Data classification is fundamentally based on the CIA triad - Confidentiality (who can access), Integrity (accuracy/trustworthiness), and Availability (when needed). User types, threat levels, and access controls are implementation details, not the foundational consideration.