Overview
ISO/IEC TS 38505-3:2021 - Information technology - Governance of data - Part 3: Guidelines for data classification - is a Technical Specification that provides practical guidance for governing bodies and management on using data classification to support an organization’s data governance policy. It complements ISO/IEC 38500 (IT governance) and ISO/IEC 38505-1 (data governance) and focuses on factors to consider when developing, deploying and maintaining a data classification system to manage value, sensitivity and risk.
Key topics and requirements
- Foundations and context
- The strategic value of data, the “data deluge,” associated risks and consequences of failure.
- Definitions for terms such as big data, customer data, data controller/processor, data steward, data sensitivity and PII.
- Roles and responsibilities
- Guidance for the governing body (oversight, direction, monitoring).
- Guidance for management (scope, implementation, operations, reporting).
- Operational roles: data stewards, data quality owners, controllers and processors.
- Data classification framework
- Phases: Context → Identification → Implementation → Monitor/Improve.
- Emphasis on scoping, discovery, attribution and lifecycle considerations.
- Guiding principles
- Simplicity, default classifications, interoperability and equivalence.
- Use of classification for controllers/processors, auditing, controls, compliance, customer data handling, assessment and continuous improvement.
- Practical controls
- Apply proportionate protections aligned with sensitivity and business needs.
- Emphasize monitoring, reporting and continuous improvement rather than prescriptive technical controls.
Applications and users
ISO/IEC TS 38505-3 is designed for:
- Members of governing bodies and senior management setting data policies and risk appetite.
- Data governance teams, data stewards and data quality owners implementing classification schemes.
- Compliance, privacy and information security officers aligning classification with PII/data protection obligations.
- IT and business managers integrating classification into systems, access controls and data lifecycle processes.
Practical applications include designing a classification taxonomy, setting default classes, mapping controls to sensitivity, supporting legal and regulatory compliance, and improving data discovery and protection workflows.
Related standards
Keywords: ISO/IEC TS 38505-3:2021, data classification, data governance, data sensitivity, data taxonomy, information security, data protection, governance of data.