption, masking, logging).
- Privacy/Legal: Reviews lawful basis, DPIA, cross-border transfers, and consent mechanisms.
- Security: Designs and operates controls; incident response.
- Compliance: Audits adherence; manages findings and remediation.
Implementation Steps
- Discover: Use data scanning and pattern recognition to identify personal and sensitive fields.
- Label: Apply DataClass and SensitivityFlags at field and dataset levels in the catalog.
- Enforce: Bind classification to access policies, encryption, masking, and retention controls.
- Review: Quarterly recertification of PD-2/PD-3 access; annual DPIA refresh for high-risk processing.
- Train: Provide role-based training for handling PD-2 and PD-3.
- Measure: Track incidents, access violations, and retention compliance; report to governance board.
This scheme provides a practical, regulation-aware structure for classifying and governing personal sensitive data, ensuring consistent controls and decision-making across the organization.
