How should data protection and classification be designed for production in Cloud Security?

Classify data, minimize collection, control access, encrypt, tokenize or mask where needed, define retention, and audit sensitive operations.