Data classification

A statutory model proposed in the draft that categorises data into tiers (e.g., public, private, internal, confidential, restricted) to prescribe differentiated security, processing and cross-border transfer conditions. Classification drives obligations such as localisation or tiered transfer safeguards and informs DPIA and registration requirements for higher-risk classes.

A data management regime that categorizes datasets and information according to sensitivity and handling requirements (e.g., public, internal, sensitive, classified), to determine appropriate protections, access controls, retention, and permitted GenAI uses. Classification drives controls such as prohibitions on using classified data and specific protections for personal or sensitive information.