Level of information classification

Considering ISO 27001 requirements and controls, to define the proper classification level for your information, you have to consider:

• the results of risk assessment
• legal requirements (e.g., laws, regulations, and contracts) applicable to your organization

For example, Article 9 of EU GDPR defines special categories of personal data https://advisera.com/eugdpracademy/gdpr/processing-of-special-categories-of-personal-data/ which you should classify with a higher confidentiality level, while the rest of the personal data you can classify with lower confidentiality level.

 This article will provide you a further explanation about information classification:

• Information classification according to ISO 27001 https://advisera.com/27001academy/blog/2014/05/12/information-classification-according-to-iso-27001/