Two questions decide how a piece of data must be handled: does it contain personal information? and who is allowed to see it? Dawiso answers them with two separate classifications — PII Level and Confidentiality — that you set on data assets and that carry up to the data products built on them.
They are kept apart on purpose, because they are independent. A public dataset can still contain personal data; a highly confidential dataset may contain none. Collapsing them into a single “sensitivity” label loses that distinction — and with it, the ability to answer a privacy question and an access question separately.
Two independent classifications
| Classification | Answers | Drives |
|---|---|---|
| PII Level | Does this data contain personal information? | Privacy obligations — GDPR, CCPA, impact assessments |
| Confidentiality | Who is allowed to see this data? | Access control and information-handling rules |
Because the two are orthogonal, every asset carries both, and one never implies the other.
How they work in Dawiso
Both are code lists — Dawiso object types, PII and Confidentiality, whose values your organization defines and governs. You classify an asset by linking it to one value from each list; from a value’s page you can see every object that carries it. Because the lists are ordinary catalog objects, they can be owned, stewarded, and shared across spaces like anything else.
Keeping the values in a code list, rather than hard-coding them, means you can shape the scale to your policy — add a tier, rename one, or reword a description — without waiting on a release.
A typical scale
Every organization sets its own values. A common starting point, from least to most sensitive:
PII Level
- None — no personal data.
- Contains PII — indirect or low-risk personal data, such as a business contact.
- Sensitive PII — direct identifiers, or special-category data such as health, financial, or data about minors.
Confidentiality
- Public — anyone may see it.
- Internal — all employees.
- Confidential — named teams or roles only.
- Restricted — explicit, audited approval to access.
The order matters: it sets which value wins when classifications combine.
Classification rolls up to the product
You classify where the truth lives — usually a column or a table. From there the classification rolls up: in the Data Product Standard application, an output port shows the highest classification among the assets it exposes, and the data product shows the highest across its ports. The rule is the most sensitive value wins — one Sensitive PII column makes the whole product Sensitive PII.
That is what lets a consumer see, at a glance in the Data Market, how sensitive a product is before requesting access — without opening every asset beneath it. Where a rolled-up value is wrong for a particular record, you can override it and set the value by hand; clearing the override lets it derive from the assets again.
Classification describes; it does not enforce
PII Level and Confidentiality are descriptive metadata. They tell people — and downstream systems — how data must be handled, but Dawiso does not itself block access based on them. Access is granted separately, through the data product’s contract and your access-provisioning process. Classification informs those decisions; it does not replace them.
Classification is one side of trust; accountability is the other. See Ownership for who answers for a product, and Data contracts for how access is actually agreed.