The ‘datafolder’ contains information that should not be accessible for end users.
These would be log files, packages, search indexes, diagnostics and etc.
Sitecore best practices recommends placing the ‘DATA’ folder outside of the webroot so these files won’t be served by IIS.
To set your dataFolder open the web.config and find the following line:
<sc.variable name="dataFolder" value="/Data" />
On the ‘value’ attribute put the path where you want your dataFolder to be located (this could be an absolute file system path or a site relative path).
*Keep in mind that if you have different environments such as DEV, QA and PROD you will need to have distinct ‘dataFolder’s to each environments.