What is the primary purpose of classifying data into categories?

• A. To support access controls, risk management, and data handling policies
• B. To increase the size of the data inventory
• C. To reduce the need for metadata management
• D. To anonymize data automatically without policy

Answer: (A)

Classifying data into categories provides a framework to apply governance and protection based on how sensitive or critical the data is. When data is categorized, you can implement access controls that restrict who can view or modify it, guide risk management by prioritizing protection for the most sensitive data, and enforce data handling policies that dictate how data should be processed, stored, transmitted, and retained. This categorization also drives metadata tagging and policy enforcement across the data lifecycle, helping with regulatory compliance and incident response.

The other options don’t fit the main purpose: simply increasing the size of the data inventory isn’t about governance or protection; classification supports controls, not inventory growth. Reducing the need for metadata management isn’t accurate—classification relies on metadata to label categories and enforce policies. Automatic anonymization without policy isn’t the aim—classification informs when and how de-identification should occur, but policy and tooling are needed to perform anonymization.