A mislabeled spreadsheet once slipped through our systems. It had names, emails, and a blueprint for a core feature. That single mistake forced us to rebuild our entire approach to sensitive data.
ISO 27001 doesn’t treat sensitive data as an abstract term. It forces you to define, classify, protect, and control it at every point in its lifecycle. Whether it’s personal information, customer contracts, financial records, or proprietary source code, the standard demands you know exactly where it lives, who can see it, how it moves, and how it’s destroyed.
Sensitive data under ISO 27001 falls into two broad zones: personal data and business-critical data. Personal data includes identifiers like full names, phone numbers, IP addresses, online IDs, and anything that can connect back to a living person. Business-critical data includes trade secrets, strategic plans, unreleased product specs, internal code repositories, and any data that, if exposed, would damage operations or reputation.
The standard makes you classify this data based on confidentiality, integrity, and availability levels. Classification drives every control: encryption at rest and in transit, role-based access, logging, data masking, secure coding practices, supplier audits, and strict incident response processes. You don’t guess; you document and enforce.