Data classification: Using a risk-based approach for data protection