What is Data classification?
Data classification answers the question that comes before any tool question: how sensitive is the thing I am about to paste. Three tiers are enough for a small team. Open is everything already published or destined to be. Internal is everything that should not leave the building but concerns no individuals. Confidential is everything involving personal data or someone else's confidentiality, so client records, applications, contracts, health data.
The value only appears once the tiers are coupled to tools. A tier without a list of permitted tools is paper. In concrete terms: for the confidential tier, only tools covered by a data processing agreement qualify, and that is never a personal account on a free plan. Article 28(3) of the General Data Protection Regulation requires a contract for processing on your behalf, setting out subject matter, duration, nature and purpose of the processing and the type of data. The line between permitted and not permitted therefore does not run between providers, it runs between plans.
Two mistakes make a classification worthless. The first is too many tiers: from the fifth category onwards nobody sorts any more, they guess. The second is the missing date. Providers change their defaults, models get swapped, subprocessors are added. A mapping table without a review date and without an accountable person describes a state of the world that stopped being true a quarter ago.
Why does Data classification matter?
According to the Berlin Business Panel 2025, presented in July 2026, only 26 per cent of businesses that use AI have any guideline, written instruction or works agreement for it. Without such a mapping, every person decides for themselves in the moment of haste what may go into someone else's system, and that decision routinely favours the faster tool.
Data classification in practice
- 01Blog draft, tier open: the text is meant for publication anyway, so it may go into any approved tool, including a fast one without a special contract.
- 02Pricing calculation, tier internal: no personal data, but nothing for outsiders either. Only tools on the company's business plan qualify, never a personal account.
- 03Job application, tier confidential: personal and someone else's. Only tools with a data processing agreement and a list of subprocessors qualify, and even then the question remains whether the summary is worth the exposure.
