A retail sales company is implementing a cloud-based customer relationship management (CRM) system to handle its global customer data. As part of its security and compliance strategy, the company must classify its data to apply appropriate security controls and prevent unauthorized access. Which of the following is the MOST effective approach to classifying data within this cloud environment?