Our databases store all kinds of data in them, depending on the purpose of your database. Most of us create tables and store data in response to some requirement or necessity in our organizations. Our decisions should be driven by good design principles, and I'd hope they are, but we do need to find a place to put all the data that our system will receive.

Depending on the sensitivity or personal nature of data, we may have to alter the way we store data (perhaps encrypt it) or alter the security for parts of the system. This is almost an ad hoc, deal-with-it-at-that-time task. The exceptions might be when I've had to conform to a regulatory statute, such as SOX, PCI, HIPAA, etc. In those cases, I've often had to ensure the entire database is protected in some way that ensures it meets the requirements of the statute.

The time when I have had to think about individual columns of data is usually when building a development database where potentially sensitive information can't be transferred to development machines. In that case, because of the effort of changing data, I'll try to build scripts that change out individual columns and ensure that sensitive data doesn't get copied. However, the data that may be deemed sensitive for one company, isn't always classified that way for another.

At least that's been my experience. I shared some of this with the Redgate Foundry, who is running research into data classification. They're looking for people to share opinions, but the project has me curious. I've always felt intuitively we could classify data in tables, but perhaps that's too simplistic a way of looking at the problem. I know that legal groups struggle with some this problem with email and file server documents. Classifying the content in different ways is a challenge for them.

Is it the same in databases? I'm not sure. I don't know if there are complex rules needed or if this is a simple problem that we easily solve and rarely deal with. I'm curious from those of you that deal with highly regulated industries. Is data classification something that you work with often? How do you decide the data classes and does this impact your administration of the database? If you don't classify the data, do you worry about the sensitivity of the bits in your database? Let us know today.