Techniques are described for applying data usage policies through data tagging. A metadata tag may be applied to data to indicate a type of the data. In some cases, the tag may be applied to the data when the data is decrypted, and the tag may propagate with the data as the data is passed between processes. A software module may include control logic that is configured to apply data usage policies based on the type tag of data. When the software module attempts an action on the data, such as storing or communicating the data, the control logic may access policy information. Based on the policy information, the control logic may allow the action, prevent the action, or allow the action to proceed on a modified version of the data.