Data classification is a crucial step in order to have a better understanding of the value and criticality of the information asset. Further, it is a primary stage to detect and control how the corporate information asset is handled in various scenarios (e.g. read, modified, stored, printed, shared…etc.) by the stakeholders. In addition, a classification process is one of the indicators of the data governance maturity level in a certain organization. Data classification has recently become a mandatory requirement by the regulators in the financial sector across the GCC region. In this session a sample of the data classification relevant regulations in the GCC financial sector will be highlighted, a method will be presented to classify data and the main protection and detection controls that can be implemented to enforce governance around it will be explored.