Data classification and placement

Controlled baseline

Use four labels, then preserve uncertainty

The signed DOA policy supplies Public, Internal, Confidential, and Restricted classifications. Internal is the default for new or unlabeled DOA data in the controlled draft workflow. When classification is uncertain, use the higher reasonable level until the Data Owner or governance authority confirms it.

Public data still needs an accountable owner and authorized-release basis. Confidential and Restricted uses require deeper or separate review. The repository does not contain the controlling City DLP or classification standard with detailed handling rules, so do not invent those rules from an unpublished draft.

Placement

Follow the data through the whole system

Inventory data entering, created by, stored in, transformed by, transmitted from, exported from, and deleted by the application. Record sources, recipients, providers, regions, identities, integrations, APIs, notifications, backups, and downstream uses.

Provider capability does not prove that a configuration meets the data requirement. A placement decision needs a named purpose and owners, a matching architecture, implementable controls, triggered reviews, and evidence at the appropriate gate.

• Name the authoritative source and whether the application creates a new system of record.
• Map every role, privileged path, external user, anonymous exposure, export, and recipient.
• Record retention-series mapping, legal-hold handling, deletion, return, export, and verified disposal.

Decision routes

Let the use case trigger the right authority

External sharing, APIs, AI use, Confidential or Restricted data, external users, public exposure, privileged integrations, operational dependency, provider deviations, and unusual notification patterns can change the review route. Technology authorization does not replace these decisions.

The Aviation retention schedule is the controlling centralized schedule according to the captured CDO clarification. If a record does not match a series, Data Management or Data Governance coordinates with the applicable policy owner to amend the governing source. Do not invent a retention period.

• Reassess after a material change to data, purpose, source, recipient, provider, region, user population, integration, retention, sharing, or exposure.
• Keep decision authority, concurrence, conditions, expiration, review date, and evidence paths with the record.
• Do not introduce production data while required classification, placement, or exception evidence remains unresolved.