A data classification policy is a formal document outlining the structure for classifying data in an organization. It generally provides for the following:  Classification levels: This defines categories which would be something like public, internal, confidential, and restricted.  Responsibilities: Specify who is responsible for classifying data—this may be the data creators, the subject matter experts, or the data stewards.  Procedures: Details how often and how the data should be classified and what type of data needs classification; methods of classification.   Compliance requirements: It confirms that data classification abides by all regulatory and industry standards, such as GDPR and PCI DSS.   Security measures: Ensure that for each level of classification, a proper sensitive information security protocol is in place.