AI Glossary / Data governance and quality / Intermediate

Information sensitivity

Definition

Information sensitivity describes how much protection information needs because of the consequences of inappropriate disclosure, access, use, alteration, or loss. It depends on the content and context, including the people and activities affected. Organizations commonly express sensitivity through classification and handling rules. The term is broader than a particular legal category of sensitive personal data, and it is unrelated to the statistical sensitivity of a test or the mathematical sensitivity used in differential privacy.

What it means

The same type of information can require different handling in different circumstances. A public business address differs from a private home address exposed to a hostile audience. A draft commercial plan may need restricted access before an announcement even if some details later become public. Sensitivity is therefore not determined solely by file type or a keyword. It reflects plausible harm and the applicable responsibilities, with decisions made under the organization's defined policy.

How it works

Identify what the information contains, why it is held, who needs it, and what harm could follow inappropriate handling. Apply the relevant classification and handling rules, then choose access, sharing, storage, retention, and disposal controls that fit those requirements. Review the assessment when content is combined, circumstances change, or information is prepared for release. Keep ownership and escalation clear so users can resolve uncertainty. Automated labeling can assist, but context and exceptions often require informed review.

Three practical examples

• Commercial planning: a draft acquisition proposal receives restricted handling before a public announcement.
• Staff information: a directory entry suitable for external publication is separated from private emergency-contact records.
• AI datasets: training material containing confidential customer interactions is assessed differently from an approved public benchmark, even when both are stored in the same file format.

Think of it this way

Think of deciding which documents belong on a public noticeboard, in a shared team folder, or in a restricted cabinet. The decision depends on what could happen if the wrong person saw or changed them. The analogy is limited because digital information can be copied, combined, searched, and transformed rapidly, and a label alone does not enforce the intended handling.

Worked example

In an original exercise, a company prepares three versions of a project update. Version A contains already published milestones. Version B adds unannounced pricing. Version C adds private customer comments and named contacts. The team cannot responsibly assign one handling level merely because all three files are called project update. It assesses the additional content and permitted audience for each version. If a public summary is needed, it creates and reviews a separate release rather than assuming removing the confidential label makes Version C safe. The example illustrates content-based review without prescribing a universal classification scheme or a legal category.

Illustrative case study

Fictional example: Cedar Support plans to use chat transcripts to evaluate an AI assistant. The team initially treats them as ordinary operational data, then notices personal details and confidential business discussions embedded in free text. It narrows access, reviews whether those details are needed, and creates a controlled preparation process. This invented case shows why sensitivity assessment must examine actual content rather than rely only on column names or the system that produced the data.

Common misconceptions and mistakes

Do not assume unclassified means public, or that public availability removes every privacy concern about reuse. Do not treat all personal information as belonging to the same legal category, and do not import one government's classification labels into an unrelated organization without a policy basis. Also, highly important public information may need strong integrity and availability protection even when confidentiality is low. Sensitivity assessment should not reduce every security requirement to keeping information secret.

Business use

A clear sensitivity scheme helps people choose appropriate tools, recipients, and safeguards. For AI projects, assess source material, prompts, logs, evaluation outputs, and model artifacts separately where their contents and risks differ. Make handling rules practical enough that users can follow them during routine work. Identify who can approve release and who reviews uncertain cases. Reassess derived datasets because aggregation or transformation can change exposure, while seemingly anonymous material may still support sensitive inferences.

People also ask

Is information sensitivity the same as legal special-category data?

No. That is a specific legal concept in some jurisdictions; general sensitivity also includes commercial, operational, and other concerns.

Can sensitivity change over time?

Yes. Publication, changed circumstances, or new combinations of data can affect the assessment.

Does a label protect information automatically?

No. It must connect to understood handling rules and effective controls.

Check your understanding

A document is marked public but contains a private contact list added during editing. Should the old label settle the sharing decision?

Answer: No. The changed content needs review. Labels can become inaccurate, and release should follow the applicable content and handling requirements.

Related terms

• Integrity
• Availability
• Personal data
• Access Control
• information classification
• confidentiality
• data minimization

Learn next

compare two versions of a harmless sample document and identify which additions change the required audience or controls. Write a brief handling note that states the permitted use and sharing route. Then check whether the systems used for storage and collaboration actually support those rules.

More in Data governance and quality

• Inference attack - An inference attack attempts to discover protected or sensitive information indirectly from information that is available, such as published statistics...
• Information security awareness - Information security awareness is people's understanding of relevant information risks, their responsibilities, and the practical actions they can take to...
• Information security indicators - Information security indicators are defined measures or signals used to understand aspects of an organization's security condition, control performance, or...
• Input mask - An input mask is a pattern that guides or restricts how a user enters a value into a field.
• IT risk - IT risk is the possibility that uncertainty involving information technology will affect an organization's objectives.
• IT risk management - IT risk management is the ongoing process of identifying, assessing, responding to, and monitoring risks arising from an organization's use of information...

Sources

Sources: NIST CSRC, sensitivity, https://csrc.nist.gov/glossary/term/sensitivity , information-protection definition consulted; UK Government Security Classifications Policy, https://www.gov.uk/government/publications/government-security-classifications/government-security-classifications-policy-html , relevant official excerpts consulted; UK Government, Working at SECRET, https://www.gov.uk/government/publications/government-security-classifications/guidance-12-working-at-secret-html , lifecycle-change excerpt consulted. Government labels are examples of scoped policy, not universal business requirements. Examples are original. Detailed privacy-law classifications and jurisdiction-specific obligations require separate current review.

Previous: Information security indicators Next: Information sets