Data handling: classification labels and what they mean
For staff who own, store or share datasets: data and reporting staff, IT and system administrators, HR, finance and project leads. Complete 'Classifying information and sharing it safely' first, which teaches an example scheme and everyday sharing. This course goes further into what labels actually mean. You'll read a label for its level, handling rules and owner, read impact ratings in the US NIST FIPS 199 notation, work out a system's rating from the information it holds, tell a sensitivity label apart from legal categories such as UK GDPR special category data, and handle information labelled under someone else's scheme, using the UK government's OFFICIAL and OFFICIAL-SENSITIVE as the example. Your organisation's own scheme and policy always apply. This course is not legal advice.
- Level
- Intermediate
- Length
- About 78 minutes
- Contents
- 5 lessons · final exam
- Status
- Published · updated 10 Oct 2026
Skills you'll practise
- Explain what a classification label tells you: the sensitivity level, the handling rules that follow from it, and who owns the decision
- Read a FIPS 199 security category and state the impact level for confidentiality, integrity and availability
- Determine a system's or dataset's category using the high water mark across the information types it holds
- Distinguish a sensitivity label from legal data categories such as personal data and special category data under UK GDPR
- Choose handling for information labelled under a partner's scheme that is no weaker than the partner requires
Course outline
- 1.Explaining what a classification label tells youLesson · 15 min
- 2.Reading a FIPS 199 security categoryLesson · 16 min
- 3.Determining a system's category with the high water markLesson · 15 min
- 4.Distinguishing sensitivity labels from legal data categoriesLesson · 14 min
- 5.Choosing handling for information labelled under a partner's schemeLesson · 10 min
- 6.Data handling: classification labels and what they mean: knowledge checkKnowledge check · 14 questions
- 7.Data handling: classification labels and what they mean: practical exerciseKnowledge check · 1 question
- 8.Final exam10 questions · passing it completes the course, so people who already know the material can test out
Sources it draws on
The lessons and questions are written from these references, so learners can go back to the original.
- GOV.UK: Government Security Classifications (collection page, updated 5 August 2024)
- GOV.UK: Government Security Classifications Policy (HTML, updated 5 August 2024)
- GOV.UK: Guidance 1.1: Working at OFFICIAL (HTML, updated 5 August 2024)
- NIST FIPS 199: Standards for Security Categorization of Federal Information and Information Systems (February 2004)
- NIST SP 800-60 Vol. 1 Rev. 1: Guide for Mapping Types of Information and Information Systems to Security Categories (August 2008)
- ICO: What is personal data? (UK GDPR guidance)
- ICO: What is special category data? (UK GDPR guidance, updated 9 April 2024)
See it with your own jobs and topics
Tell us about your team and we'll walk you through setup, from choosing jobs to your first skills check.