Different data types have different levels of sensitivity, so the acceptable uses and required protections for each data type should be addressed accordingly. The first step in accomplishing this for an organization is identifying the nature and location of its data.