Data Classification Matrix

v1.0.0

Public / internal / confidential / secret matrix — examples, controls, access scope per tier.

Organization name

Classification levels (comma-sep, low→high)

Data types to classify (comma-sep)

Data Classification Matrix

# Data Classification Matrix — ACME Corp

| Data Type | Classification | Controls |
|---|---|---|
| Marketing materials | **Public** | No restrictions, can be published |
| Employee data | **Confidential** | Encryption in transit, role-based access |
| Customer PII | **Restricted** | Encryption at rest+transit, role-based access, audit logging |
| Financial records | **Restricted** | Encryption at rest+transit, role-based access, audit logging |
| Source code | **Public** | No restrictions, can be published |
| API keys | **Restricted** | Encryption at rest+transit, role-based access, audit logging |

## Level Definitions
- **Public**: Available to the public
- **Internal**: Internal use, limited distribution
- **Confidential**: Internal use, limited distribution
- **Restricted**: Highest sensitivity, strict need-to-know

## GDPR / DSGVO Note
Personal data (PII) must always be classified as Restricted and processed under Art. 6 GDPR legal basis.