Appropriate data classification is a key anchor in ensuring that data handling practices in organisations are compliant with data privacy regulations. Data classification is one of many organisational and technical measures (TOMs) obligated by regulations to reduce the risks of privacy violations and data breaches. To this end, this paper aims to provide a data classification and taxonomy reference model that digital marketplaces can utilise to understand and categorise their data to ensure that their data handling practices are compliant with data privacy regulations. A qualitative study was undertaken on three digital marketplaces in South Africa to develop a privacy-aware data classification and taxonomy reference model built on the foundations of the ISO 27002 standard. The reference model is then overlaid with privacy requirements and how to ensure its effective handling, producing a privacy-aware compliance framework. Clearly defining data classifications and their implications allows the digital marketplaces to be more transparent with users about what data is collected and how it is used and the levels of protection applied.