PSU Data Classification Before Any AI Work

The CISO asked which class the shared drive was. The programme manager said 'internal, probably'. The drive held a tariff working, a cancelled-cheque folder, a DGMS letter, and last year's vigilance closure. The agent was scheduled to ingest 'all PDFs' on Monday. Classification happened as an incident on Tuesday.

This checklist is for DPOs, CISOs and company secretaries in CPSEs. It is not a substitute for your official information-classification policy if you have a living one. If you do not, this is the minimum grid we refuse to skip before an agent sees a file. Embeddings inherit the class of the source. Traces inherit the class of the prompt. There is no 'it's just a vector' exception.

DPDP cares about personal data. Sector overlays care about payment data, market data, safety data. CVC cares about vigilance files. Your board cares about price-sensitive and commercially sensitive papers. An agent that treats those as one soup will be right until the first wrong retrieval, which will be public.

Not legal advice. Official Secrets, SEBI insider-trading overlays for listed CPSEs, and your own standing orders may add classes we do not list.

The minimum grid

Use names the file already understands. Do not invent a five-colour scheme from a US framework if your standing order already has Restricted and Confidential. Map, do not rebrand, unless the standing order is dead.

A workable agent grid: Public; Internal; Commercial-sensitive; Price-sensitive / unpublished (if listed); Personal; Payment-adjacent; Safety / OT-adjacent; Vigilance / legally privileged. A document can wear two labels. The stricter handling wins.

Class decides perimeter, index, and whether an agent is allowed at all.

Class	Examples	Default agent rule
Public	Published tariffs, gazetted SOPs, CSR brochures	Eligible for a wide retrieval agent
Internal	Routine file notes, non-sensitive minutes	Company-perimeter inference, purpose tag
Commercial-sensitive	Bids, unreleased outages, contractor rates	Tight index, no vendor-engineer access
Personal	Employee OH, beneficiary lists, KYC packs	DPDP purpose, training ban, access log
Payment-adjacent	Account numbers, UPI refs, cancelled cheques	India storage; no foreign prompt; see 6 Apr 2018 if payment-system data
Safety / OT-adjacent	Protection settings, live tags, isolation that is not yet a public SOP	Default deny. Separate paper if ever.
Vigilance / privileged	Open complaints, legal opinions, CVO files	Default deny for general agents. Ticketed IA only.

How to mark a corpus in a week, not a year

Do not wait for a perfect enterprise taxonomy. Pick the pilot corpus. Walk it with the owner, the DPO and the CISO. Stamp folders. When in doubt, upgrade the class. A later downgrade is a meeting. A later leak is a para.

Write the rule for scans. A 'public' SOP stapled to a personal medical note is personal. Agents do not read staples unless you split the PDF.

Write the rule for chats. A clerk who pastes a cheque into an internal agent has just changed the class of that thread. Either block the pattern or escalate the thread's class automatically. Ignoring paste is how classification dies in a week.

• Owner name on every collection.
• Purpose string on every collection.
• Training banned unless a written exception the DPO initials — default no.
• Index separation by the stricter classes (personal, payment, vigilance, OT).
• Export and deletion path tested once.
• Vendor engineer access listed, time-bound, logged.

Listed CPSEs and unpublished price-sensitive paper

If you are listed, unpublished price-sensitive information is not 'internal'. An agent that retrieves a draft result, a hidden reserve, or a merger working into a widely scoped helpdesk is an insider-trading machine. Keep a listed-company counsel in the classification walk. We will not recap SEBI's text here. We will say: do not be casual.

What to refuse

Refuse 'ingest everything and we will classify later'. Later is never. Refuse a single index for convenience. Refuse a vendor who says embeddings are non-personal by nature. They are not. See the companion note that embeddings are personal data when the source is.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

We have ISO 27001, so we are classified.

ISO is a management system. Ask to see the live scheme and whether the pilot corpus is marked. A certificate on the wall does not stamp a folder.

Classification will delay the CMD's announcement.

An announcement followed by a leak will delay the CMD's next three announcements. A week on the grid is cheaper.

Everything is confidential in a PSU.

Then you cannot have a wide agent. Over-classification without handling rules is how people ignore labels. Use the grid. Mean it.

The vendor will auto-classify with AI.

A model suggesting a class is a hint. A named owner accepting the class is the control. Do not outsource the first control to the system you have not yet bounded.

A four-week classification playbook

If week one produces no owner names, stop the indent.

1. Week 1: put the minimum grid next to the standing order. Map names. Do not rebrand a living scheme.
2. Week 2: walk the pilot corpus with owner, DPO, CISO. Stamp collections. Split stapled PDFs that mix classes.
3. Week 3: implement index separation, paste rules, training ban, vendor-access list. Test export and delete.
4. Week 4: tabletop a mis-retrieval and a cheque-paste. Whatever fails becomes a gate, not a lesson-learned slide.

How this shows up in the file

Subject: Classification gate — no agent ingest until collections are stamped.

The pilot corpus is marked against the grid in annexure (Public / Internal / Commercial-sensitive / Personal / Payment-adjacent / Safety-OT / Vigilance). Stricter class wins. Embeddings and traces inherit class. Training is banned. Vendor access is listed. Ingest of unstamped folders is not authorised.

This note is not a full information-security policy. It is the gate for this pilot.

This article is informational field guidance for Indian public sector undertakings and their vendors, not legal, audit, labour, energy-regulatory, banking-regulatory or procurement advice. Confirm the live circular, DPE guideline, CVC instruction, sector regulator text, purchase manual and your counsel before you file it.

How this clears vigilance and the board

A P6 Compliance/DPO in a PSU will meet CVC-shaped questions even when there is no special 'AI circular'. “PSU Data Classification Before Any AI Work” has to survive a technical committee, a cost centre, and a union conversation if jobs appear threatened.

Classification is the first control, not a later ISO decoration. If the PSU cannot mark a folder, it cannot mark a prompt. Stop the pilot until the classes exist. OT networks stay off-limits. Navratna autonomy speeds buying; it does not waive DPDP or data classification. IREPS is not GeM. RBI-shaped rules still localise payment data.

• Classify data before the POC.
• Keep agents off OT.
• Write the board memo with residual risk.
• Engage unions on retrieval vs replacement.

Close this loop before the next CAB

Put “PSU Data Classification Before Any AI Work” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P6 Compliance/DPO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “data classification PSU” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What must be true before you file this

If “PSU Data Classification Before Any AI Work” is only a heading, it will not survive a file inspection. A P6 Compliance/DPO should be able to attach one artefact that proves “data classification PSU”: a log export, a clause, a scored row, a dated notice, or a refusal rule.

Write three dated sentences: what was decided, who owns it, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the owner of “data classification PSU” inside the institution.
• Attach one artefact a stranger can open next year.
• Revisit when the model, the notice, or the SI changes.
• Do not treat a vendor slide as evidence.

What the next file must contain

“PSU Data Classification Before Any AI Work” earns a line in the noting only if a P6 Compliance/DPO can attach proof of “data classification PSU.” A heading is not proof. A vendor slide is not proof. A workshop photograph is not proof.

Write three dated sentences: what was decided, who owns it after the next posting order, and when it will be re-checked. If you cannot write the three sentences, you are not ready to buy, to sell, or to go live.

Leave unsourced percentages out of the note. DPDP is not a blanket localisation statute. The November 2025 AI governance text is guidance, not an Act. CERT-In’s 28 April 2022 directions still set specified incident and log clocks. A PAC, when lawful, lives in GFR Rule 166.

• Name the designation that owns “data classification PSU.”
• Attach one artefact a stranger can open next year.
• Record the instrument you are actually using.
• Revisit when the model, the SI, the notice or the posting changes.