A data classification policy helps organizations identify data sensitivity levels, such as public, internal, confidential, restricted, or personal data. This supports compliance with data protection regulations because different classes of data require different controls over access, storage, transmission, retention, disclosure, and disposal. Classification does not directly confirm whether a particular record is valid, complete, or free from duplication. Those objectives are handled through input controls, reconciliation, validation routines, and data quality procedures. Internal auditors should assess whether classification rules are clear, applied consistently, linked to access controls, and aligned with legal and regulatory requirements. Strong classification also supports encryption, privacy impact assessment, breach response, and third-party data handling. Therefore, Option D is correct.