阅读中文版本

PII Discovery and Classification Workflow

Scan data stores for personally identifiable patterns, classify and tag columns, review hits with owners, and drive protection and retention from the classification.

Overview

Find and classify PII across stores so protection, access, and retention controls can be applied where needed. Confirm owners have reviewed all high-sensitivity findings and that protection controls are actually applied to the tagged columns.

Steps

1. Inventory data stores and scan them for PII patterns. Expected state: Candidate PII locations are identified.
2. Review findings with data owners to confirm and classify. Expected state: False positives are removed and sensitivity is set.
3. Tag the confirmed fields and apply protection baselines. Expected state: Classified data gets masking or encryption as required.
4. Feed the classification into retention and access reviews. Expected state: Protection is enforced, not just documented.

-- example PII pattern probe (run on a masked copy)
SELECT column_name
FROM information_schema.columns
WHERE column_name ~* '(email|ssn|phone|dob|passport)';

Verification

• A reviewed PII inventory with classified fields, applied protection baselines, and retention driven by the classification.

Decision points

• Automate classification or rely on owners? Options: Scanner plus owner review; Scanner only. Recommended: Scanner alone produces false positives that erode trust; owner review is required for high sensitivity.
• Scan production or a copy? Options: A masked copy; Production directly. Recommended: Prefer a masked copy to avoid exposing PII to the scanning infrastructure.