Which term describes the overall approach of classifying and protecting data based on its sensitivity and regulatory requirements?

• A. Data classification
• B. Data governance
• C. Data lineage
• D. Data anonymization

Answer: (A)

Classifying data by its sensitivity and regulatory requirements is the practice of labeling data into levels (like public, internal, confidential, restricted) and applying appropriate protection based on those levels. This approach determines who can access the data, what controls to enforce (such as encryption or masking), how long to retain it, and how it should be shared or disposed of, all in line with legal and regulatory obligations. Data classification provides the actionable framework that translates policy into concrete security and compliance controls.

Data governance, by contrast, is the broader management framework that sets policies, roles, standards, and accountability for data across an organization. Data lineage focuses on tracing where data comes from and how it moves and transforms over time. Data anonymization refers to techniques that remove or mask identifying information to reduce privacy risks, not the overall process of organizing data protection by sensitivity.