Understanding What Each Classification Covers

A classification is a named group of rules that together detect one kind of sensitive data. Knowing what sits inside a classification tells you what a violation against it actually means.

The Sensitive Data Exposure tab groups violations by classification rather than by individual rule, so that you can see the shape of your exposure without reading every event. A classification usually corresponds to a regulation, a data type, or a business category.

Classifications fall into a few broad kinds:

• Regulatory — rules that detect data covered by a specific law or standard, such as an information technology act or a health information regulation. A violation here may carry a reporting obligation.
• Personal information — rules that detect data identifying an individual, such as names paired with identifiers, addresses, or dates of birth.
• Financial — rules that detect payment and account data, such as credit card numbers or bank details.
• Business — rules that detect information your organization has defined as confidential, such as source code, contracts, or internal documents.

Two classifications can both flag the same piece of content. A credit card number sent alongside a customer name may count against a financial classification and a personal information classification at once, so classification counts can add up to more than the total violation count.