Data classification levels are the operating language of an enterprise security program. They translate business sensitivity into something access controls, retention rules, and audit logs can act on.