questionnaire asks about data classification what should I fill in

Classification of sensitive data: no separate box in Article 21

This falls under the measure for access policy and business resources from Article 21(2) NIS2, not under a separate requirement. The directive mentions "asset management" and access policy under point (d) of the ten measures, and data classification is the logical starting point: you cannot restrict access to sensitive data if you have not first established which data is sensitive. If the questionnaire asks about classification, it belongs with the same substantiation as access control and asset management.

In practice, the customer usually wants to know: do you have a categorization (for example, public, internal, confidential, secret), is that categorization documented, and are rules attached to each level — who may view it, how is it stored, may it be sent encrypted. If you have no formal classification but do have a list of sensitive systems and who has access to them, you can often present that as partial evidence; the answer then remains "yes, with explanation" instead of a ready-made "yes". If you have documented nothing, then "no" is the honest answer — inventing a classification scheme to fill in the list does not produce evidence if the customer ever asks for it. Also watch for overlap with encryption: if classification leads to rules about encrypting the highest category, that belongs with the encryption policy.

Where this appears in the regulations

Article 21(2) sub (d) and (i) of Directive (EU) 2022/2555 list business resource management and access control policy as two of the ten mandatory measures; data classification is the connection point between the two. ISO/IEC 27001 elaborates this more explicitly: Annex A has a separate category for "information classification" within the broader group of control measures for business resources. Anyone already ISO 27001-certified thus usually has a classification scheme as a fixed part of the management system — see also the question whether the undertaking is ISO 27001 certified. The Dutch Cybersecurity Act, the Netherlands' implementation of NIS2, enters into force on 15 August 2026 and repeats these ten measures without supplementing them with a separate classification article.