Regulations and data classification

Why this matters

Much of the data analysts work with is about people, and the law places obligations on how it is collected, used, stored and shared. Breaching them can bring large fines, legal action and lost trust, and the breach can happen in ordinary analytical work: an extract emailed to the wrong person, personal data used for a purpose it was not collected for, or a data set copied to a country it should not leave.

The exam asks you to summarise compliance requirements. This lesson covers data classification, the main regulations in the terms an analyst needs, data sovereignty, consent and lawful purpose, and the policies that sit alongside the law. It describes the regulations in outline; applying them to a specific case is a matter for an organisation's legal and compliance teams.

The lesson

Personal data, sensitive data and how they are classified

Data classification sorts data by how sensitive it is, so that each class gets appropriate protection. A typical scheme has four levels:

• Public: approved for anyone, such as published prices.
• Internal: for employees, low harm if disclosed, such as internal procedures.
• Confidential: limited to those who need it, with real harm if disclosed, such as customer lists or sales figures.
• Restricted (or highly confidential): the most sensitive, with serious harm if disclosed, such as payment card data, health records or trade secrets.

Several categories of data about people carry legal meaning.

Personal data, or personally identifiable information (PII), is information that identifies a person directly, such as a name, email address or identification number, or indirectly, in combination with other data, such as a postcode together with a date of birth.

Sensitive or special category data needs extra protection: health, biometric and genetic data, racial or ethnic origin, religious beliefs, political opinions, trade union membership, sex life or sexual orientation. Protected health information (PHI) and payment card data have their own specific rules.

Classification drives everything downstream: who may access the data, whether it must be encrypted or masked, where it may be stored, and how long it may be kept. Analysts should know the classification of every data set they use.

GDPR, CCPA, HIPAA and PCI DSS in the terms an analyst needs

Four regulatory frameworks appear most often.

The General Data Protection Regulation (GDPR) applies to personal data of people in the European Union, including when it is processed by organisations outside the EU. Its principles include lawfulness, fairness and transparency; purpose limitation (use data only for the purposes it was collected for); data minimisation (collect and use only what is necessary); accuracy; storage limitation (keep it no longer than necessary); and security. It gives individuals rights, including access to their data, correction, erasure (the "right to be forgotten") and objection to certain processing. The United Kingdom has its own version, the UK GDPR.

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act, gives California residents rights to know what personal information businesses collect about them, to have it deleted, and to opt out of its sale or sharing. Other US states have passed similar laws.

The Health Insurance Portability and Accountability Act (HIPAA) governs protected health information held by US healthcare providers, health plans and their business associates. It restricts use and disclosure and requires administrative, physical and technical safeguards. It also defines methods for de-identifying health data so it is no longer PHI.

The Payment Card Industry Data Security Standard (PCI DSS) is an industry standard, not a law, required by the card brands of organisations that store, process or transmit payment card data. It requires protecting cardholder data, including restricting and encrypting stored card numbers, and it strongly encourages not storing card data at all where it is not needed.

For an analyst, the practical common ground is: use personal data only for approved purposes, use the minimum necessary, prefer de-identified or aggregated data where it answers the question, and protect what you hold.

Data sovereignty and cross-border transfer

Data sovereignty is the principle that data is subject to the laws of the country where it is located. Data residency refers to requirements, from law, regulation or contract, that data be stored in a particular country or region.

Cross-border transfers of personal data are often restricted. GDPR, for example, permits transfers outside the EU only to countries with an adequate level of protection or under approved safeguards, such as standard contractual clauses. Some countries require certain data, such as financial or health records, to be stored locally.

This matters for everyday analytical decisions: choosing the cloud region for a warehouse, using a software-as-a-service tool hosted abroad, or sending an extract to a colleague or supplier in another country. Each can be a cross-border transfer, and each should follow the organisation's approved routes.

Consent and lawful purpose for analysis

Using personal data needs a legal basis. Consent is one basis: the person has agreed, freely, specifically and in an informed way, to a particular use. It is not the only one. Others include performing a contract with the person, a legal obligation, and, under GDPR, the organisation's legitimate interests, balanced against the person's rights.

For analysts, the most important principle is purpose limitation: data collected for one purpose should not simply be reused for an unrelated one. Order data collected to fulfil purchases can generally be analysed to understand sales; using the same data to build profiles for a new, unrelated purpose may need a new legal basis, or consent. When an analysis would use personal data in a new way, the right step is to check with the data owner or privacy team before starting, not after.

Where individuals have withdrawn consent or objected, their data must be excluded from the processing it covered, which analyses built on older extracts may miss.

Industry and internal policies alongside the law

Law sets the minimum. Organisations add their own layers.

Industry standards and regulations apply to particular sectors: financial services, healthcare, education and government each have specific rules on data handling, retention and reporting.

Internal policies turn legal requirements and the organisation's risk appetite into specific rules: an acceptable use policy, a data classification policy, a retention schedule, rules on which tools may hold which data, and requirements for approval before sharing data externally.

Contracts with customers and suppliers can also restrict how data received under them may be used.

An analyst does not need to be a lawyer, but does need to know the policies that apply to their work, follow them, and ask when unsure. The organisation's privacy or compliance team is the resource for interpretation, and the data owner is the resource for approval.