Data Classification Guide
About this resource
What Not to Put Into AI gives your staff the rule in one page. This is the exercise that produces the rule: a landscape worksheet for mapping your organization’s own data categories against permission levels and naming who decides for each one.
Generic data rules fail because every organization holds different things and calls them different names. The worksheet walks a group through listing their actual categories, assigning each a permission level, naming the approval authority where one is required, and recording the reasoning so the classification survives the person who made it. The output is a mapping specific enough to be enforceable, which a borrowed rule never is.
A generic data rule fails because your organization does not call its information what the template calls it. The mapping has to use your own category names.
How to use it
Complete it before you publish a data rule, not after. Do it with someone who actually handles the information rather than only with policy owners, because the categories that cause incidents are the ones leadership does not know exist. The output feeds directly into the one-page rule your staff will carry, which is where it becomes useful.
Inside the download
Your own names for your own information, not a template’s.
Never, approved tools only, or generally fine, category by category.
Who decides when a category needs a decision, by role.
Why each classification was made, so it can be revisited rather than re-argued.
Common questions
List your organization’s actual information categories in the language your staff uses, assign each one a permission level, name who approves the cases requiring a decision, and record why each classification was made. Borrowed classifications fail because they describe somebody else’s information.
The classification belongs to whoever owns the data domain, with security and compliance confirming rather than deciding. Approval authority for edge cases should be named by role and reachable quickly, since an approver who takes a week is functionally a prohibition.
That is the most valuable output of the exercise. Edge cases are where incidents originate, and surfacing them on a worksheet means deciding deliberately rather than leaving each employee to decide alone under time pressure.
Free. No email list, no follow-up sequence.
More from the resource library, chosen because they pair well with this one.
A one-page data rule for everyone who uses these tools. Print it and put it where people can see it.
The security questions to put to a vendor before connecting anything to your systems.
Eighteen places to start when you serve people whose privacy you are responsible for, and four places not to.
Tell us a little about yourself and this document is yours. We don't have an email list. We collect this so we know who's finding our resources useful, and that's it.
You're downloading
this document
Your information is kept confidential and never shared with anyone.
