City council support staff must treat resident PII differently from public park maps in Microsoft 365. Which Purview concept should guide that distinction?

Data classification categorizes content by sensitivity so organizations can apply different protections to different classes of information. City council support staff who must treat resident PII differently from public park maps in Microsoft 365 should guide that distinction with data classification concepts so protections can differ appropriately. Retention labels that keep council records for a defined period to meet compliance obligations govern how long content is kept, not how it is classified by sensitivity, so they cannot guide the distinction between resident PII and public park maps. eDiscovery search that finds relevant content across mailboxes for legal review purposes is meant for legal review, not sensitivity classification, so it does not help staff separate resident PII from public park maps for protection purposes. Audit logging that records user and admin activity in Microsoft 365 to support detailed later investigation tracks activity, but it does not categorize content by sensitivity, so it cannot determine whether resident PII or public park maps need different protections. Exam caveat: AB-900 expects classification by sensitivity (for example PII versus public maps)—not "everything public," network-origin tags, or display-name taxonomies. Operational check: define municipal classification categories, map them to labels and DLP or access controls, and verify resident PII locations receive stronger protection than public park maps. In municipal practice, classification is the bridge between "what kind of information is this" and "which controls apply," so council workflows can keep park maps broadly shareable while locking down resident PII. Without that distinction, staff either over-restrict public information or under-protect personal data—both of which create operational and compliance problems for the city.