Structured data is information organized in a predefined format of named fields and types, such as rows in a database table or objects in JSON. Because its shape is known, you can validate it, search it, classify it and control access to it far more precisely than free-form files.
What counts as structured, semi-structured and unstructured?
Structured data fits a schema: a customer table with columns for id, name, email and country, each with a type. Semi-structured data carries its own labels but with flexible shape, such as JSON documents or logs. Unstructured data has no fixed fields: documents, chat messages, images, audio and email bodies.
RFC 8259 defines JSON as a lightweight, text-based, language-independent data interchange format and says it defines a small set of formatting rules for the portable representation of structured data. JSON-LD, a W3C specification, builds on it: a JSON-based format to serialize Linked Data, designed to fit into systems that already use JSON.
Real systems mix all three. A support ticket has structured fields such as status and priority and an unstructured body where customers paste whatever they like.
Why does structure help security?
Four reasons.
Validation. When you know the expected type and range of each field, you can reject bad input early. OWASP's input validation guidance says to validate both syntax, meaning the expected type and format, and semantics, meaning whether the value makes sense for the operation, with rules defined for each field.
Classification. A column named national_id is far easier to label and protect than a sentence inside a PDF.
Access control. Databases can restrict access by table, column or row. Free-form files usually have only folder-level permissions.
Monitoring. A query log shows which fields were read. A shared drive shows only that a file was opened.
Why does the unstructured part still matter?
It often holds the most surprising sensitive content. People paste card numbers into chat, attach spreadsheets to email and store exports in personal folders. Discovery for unstructured data relies on pattern matching and sampling, which is less certain than reading a column definition.
NIST's data confidentiality guide, SP 1800-28, treats identifying and protecting assets, including data, as the first step against data breaches. You cannot do that without knowing which of your stores are structured and which are not.
Does validation replace other defenses?
No. OWASP separates validation from the additional defenses needed when using data: parameterized queries for SQL and context-aware output encoding against cross-site scripting. It also says to check authorization separately, because a valid account identifier does not mean the caller may access that account.
A constructed example
A team stores customer records in a table and, separately, exports a nightly CSV for the analytics group. In the table, the email column is flagged personal data and masked for most roles. The CSV lands in a shared folder, unmasked, readable by the whole department, because a file is just a file.
The structured source had fine-grained controls. The unstructured copy lost them. The fix is to produce the export with masking applied at the source, restrict the folder, and record where the copy lives.
How to check or apply this
- Inventory data stores and mark each as structured, semi-structured or unstructured.
- For structured stores, label sensitive columns and apply column or row level controls where available.
- Define a schema for APIs and messages, and validate against it on the server, not just in the client.
- Use parameterized queries and output encoding in addition to validation.
- Track copies and exports: where structured data becomes files, treat the files with the same label.
- Scan unstructured stores with pattern and sampling methods, and review hits by hand before acting.
- Log access at the field or query level for the most sensitive structured stores.
- Revisit the inventory when teams adopt new tools. Each new tool is a new place for copies.
Quick check
Is JSON structured or unstructured data?
Usually described as semi-structured or structured, because fields have names, though the shape can vary. Its text content can still hold unstructured material.
Is structured data safer than unstructured data?
It is easier to control, not automatically safer. Controls must still be applied, and copies in files can lose them.
Sources
- RFC 8259: The JavaScript Object Notation (JSON) Data Interchange Format
- W3C: JSON-LD 1.1
- OWASP Cheat Sheet: Input Validation
- NIST SP 1800-28: Data Confidentiality
Last reviewed: 18 October 2026.
