China's Financial Data Guidelines Introduce 'Sensitive General Data' Tier, Reshaping Governance

1. The Middle-Ground Problem in Data Classification

Many systems face a familiar scenario: numerous tables, permissions, and reports, yet data security discussions still reduce to a binary question — is this important data? In practice, business data rarely fits neatly into "important" or "not important." Some data appears ordinary alone but becomes influential in financial services, market analysis, user profiling, institutional operations, or trading support — affecting judgments, rights, and market expectations. Other data may not reach "important data" status but can still harm organizations, individuals, or public interests if leaked, tampered with, or destroyed.

The recently issued Financial Information Service Data Classification and Grading Guidelines (《金融信息服务数据分类分级指南》) signals a shift: data governance is moving from "do we have important data?" to "even general data must be managed in layers."

2. Past Classification Efforts Stuck on the "Middle Ground"

Data classification and grading is not new. Many entities have done resource inventories, catalogs, important data identification, personal information surveys, permission assignments, and security policy configurations. However, implementation often stumbles on data that sits between the highest tiers and public information.

These middle-ground datasets — business process data, user behavior data, institutional operational data, market indicators, model outputs, processed information, or seemingly ordinary fields that become sensitive in combination — are neither naturally highly protected like state secrets nor freely shareable like public data. Treating them all as low risk underestimates impact; treating all as high risk overburdens systems, sharing, and usage, leading to "classification done but business unusable." The core difficulty is not knowing data needs protection, but determining the appropriate protection layer.

3. "Sensitive General Data" Shows General Data Is No Longer a Monolith

On June 13, 2026, six departments — the Cyberspace Administration of China, the People's Bank of China, the National Financial Regulatory Administration, the China Securities Regulatory Commission, the National Bureau of Statistics, and the State Administration of Foreign Exchange — jointly released the Guidelines. They apply to domestic financial information service providers for data classification, grading, and important data identification, excluding state secrets and military data.

Classification: by business attribute into three categories — business data, user data, enterprise data — further divided into 9 second-level and 67 third-level categories. Grading: four tiers from high to low — core data, important data, sensitive general data, routine general data.

The key industry takeaway is the "sensitive general data" tier. It signals that general data is not a coarse-grained bucket. Certain data, while not reaching "important data" level, can still impact economic operation, social stability, public interest, organizational rights, or individual rights if compromised. The governance logic is pragmatic: financial information services target financial users; their data, news, analysis, quotes, indicators, and institutional info can influence market judgments and user decisions. Sensitivity stems not just from field names but from scenario, combination, timeliness, and usage. In short, grading is shifting from "look at the name" to "look at the impact."

4. Higher Data Value Demands More Than Spreadsheet Classification

Many governance efforts treat classification as a table: data name, system, owner, classification result, grading result, then a ledger. The ledger is necessary but only the start. Real risk is determined by how data flows in systems, who processes it, what decisions it supports, whether it can be combined for inference, and whether anomalies are traceable.

A business-aligned framework avoids two extremes:

Pan-sensitization: nothing dares to be used; sharing, model training, analytics slow down.

Pan-generalization: anything not in the important data catalog gets low-risk handling.

The former stifles data value; the latter leaves security accountability ungrounded. Mature governance finds layered space between them.

5. Classification Focus Shifts from "One-Time Grading" to "Dynamic Management"

The Guidelines' Q&A outlines steps: data resource inventory, classification, grading, forming a classification/grading list, submitting important data catalog, and dynamic update management. The most underestimated step is "dynamic update."

Data is not static. A field may be ordinary query data today but become more sensitive tomorrow due to business rule changes, processing changes, service object changes, or external environment changes. An internal dataset, once fed into intelligent analysis, external interfaces, third-party services, or cross-department sharing, sees its risk profile shift.

With large models, agents, and automated analytics entering business systems, data is no longer just opened, downloaded, or queried by humans — it may be retrieved, summarized, correlated, recommended, used to generate reports, or trigger downstream processes by models. This raises a new question: do original grading results still cover new usage modes?

For example, the same data class may be mere statistical display in traditional reports but become model inference basis in intelligent analysis; it may assist internal judgment internally but form new sharing chains when exposed externally. The data grade may not change immediately, but protection strategies, audit requirements, de-identification methods, and access boundaries likely need adjustment. Therefore, classification/grading should not be a one-time project artifact but embedded into system change, data sharing, model integration, API opening, and permission adjustment workflows.

6. For Industry Software, Data Layering Will Drive Product Capability Changes

The Guidelines directly affect financial information service providers, but they also inspire broader industry software development. Historically, many systems treated data security as peripheral modules: account permissions, audit logs, de-identification configs, export approvals — considered baseline capabilities.

As classification becomes finer, systems must understand not just "who logged in" but "who uses which data class in what scenario." Data security capabilities evolve from static permissions to scenario-based controls. Several changes will intensify:

Data catalogs must serve not only compliance reporting but be actively referenced by permission, de-identification, audit, sharing, and model invocation policies.

Authorization must consider data grade, business purpose, access method, export scope, call frequency, and anomalous behavior — not just roles.

Logs must answer: which data class was accessed, which policy triggered, whether sensitive general data or important data was involved.

Grading results must live in system configuration, approval flows, and runtime monitoring — not just documents.

This means data governance is turning from management policy into product design problems. Truly implementable classification doesn't end with labeling; it requires labels to enter processes, processes to generate evidence, and evidence to support management decisions.

Conclusion: Data Governance Granularity Becomes Competitive Advantage

The "sensitive general data" tier appears as just a terminology, but it points to a larger shift: data security governance is leaving coarse-grained management behind. Not all general data is equal; not all business scenarios fit one policy; not all risks wait for the "important data" tier to be noticed. For data governance, security compliance, and industry software, the real watchpoint is whether classification can move from files, ledgers, and reports into the system runtime itself. Only when data is correctly layered can it be reasonably used — otherwise it is either over-sealed or over-flowed, and neither yields trustworthy data value.