Data classification

Label what matters, then write the rule beside the label.

Data classification sorts information by the harm its misuse could cause, so the right people can reach it and nobody else can. Here are four example levels, the handling rules that make them work, what Microsoft Purview labels do and do not do, and a tool to classify a record.

Sourced from the OAIC, Microsoft and CSIRO, checked 31 October 2026.

Plan a classification pilot Classify a record 07 3114 2808

Four example levels
Handling rules
Classify a record

Reviewed by Blake Bath, General Manager, on 31 October 2026.

A practice manager sorts paper patient files into coloured folders at an open filing cabinet in a small back office. — **A label is not a lock**A sensitivity label can encrypt, but only if it is set up to. Check the policy, not the name.

What we find

Four reasons classification schemes fail.

Each one leaves the label on the file and the risk where it was.

Too many unexplained levels

Keep the scheme small enough for staff to choose a level using a real example.

Few levels
Real examples
Staff tested

Record classifier

Classify one of your records.

Pick one type of record and answer four questions. You get a suggested level and the handling rule to write beside it.

Think of one type of record, such as payroll, client files or a price list. Four questions give you a level and the handling rule to write beside it.

Is it meant to be public?

Does it contain personal information?

If it leaked or was changed, what would happen?

Is it shared outside the business?

Suggested level

Confidential

Where it lives: A site limited to named roles
Sharing: Approved recipients only, using links that expire
Also: Consider a sensitivity label with encryption for this workflow.
It holds personal information, so APP 11 applies if you are covered by the Privacy Act. Keep only what you need and dispose of it when no longer needed.
Because it goes outside the business, decide the secure delivery method and test it with a real recipient.
Set retention by record type, law and contract, not by the label.

These four levels are an example business scheme, not a government classification.

Plan a pilot

Four levels

Four example levels, not a mandatory standard.

Use names that staff can explain and test them against real work. These four levels are an illustrative business scheme, not an Australian Government classification or a guaranteed mapping to the Industry Data Classification Framework.

PublicExample: an approved brochure. Publish the approved version, but still protect editing rights, integrity and any unpublished drafts.
InternalExample: a routine team procedure. Limit it to the relevant staff; do not assume every internal record belongs in an all-staff folder.
ConfidentialExample: a client contract or payroll report. Give named roles access, control external sharing and consider encryption for the workflow.
RestrictedExample: sensitive health records or commercially critical designs. Require an accountable owner, tightly scoped access and review of any proposed disclosure.

Make it work

Write the handling rule beside the label.

Storage and accessName the approved repository and the roles that need the information. Check existing permissions before assuming a label fixes them.
Email and external sharingSpecify approved recipients, the approval owner, secure delivery and link expiry where supported. Test a genuine external-recipient workflow.
Download and printSet restrictions where the application and protection method support them. Screenshots and copies outside the controlled workflow still need staff rules.
RetentionSet periods by record type, business need, law and contract. A sensitivity level does not automatically mean a seven-year retention period.
DisposalSpecify how records and copies are destroyed or de-identified when no longer needed, subject to legal holds and other retention requirements.
Ownership and exceptionsName who approves a change, reviews access and handles an exception. Train staff with an example from their own work.

Labels and controls

Microsoft Purview labels are one part of the control.

Microsoft documents that sensitivity labels can identify content and, when configured, apply protection such as encryption and markings. A label can also be applied without protection settings. Check the actual policy, supported application and user licence rather than treating the label name as proof of encryption.

Features such as automatic labelling, endpoint controls and Teams DLP have separate licensing and support conditions. There is no blanket promise that every Microsoft 365 plan includes every Purview capability.

Control	What it does	What to verify
Sensitivity label	Identifies sensitivity and can apply configured protection.	Published policy, encryption settings, application support and licences.
Permissions	Determines who can reach a site, folder or record.	Named roles, guest access and inherited permissions.
DLP policy	Detects relevant content and can warn or restrict configured activities.	Covered locations, rule behaviour, exceptions and licensing.
Retention rule	Controls record retention or deletion under a configured policy.	Legal requirements, record type, holds and service support.

Australian context

Where the Privacy Act and the IDCF fit.

APP 11 requires covered entities to take reasonable technical and organisational steps to protect personal information. Classification can support that work, but a classification policy does not prove Privacy Act compliance. It is not an extra strategy in the Essential Eight or a substitute for implementing its controls.

CSIRO and the Department of Home Affairs announced the voluntary Industry Data Classification Framework on 2 September 2026. It provides a shared approach to understanding data value and risk, rather than requiring every business to use the four example labels in this guide.

Use the framework when you need a more detailed assessment or a shared language with another organisation. Do not rename local labels as official data security levels without doing that assessment.

Our view

Start with one data set and its owner.

Classifying everything at once rarely works. We start with the records that would hurt most if exposed, usually payroll, client files and contracts, fix who can reach them, and only then add labels and data loss prevention.

Pilot the rules with the people who do the work. If a rule blocks a legitimate task, staff will find a way around it, and that way is usually less secure.

The order

Rolling out classification in four steps.

Step 1Discuss the information in the first call
We review the repositories, work patterns and current licences.
Step 2Agree the rules and responsibilities
We turn the chosen levels into practical access, sharing and disposal rules.
Step 3Test a representative pilot
We configure the agreed labels and available controls, using simulation or audit options where supported.
Step 4Review a month into the pilot
We review rule matches, incorrect blocks and adoption.

Related guides

Classification is the map. These are the controls.

Data loss prevention, Microsoft 365 and the frameworks behind them.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about data classification.

How many data classification levels do we need?

There is no single required number for every business. Start with a small scheme staff can apply to real records. The four levels here are examples; your contracts or regulatory setting may call for different names or detail.

Does a sensitivity label encrypt every file?

No. Microsoft labels can be applied without protection settings. Encryption depends on the label configuration, supported file and application, and the relevant licences.

Is automatic labelling included in every Microsoft 365 plan?

No. Licensing differs between manual labelling, automatic labelling, DLP locations and other controls. Check Microsoft's current service description for the features and users in your rollout.

Does classification make us Privacy Act or Essential Eight compliant?

No. Classification supports decisions about protection, but compliance depends on the applicable duties and implemented controls. It is not a separate Essential Eight strategy or a certification.

How long should we retain confidential information?

Retention depends on the record, its purpose, law and contract, not the sensitivity label alone. Agree a recordkeeping schedule and account for legal holds before configuring deletion.

How does this relate to the Industry Data Classification Framework?

The IDCF is a voluntary Australian framework announced in September 2026 for assessing data value and risk. The example business labels in this guide are not an automatic mapping to its data security levels.

Next step

Start with one data set and its owner.

Tell us which records need tighter handling and where they live. We can scope a pilot against your current licences and work patterns before recommending wider controls.

Discuss a classification pilot 07 3114 2808