Who is responsible for deciding the appropriate classification level for data within an organization?

The data custodian is responsible for the technical implementation and day-to-day maintenance of data protection controls, not for deciding classification levels.

A security auditor evaluates data sensitivity, risk, and regulatory requirements to assign appropriate classification levels across organizational information assets. In formal governance structures, the auditor holds the specialized expertise and independent authority needed to validate and determine classification labels in a way that is consistent, objective, and policy-compliant.

End users consume and interact with data but have no formal authority or specialized knowledge to determine the appropriate classification level of organizational information assets.

The data owner holds business accountability for a dataset but in this governance model defers the formal classification determination to the security auditor who has the mandate and expertise to assess sensitivity and compliance requirements.