Understanding and protecting the data you hold: Industry data classification framework

Every organisation holds data of different types, sensitivities and values – from customer information and intellectual property to operational, financial and research data. However, many organisations struggle to consistently identify what data they hold, understand its sensitivity, and determine what level of protection is appropriate. There are also the flow-on challenges of communicating assessments and protection controls in a common language. In practice, this often leads to either under‑protecting high‑value data or over‑protecting low‑risk data, increasing cost and complexity without improving security outcomes. 

This session introduces the Industry Data Classification Framework (IDCF) – a voluntary, practical data governance framework developed by the Department of Home Affairs in partnership with CSIRO’s Data61 as part of the 2023–2030 Australian Cyber Security Strategy. The IDCF is designed specifically for industry use and responds directly to long‑standing feedback from businesses that there is no common, easy‑to‑use approach to classifying data and communicating protection requirements across organisations. 

The IDCF helps organisations answer a deceptively simple question: what level of protection does this data actually need? It does this by providing clear guidance to help organisations: 

• Identify and understand the data they hold 
• Assess sensitivity and risk in a consistent, structured way 
• Apply proportionate security controls aligned to that risk 
• Communicate protection expectations using a common, shared language. 

At the core of the framework are Data Security Levels (DSLs) – a simple classification system that allows organisations to label data based on risk and handling requirements. These labels support clearer internal decision‑making and reduce confusion when data is shared with third parties, suppliers or partners. The framework also includes optional markers to communicate additional handling requirements or context where needed. 

Importantly, the IDCF is voluntary and non‑regulatory. It does not mandate controls or replace existing standards. Instead, it is designed to work alongside existing security, risk and governance arrangements, allowing organisations to adopt the modules that suit their size, maturity and operating environment. This makes the framework accessible for small and medium enterprises while still useful for large, complex organisations. 

The framework is structured into four modular components: 

• Overview – how to use the framework and integrate it into existing practices
• Risk assessment – practical guidance to assess data risk 
• Data Security Levels (DSLs) – a common system to classify data and communicate protection needs 
• Markers – optional secondary labels for additional context or controls 

In this session, speakers will walk through the rationale for developing the IDCF and explain how the framework works in practice. Attendees will leave with an understanding of how the IDCF can simplify data governance, support better security decisions, and enable more trusted data-sharing. 

This session will be relevant to security leaders, risk and governance professionals, data practitioners, and organisations of all sizes looking for practical ways to improve how they manage and protect the data they hold.