In a scenario where you are managing a data catalog for a research institution that handles sensitive data, what specific considerations would you need to take into account regarding data classification and metadata to ensure data privacy and security?