what do I enter for the question about data classification

Data classification falls under access policy, not encryption

Data classification typically appears in questionnaires under the broader access control and asset management section — not under the encryption section, where some respondents accidentally place it. The question tests whether you categorize your data by sensitivity level (for example, public, internal, confidential, secret) and whether different access rights and processing rules actually correspond to that categorization. A label without consequences does not count as classification.

If you have no classification scheme, then "no" is the honest answer — not "not applicable". Some clients accept an informal categorization as an interim step, as long as you can demonstrate which systems contain which data and who has access to them. This directly touches on the question is the access policy documented, including the management of business assetswithout an up-to-date asset inventory, classification is difficult to substantiate anyway. If you have a schema but no supporting document, upload the policy document or the classification overview itself; a verbal agreement does not qualify as evidence.

Where this comes from: Annex A and Article 21 paragraph 2

ISO/IEC 27001 Annex A lists information classification as a control measure, linked to the broader requirement for asset management. NIS2, Article 21 paragraph 2, does not mention data classification as a separate term, but the ten measures in that paragraph include access control and information system security as a whole — classification is the instrument within this framework to determine which protection level is needed where. If you are yourself an entity under the Cybersecurity Act, this is one of the components that a supervisor can specifically inquire about; verify that through is the enterprise covered by the NIS2 directive or its national implementation. If you have an ISO 27001 certificate, classification is usually already established within the scope of your information security management system and you can refer directly to it.