WA Government Data Classification: Operationalising the Information Classification Policy in Purview

Western Australian agencies carry a clear obligation to identify, mark and handle information according to its sensitivity. The WA Government information classification scheme gives agencies a common vocabulary for describing that sensitivity, but a policy document on its own does not protect a single file. The value of the scheme is realised only when classification becomes an operational control inside the systems where staff create and share information every day.

For agencies working within Microsoft 365, that operational layer is Microsoft Purview. Purview sensitivity labels, auto-labelling policies and data loss prevention rules allow a classification scheme to move from guidance on paper into enforceable behaviour in email, documents and collaboration spaces. This article explains how to map the WA scheme to a Purview label taxonomy, how automatic labelling can reduce reliance on manual decisions, and how to structure a rollout that users will actually accept.

The WA information classification scheme in context

The WA Government's approach to information classification aligns closely with the Australian Government Protective Security Policy Framework, which sets out the national markings used across the public sector. Most agency information falls under OFFICIAL and OFFICIAL: Sensitive, with higher protective markings reserved for a smaller set of material carrying greater consequences if compromised. Sitting alongside these business impact levels are handling instructions and information management markers that describe legislative or administrative constraints, such as privacy or legal professional privilege.

Understanding this structure matters because a label taxonomy must reflect it faithfully rather than inventing a parallel scheme. Agencies should treat the published classification policy as the authoritative source for the names, order and meaning of each marking. When the taxonomy mirrors the policy, staff see consistent terminology whether they are reading a guideline, marking a letter or applying a label in Outlook, and auditors can trace each technical control back to a documented obligation.

Mapping the scheme to a Purview label taxonomy

A sensitivity label in Purview is more than a visual marking. Each label can apply content marking such as headers, footers and watermarks, enforce encryption with defined usage rights, and restrict access to external parties. When mapping the WA scheme, the most defensible pattern is a parent label for each business impact level, with sub-labels used to express handling caveats or information management markers that modify how a given level must be treated.

Care is needed to keep the taxonomy comprehensible. A scheme with too many labels invites inconsistent choices and user fatigue, while too few labels fails to capture meaningful differences in handling. Agencies should decide deliberately which markings warrant encryption, which require visual marking only, and which should block sharing beyond the tenant. Documenting these decisions in a label design register, alongside the policy marking each label represents, gives the implementation a clear rationale and supports future review as obligations change.

Auto-labelling and operational enforcement

Manual labelling places the classification decision with the person creating the content, which is appropriate for judgement-based sensitivity but unreliable as the sole control. Purview supports automatic and recommended labelling driven by content inspection, using sensitive information types, trainable classifiers and keyword or pattern matching. These rules can apply a label as content is created or at rest across SharePoint, OneDrive and Exchange, catching material that staff might otherwise leave unmarked.

Auto-labelling works best as a safety net rather than a replacement for informed human judgement. Agencies should begin in simulation mode, which reports what a policy would have labelled without changing anything, then refine the rules to reduce false positives before enforcement. Pairing labels with data loss prevention policies closes the loop, because a DLP rule can act on the label itself to warn users, block external sharing or require justification. This combination turns a classification into a measurable control with evidence that handling rules are being applied consistently.

Governance, rollout and user adoption

Technical configuration delivers little without governance around it. Agencies should assign clear ownership for the label taxonomy, define a change process for adding or amending labels, and keep the mapping between labels and policy markings under periodic review. Logging and reporting through the Purview portal and audit tools provide the assurance that executives and auditors increasingly expect, showing both coverage and exceptions over time.

Adoption depends on preparing people as carefully as the platform. Staff need concise guidance on what each label means, when to override an automatic suggestion, and how classification affects sharing with colleagues and external partners. A phased rollout, starting with a pilot group and default labels before enabling mandatory labelling, gives agencies time to resolve friction and build confidence. When the taxonomy reflects the published scheme, the automatic rules behave predictably, and users understand the reasoning, classification stops being an obstacle and becomes a routine part of how the organisation protects its information.

References

• Microsoft Purview: Learn about sensitivity labels
• Microsoft Purview: Apply a sensitivity label to content automatically
• Australian Government Protective Security Policy Framework