Data Classification and Grading as an Information Governance Mechanism: A Review of Regulatory Practices, Sectoral Implementation, and Operationalization Gaps in China

Data classification and grading is an information governance mechanism through which information resources are categorized, assigned responsibilities, linked to differentiated controls, and updated over time. Using China as the main case, this review examines how classification and grading has been operationalized across regulatory, local public data, and sectoral settings, and where its implementation remains incomplete. This study adopts a structured analytical review design, synthesizing academic studies, national laws and regulatory documents, standards and technical guidance, local public data normative documents, and sectoral implementation instruments, with a focused comparison of governance approaches in China, the United States, and the European Union. The review develops a five-dimensional information governance framework covering information stewardship roles, protected information assets and governance concerns, information categorization criteria and risk logics, differentiated information control mechanisms, and assessment and adaptive updating. The findings show that China has rapidly expanded regulatory and sector-specific arrangements for data classification and grading, especially in public data governance and in sectors such as telecommunications, finance, healthcare, and industry. However, significant operationalization gaps remain, including fragmented standards, weak cross-sector interoperability, uneven information stewardship capacity, limited translation of categories into access, handling, sharing, lifecycle, and audit controls, and underdeveloped feedback and updating mechanisms. By repositioning data classification and grading as information governance rather than only regulatory compliance, this review contributes to research on differentiated data management, information stewardship, and adaptive governance practice.