Data types, classification, and the protection each class earns

Objective 3.3 in this course covers data protection — CompTIA's scope note for it compares data types, securing methods, general considerations and classifications. It is one objective and it is the hinge between the technical controls in this domain and the compliance obligations in Domain 5.

Why this matters

Every control in this course costs something. Classification is how you decide what to spend it on: you cannot protect everything at the highest level, and an organisation that tries either goes bankrupt or quietly stops doing it.

The exam tests this as matching. Given a data type, what obligations follow? Given a state — at rest, in transit, in use — which control applies? Given a jurisdiction, what constrains where it may be stored? Those are three separate question shapes and they all live in this objective.

The lesson

Regulated, trade secret, intellectual property, legal and financial data

CompTIA's data types are about what the data is, and each carries a different obligation.

• Regulated data is data whose handling is dictated by law or a standard — personal data under privacy law, cardholder data under PCI DSS, health records under sector regulation. The defining feature is that someone outside your organisation decides the requirements, and non-compliance has defined consequences.
• Trade secret is information whose value comes from not being known — a formula, a process, a customer list, pricing logic. It is protected by keeping it secret, which is legally significant: unlike a patent, its protection depends on you having taken reasonable steps to protect it, so poor access control can forfeit the claim.
• Intellectual property is the broader category including patents, copyrights, trademarks and designs. Some of it is deliberately public.
• Legal information — contracts, litigation material, privileged communications. Brings legal hold obligations: once litigation is reasonably anticipated, relevant data must be preserved and normal deletion schedules suspended. Deleting it then is a serious matter, which is why Domain 4's asset management lesson treats retention carefully.
• Financial information — accounts, transactions, forecasts. Brings integrity and audit requirements, and insider-trading implications for unpublished results.
• Human- and non-human-readable is CompTIA's final pair: data a person can read directly versus data meaningful only to a machine — binary formats, serialised structures, database files. Non-human-readable is not protected by being awkward to read, which is the point of listing it.

Two terms that appear constantly and are worth separating: PII is personally identifiable information — anything that identifies a person. PHI is protected health information. Sensitive personal data — health, biometrics, race, religion, political opinion, sexual orientation, trade union membership — attracts stricter handling under privacy law than ordinary personal data.

Sensitive, confidential, public, restricted, private and critical

Classification is the label you attach, and it is what drives handling. CompTIA names: public, private, sensitive, confidential, restricted and critical.

Exact level names vary by organisation — that is expected, and the exam does not require one taxonomy. What it requires is the mechanics:

• Every classified item has an owner, who is accountable for its classification and for who may access it.
• The classification determines handling: who may access, how it is stored, whether it may leave the country, how it is transmitted, how long it is kept, and how it is destroyed.
• Classification is applied at creation where possible, because retrospectively classifying an existing estate is enormous work.
• Data labelling makes the classification visible to people and machines, so that DLP and access controls can act on it.

Two common failures the exam tests. Over-classification — labelling everything confidential — is a real failure, not caution: it makes the label meaningless, blocks legitimate work, and trains people to ignore it. And aggregation, where individually harmless items combine into something sensitive: a name is public, a job title is public, and a complete staff list with titles, locations and email formats is a phishing target.

Data at rest, in transit and in use, and the control for each state

This is the cleanest mapping in the objective and it is examined directly.

• At rest — stored on disk, in a database, in object storage, on backup media. The controls are encryption (full-disk, file, database, field), access permissions, and physical security. The threat is theft of the medium or unauthorised access to the store.
• In transit — moving across a network. The controls are TLS, IPSec, SSH and other transport encryption, plus certificate validation so you are encrypting to the right party. The threat is interception and on-path modification.
• In use — loaded in memory and being processed. This is the hard one, because the application must see the plaintext to work with it. Partial answers exist: memory protection and process isolation by the OS, secure enclaves and confidential computing, tokenisation so the sensitive value is never processed at all, and strict access control over who can reach the running system.

The exam point about in use: if a scenario asks how to protect data while an application is processing it, encryption at rest and in transit are both wrong answers, and enclaves, tokenisation or access control are the direction.

Data sovereignty, geolocation and the jurisdiction question

Data sovereignty is the principle that data is subject to the laws of the country it is physically stored in. Geolocation here means knowing and controlling where that is.

The consequences that matter:

• Some jurisdictions require certain data to remain within their borders — data residency requirements for health, government or financial records.
• Some jurisdictions restrict transfer of personal data to countries without adequate protection, which is why international transfers need a legal mechanism.
• A government may be able to compel access to data stored in its territory, or held by a provider subject to its laws, regardless of where the customer is.

Practically, this means cloud region selection is a compliance decision, not only a latency one — and it extends to backups, replicas, logs and support access, which is where organisations get caught. The primary store is in the right region and the disaster recovery copy is not; or the data is resident and the provider's support engineers access it from elsewhere.

Geographic restrictions as a control also work the other way: limiting access from specific countries, which is a coarse but genuinely effective control for systems with no legitimate users abroad.

Encryption, hashing, masking, tokenisation, obfuscation, segmentation, permissions

CompTIA's methods to secure data, with what each is actually for:

• Encryption — reversible with a key. Use when you need the original back. The control that protects data at rest and in transit.
• Hashing — one-way. Use for verifying integrity and for storing passwords (with salt and stretching). Not for data you need to read again.
• Masking — replacing part of a value for display, usually irreversible. Use for screens, reports and non-production environments.
• Tokenisation — substitution with a meaningless token, mapping held in a separate vault, no key and no mathematical relationship. Use when the sensitive value should never enter the system at all, which is the card-payment pattern.
• Obfuscation — the general category of making data harder to interpret, including steganography. Weakest of the set on its own.
• Segmentation — keeping sensitive data in its own environment with its own controls, so the rest of the estate is out of scope. This is how PCI environments are kept small, and reducing audit scope is a legitimate and substantial benefit.
• Permission restrictions — least privilege applied to data. The most fundamental control and the most commonly wrong in practice.

One more idea that belongs here: data minimisation. The most reliable way to protect data is not to hold it. Data you never collected cannot be breached, cannot be subpoenaed and costs nothing to protect — and it is a requirement of most privacy regimes, not just good practice. When a scenario asks how to reduce the impact of a potential breach, "stop collecting and retaining what you do not need" is a legitimate and often correct answer.

What to take into the exam

• At rest → encryption and permissions. In transit → TLS/IPSec. In use → enclaves, tokenisation, access control. If the question says "while being processed", the first two are wrong.
• Tokenisation has no key; masking is for display and test data; hashing is one-way and not for data you need back.
• Trade secret protection depends on having taken reasonable steps to keep it secret, so weak access control can forfeit the claim.
• Legal hold suspends normal deletion, and it overrides retention schedules.
• Data sovereignty follows the storage location — and applies to backups, replicas, logs and support access, not just the primary copy.
• Over-classification is a failure; aggregation can make public items sensitive.