Four in ten UK businesses (43%) and three in ten charities (30%) reported a cyber security breach or attack in the last 12 months, according to the UK government's Cyber security breaches survey 2025. That is a UK survey, but the point applies elsewhere. Most staff cannot protect information they cannot name, and the question "is this spreadsheet Internal or Confidential?" comes up long before anyone is attacked.
This post gives you the 4 data classification levels most organisations use: Public, Internal, Confidential and Restricted. Each has 5 examples and a handling rule. Then it shows how they relate to two formal schemes, so you know what is a convention and what is a standard.
What data classification is
Data classification is a label that tells people how to handle a piece of information. The label sits on a document, a file or a data set, and it points to a rule: who may see it, how it may be sent and how it is stored.
No single list of levels is required of every organisation. The 4 below are a common way to set up a policy, not a standard defined by NIST or by any government. Your own policy may use 3 levels, 5 levels or different names, and the data owner decides which label fits. The examples are generic, so swap in your own documents when you teach them.
Round 1: Public (5 examples)
Public information is meant to be seen by anyone. Sharing it outside the organisation causes no harm.
Handling rule: no restriction on sharing, but only the owner publishes it, and it stays accurate.
- A published press release.
- A job advert.
- A product brochure.
- A public blog post.
- Published prices on the website.
Our pick: the job advert. People often treat it as sensitive because it came from HR. It was written to be read by strangers, so it is Public.
Round 2: Internal (5 examples)
Internal information is for people who work for the organisation. It is not secret, but it is not for outsiders.
Handling rule: employees only, kept inside company systems and not shared outside without the owner's say-so.
- The staff directory.
- An internal newsletter.
- Meeting notes.
- A policy document.
- A project plan.
Our pick: meeting notes. They look harmless, yet they often name customers, prices or people. Check what is in them before you forward them to a supplier.
Round 3: Confidential (5 examples)
Confidential information would cause real damage if it reached the wrong people, such as lost customers, legal exposure or a weaker position in a negotiation.
Handling rule: need to know only, encrypted when sent, and shared through approved tools, not personal email.
- A customer list.
- A signed contract.
- A financial forecast.
- A performance review.
- Supplier pricing.
Our pick: the customer list. It is easy to export and easy to paste into an email. One slip hands a competitor your whole book of business.
Round 4: Restricted (5 examples)
Restricted is the tightest tier. A leak could cause serious harm to the organisation or to individuals, so access is limited to named people.
Handling rule: named people only, the strongest controls, and access that is logged.
- Passwords and keys.
- Payment card data.
- Health records.
- Unreleased financial results.
- Security incident details.
Our pick: credentials in a shared document. Most people recognise this mistake from their own team. A password on a shared sheet is Restricted data stored as if it were Internal.
How the levels map to formal schemes
The 4 tiers are a convention, so none of the formal schemes matches them one for one. The table shows the closest fit. Treat the mapping as approximate.
| Common 4 levels | NIST FIPS 199 (US federal systems) | UK Government Security Classifications |
|---|---|---|
| Public | Confidentiality not applicable, roughly | Not covered, since the UK scheme classifies government information |
| Internal | Low impact, roughly | OFFICIAL, roughly |
| Confidential | Moderate impact, roughly | OFFICIAL with the -SENSITIVE marking, roughly |
| Restricted | High impact, roughly | SECRET and TOP SECRET, roughly |
FIPS 199 does not define four levels. It defines three levels of potential impact (low, moderate and high) for federal information and information systems, based on how much harm a loss of confidentiality, integrity or availability would cause (NIST FIPS 199). A limited adverse effect is low, a serious one is moderate, and a severe or catastrophic one is high.
The UK Government Security Classifications Policy uses three tiers: OFFICIAL, SECRET and TOP SECRET. The GOV.UK page was last updated on 5 August 2024. OFFICIAL covers most government information, and "-SENSITIVE" is an additional marking on OFFICIAL information whose compromise could cause more damage. The policy says it is not a statutory scheme (GOV.UK: Government Security Classifications).
The US National Archives also keeps a registry of Controlled Unclassified Information (CUI). It is a list of categories grouped by subject, such as critical infrastructure, defence and financial, not a ladder of levels (NARA CUI registry). If your organisation handles US government information, read your contract for which categories apply.
Labelling and handling
A label only helps if people apply it the same way. Four habits keep it consistent.
- Label at creation. The author knows best what is in the file, so ask them to mark it when they save it.
- When unsure, use the higher level. Treating a file as Confidential costs a little time. Treating Confidential data as Internal can cost a customer.
- Never downgrade without the owner. Only the data owner, following the policy, can lower a label.
- Reclassify when sensitivity changes. A forecast is Confidential before results are published and may be Public afterwards.
These habits matter because breaches are common. The survey above found 43% of UK businesses reporting one in the past year, and a file with no label is a file nobody knew to protect. For the human side of attacks, see our post on social engineering examples.
Ways to host a classification quiz with AhaSlides
You can teach the 4 levels in one 20-minute session. The room answers, so the rules stick better than they do from a policy PDF. Build each slide from the examples above.
- Pick Answer: "Which level is this document?" Show an example from each round, add a leaderboard, and award the points for the correct level.
- Word Cloud: "What is the most sensitive thing you handle?" The answers show which of your teams work with Confidential or Restricted data every day.
- Rating Scale: "How confident are you labelling a file?" Rate from 1 to 5, then follow up with the people who score low.
- Open Ended, anonymous: "What question would you like to ask the security team?" People will ask things they would not say out loud.
Looking for more ways to run it? See cybersecurity awareness training, IT security and phishing pulse checks in Slack and AI documentation and privacy training. The Data classification & handling course template gives you the slides ready to adapt.
Frequently asked questions
What are the 4 levels of data classification?
Public, Internal, Confidential and Restricted is the most common scheme, though each organisation sets its own. Public can be shared with anyone, Internal stays inside the organisation, Confidential is need to know, and Restricted is for named people only.
Is there a standard set of data classification levels?
No, there is not one set. FIPS 199 defines three impact levels (low, moderate and high) for US federal systems, and the UK government uses its own three classifications, OFFICIAL, SECRET and TOP SECRET. Private organisations choose their own, and 4 tiers is a common pattern.
What are examples of confidential data?
Customer lists, contracts, financial forecasts and performance reviews. Supplier pricing belongs here too. All of them would cause real damage if they reached the wrong people, so they are shared on a need-to-know basis.
What is the difference between confidential and restricted data?
Restricted is the tightest tier, limited to named people with the strongest controls. Confidential data is shared with anyone who needs it for their job. Restricted data, such as passwords or payment card data, is available to far fewer people and its access is logged.
Who decides how data is classified?
The data owner, following the organisation's policy. The author usually applies the label first, and the owner confirms it or changes it. Staff should not downgrade a label themselves.
Where to start
Pick one team, label its 10 most common files with the 4 levels, and run the quiz to see where people disagree. Those disagreements show you which examples your policy needs.
