How to create a Data Classification Policy in Data Governance

João Barros 06 de November de 2026 4 min read

This tutorial explains how to create a Data Classification Policy in Data Governance to identify, label and control sensitive data consistently. The policy helps reduce risk, make audits easier and support access and retention policies.

Prerequisites

Account with administrative permissions in a cataloging/metadata service (e.g.: Microsoft Purview or equivalent).
Initial inventory of data sources (databases, data lakes, files) and examples of sensitive data.
Basic knowledge of regular expressions (regex) and the labels/terminology your organization uses.
Tool to test regex (optional) and access to a test environment.

Step 1: Define objectives and classification categories

Before configuring any policy, define which types of data you want to identify (e.g.: PII, PCI, PHI, internal secrets) and which actions each label triggers (e.g.: encryption, access restriction, anonymization). Document formats and examples for each category — this makes rules more effective and reduces false positives.

Step 2: Create a set of rules with regex and heuristics

Build rules that detect concrete patterns (e.g.: NIF, credit cards, emails). Combine regex with heuristics (column/title context, file type) to improve accuracy. Test each regex with real and simulated examples.

# Exemplos de regex (sintaxe PCRE comum)
# NIF (Portugal): 9 dígitos
regex_nif = r"\b\d{9}\b"
# Cartão de crédito (Visa/Master simplificado)
regex_cc = r"\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})\b"
# Email
regex_email = r"[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}"

Step 3: Implement the policy in the cataloging tool

In your tool (e.g.: Microsoft Purview) create a new Data Classification Policy or Policy Rule. For each category, add the regex rules and conditions (apply only to columns with a name containing 'email', 'nif', 'cc' to reduce false positives).

# Pseudopasso: configurar regra na UI/API da ferramenta
1. Nova Policy -> Nome: "Classificação PII Básica"
2. Categoria: PII -> Etiqueta: "Confidencial - PII"
3. Adicionar Rule:
   - PatternType: Regex
   - Pattern: regex_email
   - Scope: columnName contains 'email' OR fileExtension in (csv,txt)
4. Ativar scan agendado ou manual

Step 4: Run scans and refine with exceptions

Run an initial scan over test sources to measure detection rates and false positives. Analyze samples and create exceptions or additional rules (e.g.: exclude columns named 'test_email' or files in /archive/). Iterate until you reach acceptable accuracy.

# Processo de iteração (exemplo lógico)
1. Run scan -> export results
2. Sample hits -> verificar verdadeiro positivo/negativo
3. Se falso positivo -> adicionar condição de exclusão
4. Se falso negativo -> relaxar regra ou adicionar contexto adicional

Step 5: Integrate labels with operational policies

After labeling data, connect the labels to operational actions: create access alerts, apply Column-Level Security, enable encryption or initiate anonymization processes. Document the workflow so Data Stewards and security teams know how to respond to detections.

# Exemplo conceptual de integração
If data.label == 'Confidencial - PII':
    apply_access_policy(role='PRIV_SECURE')
    log_event('PII_detected', resource_id)

Verify the outcome

Validate that labels were applied correctly: check the policy report in the tool, review examples of labeled files/tables and verify that actions were triggered (logs, permission changes, alerts). Perform an access test with a non-privileged user to confirm restrictions.

Conclusion

By creating a Data Classification Policy in Data Governance you can identify and label sensitive data at scale, reducing risk and easing compliance. Next steps: automate periodic reviews, involve Data Stewards for human validation and integrate detections with remediation processes. Tip: start with a few high-precision rules before broadening coverage — which categories will you prioritize first?