Classify data before storing it — you cannot protect what you have not categorised

The Equifax breach was catastrophic partly because Equifax had accumulated sensitive data on hundreds of millions of people who never chose to interact with them — Social Security numbers, birth dates, and financial histories — without a clear retention policy. Data classification assigns sensitivity levels (public, internal, confidential, restricted) and triggers corresponding controls: encryption requirements, access logging, retention limits, and disposal procedures. Before storing any data, ask: what is it, how sensitive is it, who needs it, and when can we delete it? Only store what you genuinely need, encrypted appropriately for its classification.