Data Classification Policy

Data artifactGovernance & ComplianceSafety, Security & Governancearc:DataClassificationPolicy

A policy defining data sensitivity levels (public, internal, confidential, restricted) and, for each, the required encryption, access-control granularity and retention.

Responsibility. Scales protection requirements to data sensitivity.

Also known as: Data sensitivity levels

Direct neighbourhood (hover for relationship types)

Relationships

configures structural

Design guidance

SHOULD require encryption with key rotation and least-privilege access for restricted data such as PII, health and financial records.
SHOULD serve as a decision-boundary dimension, distinguishing classifications an agent may process from restricted classifications that are hard-blocked or require escalation.

Classification

Patterns: Risk-proportionate security
Quality attributes: Security (ISO/IEC 25010 | NIST AI RMF: secure and resilient)
Frameworks & regulations: GDPR Art. 32

Sources

Ch9.7: T. Nguyen, "GDPR and Data Protection Regulations," in Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam, 1st ed. 2026, ch. 9.7. ISBN: 9798244538229.
Ch10.5: T. Nguyen, "Human-over-the-Loop," in Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam, 1st ed. 2026, ch. 10.5. ISBN: 9798244538229.
Ref9.05: "Privacy and Data Protection for AI Systems," unpublished reference note (references/Chapter 9 - Safety, Ethics, and Compliance/05-Privacy-Data-Protection.md), Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam supplementary materials, 2026. unpublished note