questionnaire wants to know whether we classify data according to sensitivity

Data classification falls under access policy and asset management

Yes, this is a recognizable question, and typically the answer is that data classification by sensitivity exists as part of broader policy, not as a standalone document. In NIS2 terms, this falls under asset management and access control measures: knowing which data you have, where it is stored, and who may access it. Without classification, access control is difficult to substantiate — you cannot say who may access "sensitive data" if you have never documented what falls under that category. Questionnaires asking about classification typically expect a brief answer about levels (for example, public, internal, confidential, strictly confidential) and about who assigns those levels.

If you have not documented this, then "no" is the honest answer, and that is not in itself a problem for the questionnaire. Many smaller suppliers operate informally: data is distinguished, but not according to a written schema. It is better to answer "no" than to invent a classification that does not exist. This topic is closely linked to access control and asset management — if there is already an answer there, it is likely that classification is implicitly included and you can supplement that answer instead of building it from scratch. Also relevant is whether there policy on cryptography and encryption is, because classification levels often determine which data is encrypted.

Where this is located precisely: Article 21(2) and Annex A

Article 21(2) of the NIS2 Directive lists asset management and access control as two of the ten mandatory measures; data classification is the practical implementation thereof. ISO/IEC 27001 Annex A contains explicit control measures for classification of information and labeling of assets — that is the most direct reference point if a customer asks for a standards reference. The Cybersecurity Act, which transposes the Directive in the Netherlands and enters into force on 15 August 2026, follows the same structure of measures.