Classifying, labelling, masking, retaining and sanitizing data

Use the data lifecycle to make handling decisions

Know what information exists, its owner, where it flows and why it is needed. Classification groups information according to the organization’s sensitivity and handling needs; a label communicates that classification. The names and rules must be defined locally. A label may trigger protection in a configured product, but a label without protection is still possible.

Do not confuse display masking with encryption

Dynamic masking changes what a query user sees under configured conditions; it does not replace permissions or make the underlying information cryptographically unreadable. A display showing only the end of a number can reduce casual exposure without providing all the protection required for that data. Apply the actual access policy and consider other ways the information can be obtained.

Retention and disposal have constraints

Keep information for the justified period and account for applicable obligations, business needs and data locations, including providers and copies. Retention is not simply “keep everything forever”, while deletion is not always immediate when an obligation requires preservation. A disposal decision needs an owner, appropriate method and evidence suited to the circumstances.

Distinguish clear, purge and destroy

In NIST 800-88r2, clear uses logical techniques on user-addressable storage to resist simple recovery through the normal interface. Purge aims to make recovery infeasible even with advanced laboratory techniques while leaving the medium potentially reusable. Destroy aims for that stronger recovery resistance and leaves the medium unusable for storage. The suitable method depends on the medium and context; clear/purge are not methods for paper. Logical/virtual storage also has distinct limits. No fixed overwrite-pass count is prescribed here.

Check what an AI service actually receives

Editorial application: apply classification, approved purposes, access and retention rules before sending information to an AI service. A masked screen does not prove the submitted data are anonymous. Encryption on a transport path does not prevent the authorized endpoint from processing plaintext. Do not infer that a protection label or encryption automatically authorizes disclosure to a provider.

Connect the terminology.