"Setting data classification policy if very important, because if you don't have a policy in place, you won't know what your level of sensitivity is, which means you have no baseline or security controls to protect your data. This is an important topic to me, and I take it very seriously. My involvement goes deeper into data classification than any other team member, so I typically take the lead for data classification in three main levels. Restricted Data, Private Data, and Public Data classification. Here's how I classify these three into workable tasks.

1.Restricted Data - I apply the highest level of security to a restricted classification, because it has the highest level of risk.
2.Private Data - This one is a moderate risk level, but should still be treated as private data and protected nonetheless.
3.Public Data - Normally this level is low or no risk. While there are still controls in place, some level of control is still required."