Personal data is, in nature, of different sensitivity. For instance, social security number, has a higher level of sensitivity than say an address. You add levels that suits your organizations data structure. The system has no default levels, so these must be added before the GDPR functionality can be up and running.