Data Classification Record

Data Classification Records (DCRs) are created either automatically by the system when automatic configuration mode has been selected, or manually when you classify data in a data policy. Each record represents a single attribute in a domain model entity. When classifying data the following options are available:

Attribute Details

This card gives an overview of the attribute you are classifying:

• Domain Name. The name of the domain model that this attribute belongs to.

• Entity Name. The name of the entity that this attribute belongs to.

• Attribute Name. The name of the attribute that you are classifying.

• Classified by. Who created this DCR. Either 'SYSTEM' or 'USER'. Note: If you change the classification settings of a DCR created by the system this value will automatically change to 'USER'.

Personal Data

This card is used to indicate if this attribute contains personal data, and if so what kind.

• Is personal data. If checked, this attribute contains personal data.

• Personal data type. The type of personal data this attribute contains. Note: These types are aligned with EU GDPR personal data meanings.

  • Not personal data. This value is only selected if this attribute does not contain personal data.

  • Indirect Identifier. This data indirectly identifies someone (E.g. date of birth, postal code, gender).

  • Direct Identifier. This data directly identifies someone (E.g. First / last name, social security number, phone number).

  • Special Category. This data contains sensitive personal data (E.g. religion, race, sexual orientation).

• Personal data classification reasoning. The reasoning behind the classification that you have selected.

Data Sensitivity

This card is used to indicate the sensitivity of the data that the attribute that you are classifying contains. Note: If you have selected personal data, the classification level will automatically be set to minimum LEVEL 3.

• Data classification level. The sensitivity of the data stored by this attribute. Although these levels do not have direct legal or standardized meaning, these levels reflect common data security best practices:

  • Level 1 (Public) – Information that can be freely shared with no risk if disclosed (e.g., marketing materials, published documentation).

  • Level 2 (Internal) – Non-sensitive business information not intended for external release, but low risk if it were leaked (e.g., internal process documents, general employee directories).

  • Level 3 (Confidential) – Information that could cause harm to the business or individuals if disclosed without authorization (e.g., contracts, financial reports, indirect identifiers like postal codes or job titles).

  • Level 4 (Restricted) – The most sensitive data, where unauthorized disclosure could cause significant legal, financial, or reputational damage, or harm to an individual (e.g., direct identifiers such as national ID numbers, and special category data such as health or biometric data).

• Data classification reasoning. The reasoning behind the data classification level that you selected for this attribute.

Automatic Data Classification

If you are using automatic data classification the system uses AI to attempt to classify your data for you. Note the following about how this feature works:

• Data Classification Level. The data classification level selected by the system will NEVER be lower than LEVEL 2. This is to ensure that data is never accidentally classified as PUBLIC.

• Personal Data. If an attribute is flagged as personal data by the system, it's data classification level will never be set to less than LEVEL 3 (Confidential). This is to ensure that access to personal data by user roles will always raise an alert so that you can validate it.