Data Classification Labels and Tagging System

Overview

Data classification labels are the operational mechanism through which classification policy is enforced across the enterprise. Labels attach classification metadata to data assets — documents, emails, database records, and cloud resources — enabling automated enforcement of handling requirements through DLP policies, access controls, and encryption. This skill covers the design and implementation of a labelling system using Microsoft Purview Information Protection as the primary platform, with architecture patterns for automated labelling, user-applied labelling, label inheritance, and cross-platform propagation.

Label Taxonomy

Vanguard Financial Services Label Hierarchy

Vanguard Classification Labels
├── Public
│   └── (no sub-labels)
├── Internal
│   └── Internal - Project Confidential
├── Confidential
│   ├── Confidential - Customer Data
│   ├── Confidential - Employee Data
│   ├── Confidential - Financial Data
│   └── Confidential - Legal
└── Restricted
    ├── Restricted - Special Category (Art. 9)
    ├── Restricted - Criminal Data (Art. 10)
    ├── Restricted - AML Investigation
    └── Restricted - Board & Strategy

Label Properties

Label	Colour	Visual Marking	Encryption	DLP Policy	Auto-Apply
Public	Green	Footer: "Vanguard Financial Services — Public"	None	None	No
Internal	Blue	Footer: "Vanguard Financial Services — Internal Use Only"	Optional	Warn on external	No
Confidential	Amber	Header + Footer: "CONFIDENTIAL"	Azure RMS (AES-256)	Warn + audit external; block personal email	Yes (when PII detected with >85% confidence)
Restricted	Red	Header + Footer: "RESTRICTED" with red background; watermark on print	Azure RMS (AES-256, double key encryption)	Block all external; block USB/print; alert DPO	Yes (when Art. 9/Art. 10 data detected with >85% confidence)

Microsoft Purview Implementation Architecture

Component Architecture

┌─────────────────────────────────────────────────────────────────┐
│                    Microsoft Purview                             │
│                                                                  │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────────────┐  │
│  │ Sensitivity   │  │ Auto-labelling│  │ DLP Policies          │  │
│  │ Labels        │  │ Policies      │  │ (endpoint, email,     │  │
│  │ (definitions) │  │ (rules)       │  │  SharePoint, Teams)   │  │
│  └──────┬───────┘  └──────┬───────┘  └──────────┬───────────┘  │
│         │                  │                      │              │
│         ▼                  ▼                      ▼              │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │              Unified Label Application Engine             │   │
│  └──────────────────────────────────────────────────────────┘   │
│         │                  │                      │              │
└─────────┼──────────────────┼──────────────────────┼──────────────┘
          ▼                  ▼                      ▼
   ┌─────────────┐  ┌──────────────┐  ┌──────────────────────┐
   │ Office Apps  │  │ SharePoint/  │  │ Endpoint DLP         │
   │ (Word, Excel,│  │ OneDrive     │  │ (Windows devices)    │
   │  Outlook)    │  │              │  │                      │
   └─────────────┘  └──────────────┘  └──────────────────────┘

Auto-Labelling Configuration

Policy 1: Confidential — Customer PII Detection

Setting	Value
Policy Name	VFS-AutoLabel-Confidential-CustomerPII
Scope	All SharePoint sites, OneDrive accounts, Exchange mailboxes
Conditions	Content contains ANY of: UK National Insurance Number (HIGH confidence), IBAN (HIGH), Vanguard Account Number (HIGH), Credit Card (HIGH + Luhn validated)
Minimum count	1 instance of any SIT at HIGH confidence
Label applied	Confidential - Customer Data
Priority	2 (overridden by Restricted auto-label)

Policy 2: Restricted — Special Category Detection

Setting	Value
Policy Name	VFS-AutoLabel-Restricted-SpecialCategory
Scope	All SharePoint sites, OneDrive accounts, Exchange mailboxes
Conditions	Content contains ANY of: ICD-10 codes (MEDIUM+), health terminology trainable classifier (HIGH), biometric template format detection, genetic marker patterns
Minimum count	1 instance at MEDIUM confidence or above
Label applied	Restricted - Special Category (Art. 9)
Priority	1 (highest priority — overrides all other auto-labels)

Policy 3: Restricted — Criminal Data Detection

Setting	Value
Policy Name	VFS-AutoLabel-Restricted-CriminalData
Scope	HR SharePoint sites, Compliance SharePoint sites
Conditions	Content contains: DBS reference patterns, criminal conviction terminology, SAR reference numbers
Label applied	Restricted - Criminal Data (Art. 10)
Priority	1

Label Inheritance Rules

Rule	Description	Implementation
Container inheritance	Items in a labelled SharePoint site inherit the site's label as minimum	Site sensitivity label propagates to new items; existing items retain higher label
Email attachment inheritance	Attachments inherit the email's label if attachment label is lower	Outlook plugin checks attachment label vs email label on send
Parent-child inheritance	Child documents inherit parent folder label as minimum	SharePoint library policy; items cannot be labelled below folder label
No downgrade without approval	Users cannot remove or downgrade labels without justification	Label policy: require justification text for downgrade; audit log entry
Highest label wins	When documents are merged or combined, the highest label applies	User training + DLP monitoring for combined documents

User-Applied Labelling

Labelling Responsibilities

Scenario	Who Labels	How
New document creation	Author	Select label from Office ribbon (Word, Excel, PowerPoint)
New email composition	Sender	Select label from Outlook toolbar; mandatory before sending external
File upload to SharePoint	Uploader	Label prompt on upload if no label detected
Data export from system	Exporter	Label selection required before export completes
Physical document printing	Printer	Classification header/footer printed automatically; user selects tier if not auto-labelled

Mandatory Labelling Policy

Setting	Value
Require label on documents	Yes — all Word, Excel, PowerPoint documents must have a label before save
Require label on emails	Yes — for emails to external recipients; recommended for internal
Default label	Internal (applied if user does not select; user can override up or down)
Justification for downgrade	Required — user must enter text justification; logged in audit
Justification for removal	Required — DPO-approved exception only

DLP Integration

DLP Policy Matrix

Label	External Email	USB/Removable	Print	Screenshot	Cloud Upload
Public	Allow	Allow	Allow	Allow	Allow
Internal	Warn	Warn	Allow	Allow	Block (non-approved cloud)
Confidential	Warn + audit	Block	Secure print	Allow (watermarked)	Block
Restricted	Block	Block	Block (unless DPO approved)	Block	Block

DLP Alert Routing

Alert Severity	Label Trigger	Routing
Low	Internal label — external email warn overridden	Security team email
Medium	Confidential label — external sharing attempted	Security team + Data Owner
High	Restricted label — any policy trigger	DPO + CISO + immediate investigation
Critical	Restricted label — data exfiltration indicators	DPO + CISO + Incident Response Team + 15-minute SLA

Label Propagation Across Platforms

Supported Platforms

Platform	Label Method	Propagation
Microsoft 365 (Word, Excel, PowerPoint)	Native sensitivity label in file metadata	Full support — label travels with file
Outlook / Exchange	Email header X-MS-Exchange-Organization-Classification	Label persists in message store and forwarded copies
SharePoint Online	Document library metadata + file metadata	Dual storage — library and file level
OneDrive for Business	File metadata	Same as SharePoint
Teams	Channel/chat message metadata	Limited — file attachments inherit, message labels in compliance
PDF export	Visual marking (header/footer) + XMP metadata	Visual marking persists; metadata depends on PDF viewer
Azure SQL Database	Column-level sensitivity classification (sys.sensitivity_classifications)	Native Azure SQL feature; integrates with Purview
AWS S3	Object tags (key: classification, value: tier)	AWS-native tagging; read by Macie and IAM policies
On-premises file shares	File metadata (NTFS ADS) via AIP Unified Labelling client	Requires AIP client installed on endpoints

Enforcement Precedents

• ICO v Interserve Group (2022): GBP 4.4 million — failure to implement adequate data classification and labelling contributed to staff not recognising the sensitivity of data compromised in a breach
• CNIL v Free Mobile (2022): EUR 300,000 — customer personal data stored without classification or access controls; staff could access all customer data regardless of role or need

Integration Points

• classification-policy: Labelling system is the technical implementation of the classification policy
• auto-data-discovery: Discovery results trigger auto-labelling for newly detected PII
• pii-in-unstructured: PII detection in documents drives label recommendation or auto-application
• data-inventory-mapping: Labels feed the data inventory with current classification status per asset
• data-lineage-tracking: Labels propagate through data lineage — transformed data inherits source label