Automatic data classification is the process of reading every file an organization holds, deciding how sensitive it is, and recording that decision as a level such as Public, Internal, Confidential or Restricted. The decision is made by software from the content of the file, not by asking the author to pick a label. The result is a list of every file, its level and who can open it. That list is what makes the rest of a data security program work: a DLP rule can block a Restricted file from leaving, an access review can start with the most sensitive shares, and an auditor can see evidence instead of a policy document. This guide explains why manual classification fails, how automatic classification works, what a good scheme looks like, and how to roll it out.
Why manual classification does not scale
Most organizations already have a classification policy. It usually says that every document must carry a label, and that the author chooses it. In practice three things happen.
First, most files never get a label. Database exports, scans, attachments saved to a share, and files older than the policy all sit unlabeled. A policy that covers new Word documents does not cover the export that holds the customer list.
Second, labels drift. A file that was Internal when created becomes Confidential after someone pastes a salary table into it. Nobody goes back and changes the label.
Third, authors pick the wrong level. Some over-classify to be safe, which makes the label meaningless. Some under-classify because a Restricted label blocks the share they need.
Training helps with new documents and does nothing for the existing estate, which is where most of the data is.
How automatic data classification works
An automatic classifier does three things for each file: find it, read it, and score it.
Finding the files
The classifier needs to reach everywhere data lives: laptops and desktops, Windows file shares, cloud storage buckets and drives, and databases. Discovery enumerates the locations, lists the files, and keeps the list current as files are added, moved and deleted. A classifier that only looks at one share gives a confident answer about a small part of the problem.
Reading the content
The file name and extension are not enough. A file called notes.txt can hold an API key. A PDF can be a scanned passport. Reading means opening the file with the right parser (Office formats, PDF, archives, plain text) and running optical character recognition on images and scans so the text inside the picture is checked too.
Scoring the content
Once the text is available, the classifier looks for signals. Common signal types are:
- Built-in detectors for well-known formats: payment card numbers, national identifiers, bank account numbers, passport numbers, private keys and credentials. Good detectors check the structure (the checksum on a card number) and look for corroborating words nearby, so a sixteen-digit order number does not count as a card.
- Custom categories by keyword and pattern: project code names, internal product names, a contract template header, a phrase that only appears in board papers.
- Exact-data matching: a fingerprint of a specific set of records, such as the customer table, so the classifier recognizes those exact names and numbers wherever they appear and ignores other names and numbers.
- Document fingerprinting: a fingerprint of a specific document, so copies and near-copies of a known sensitive file are found even after editing.
- Existing labels: a label already written into the file by an Office add-in or another tool.
Each signal maps to a level. The file's level is then derived from the signals it carries.
Choosing a classification scheme
A scheme with too many levels is ignored. A scheme with too few cannot drive different controls. Four levels cover most organizations.
| Level | What it means | Typical content | Typical control |
|---|---|---|---|
| Public | Can be published | Marketing material, press releases | None |
| Internal | For staff only | Procedures, meeting notes, most email | Warn on external send |
| Confidential | Harm if disclosed | Customer data, contracts, financials | Justification required, logged |
| Restricted | Serious harm if disclosed | Credentials, payment data, health records, M&A | Block, limited access |
Two rules make the scheme usable.
The strictest signal wins. If a file contains one payment card number in a thousand pages of marketing copy, it is Restricted. Averaging signals produces a file that is "mostly Public", which does not answer the question "can this leave the building".
Only a human lowers a level. The classifier may raise a level whenever it sees a new signal. It should never lower one on its own, because a missing signal on a rescan can mean a parser failed, not that the data is gone. Lowering is an admin review, with a reason and a record of who approved it, and the review should expire if the file changes afterwards.
NIST FIPS 199 uses the same idea, taking the highest impact across the data a system holds: https://csrc.nist.gov/pubs/fips/199/final
What good looks like
An organization with working classification can answer these questions from a console, without a project:
- How many files hold payment card data, and where are they?
- Which shares hold Restricted data that is readable by every domain user?
- Who owns the share with the most Confidential files, and when did they last review access?
- Which Confidential files left the organization last month, through which channel, and was it allowed?
- Which files that were Restricted last quarter are now clean, and which ones came back?
The last question matters. Classification is not a one-time scan. Files get cleaned up, then someone restores a backup or re-exports the report. A good system reconciles each file on every pass: still sensitive, cleaned, gone, or back.
Good also means the level is visible where people work: a banner in the document footer, a label in the Office ribbon, a suggested label on an outgoing email. Classification is the first half of what DSPM delivers, and the input that DLP policies need to decide anything.
Where classification goes wrong
Too many false positives
If every tenth file is flagged as Restricted because a detector matches phone numbers, the team stops trusting the levels and the DLP rules built on them get turned off. The fixes are corroboration (a card number near the word "card" or "expiry"), minimum match counts (one identifier is noise, fifty is a list) and exact-data matching against your own records. Tune on a sample before scanning the estate.
Scanning only the new files
Scanning the newest files is fast and gives a number for the dashboard. It leaves the oldest, least-watched shares unclassified, and those are where the exports and backups live. Cover the whole estate and show a coverage figure, so "not scanned" is never confused with "clean".
Ignoring access
A Restricted file readable only by its author is a different risk from the same file on a share open to everyone. Rank by level and by who can actually open the file, resolved through group memberships, not just the ACL as written.
No owner
A finding with no owner is a finding nobody fixes. Every share and bucket needs a named data owner who sees the findings for their data and approves access to it.
Treating labels as the control
A label is information. The control is what happens because of it: the upload that is blocked, the email that asks for a reason, the access that is removed. If nothing reads the labels, the project produced metadata and no security.
Rollout checklist
- Write down the levels, with one sentence and two examples each.
- List every location data lives: endpoints, file shares, cloud buckets and drives, databases.
- Decide the signals per level: built-in detectors, custom keywords and patterns, record sets to fingerprint.
- Build the exact-data fingerprint from the systems of record, not from exports.
- Pilot on one share and one department. Review the top hundred findings by hand and tune corroboration and minimum match counts.
- Scan the whole estate and publish a coverage figure.
- Assign a data owner to every share and bucket.
- Rank findings by level and real access. Start where Restricted meets "everyone".
- Turn on the controls that read the level: justification on Confidential, block on Restricted, per channel.
- Switch on visible marking: banners in Office documents, label suggestions in email.
- Set an expiry on admin downgrades and reconcile every file on each scan pass.
- Report monthly: coverage, counts per level, open findings by owner, files that regressed.
How Tracemark does it
Tracemark's Data Security Posture product classifies the estate from the same agent and console that deliver the rest of the platform.
Discovery covers files on laptops, file shares, cloud storage (S3, Azure, Google Cloud Storage, Box, Dropbox, Google Drive) and databases (MySQL and SQL Server). Every file found gets a classification level.
Levels come from content, not file names. Tracemark reads what is actually in the file, using dozens of built-in detectors, custom categories by keyword and pattern, exact-data fingerprinting of your own records, document fingerprinting, and OCR of text inside images. The strictest signal wins. Only an admin review can lower a level.
The Documents list shows every file, its level and who can open it. Risk is ranked by who can actually access the data, not just by level. Each share has a data owner.
The level is made visible. Classification banners are written into Office documents on save. Labeling add-ins for Word, Excel, PowerPoint and Outlook show a suggested label from the content, as described in classification labels in Word, Excel, PowerPoint and Outlook.
The same agent enforces DLP on every way out: clipboard, USB and file copy, print, uploads, email and AI prompts. Per channel it can warn, ask for a reason, or block, and every decision is kept as evidence in the Incidents queue with who, what, channel, policy and outcome.
Frequently asked questions
What is the difference between data classification and data discovery?
Discovery finds where the files are. Classification decides how sensitive each one is. Discovery alone is a file count; classification alone only covers the files you already knew about.
How many classification levels should we use?
Four is enough for most organizations: Public, Internal, Confidential, Restricted. Each level should map to a different control. If two levels are treated the same way by every rule, merge them.
Can automatic classification replace user labeling?
It replaces labeling as the source of truth for the level, because it covers the whole estate including old and exported files. User labeling remains useful as a visible reminder and one more signal, and a suggested label from the content makes the choice consistent.
How do we avoid false positives?
Require corroboration near a match, set a minimum number of matches before a file is flagged, prefer exact-data fingerprints of your own records over generic patterns, and review a sample of findings by hand before scanning the whole estate.
Try it
Try Tracemark free for three months. Claim it at tracemark.ca