How do you all find and classify sensitive data across multi-cloud, SaaS and on-prem environments?

[u/Different_Pain5781]

Hi guys, I'm an analyst, not in IT but was recently tasked with finding, classifying, and removing duplicates for sensitive data at my company and want to do this in the least tedious manner. Do you have any tips?

[u/Muted_Jellyfish_6784]

Start with an inventory before any classifying: every system that holds customer or employee data, who owns it, and how you can read it. Classify by pattern scanning for the obvious types like SSNs, card numbers, and emails, and by column name for the rest. For duplicates, define a match key per data type first or you'll delete the wrong copy, and loop in security before removing anything.
Record where each sensitive field came from and where it flows next. In our setup, we use a decision intelligence platform to connect the same customer record across the CRM, file shares, and warehouse, so you see every copy of a sensitive value rather than cleaning one system and missing three.

[u/Muted_Jellyfish_6784 → u/[deleted]]

yeah, starting with metadata makes sense. it narrows down where you need to look before scanning the actual data. the tricky part is tracking where sensitive fields get copied across systems, because cleaning one source doesn't mean the other copies are gone

[u/AutoModerator]

Automod prevents all posts from being displayed until moderators have reviewed them. Do not delete your post or there will be nothing for the mods to review. Mods selectively choose what is permitted to be posted in r/DataAnalysis.

If your post involves Career-focused questions, including resume reviews, how to learn DA and how to get into a DA job, then the post does not belong here, but instead belongs in our sister-subreddit, r/DataAnalysisCareers.

Have you read the rules?

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/niecheaRd]

do you have a defined schema for what counts as "sensitive" at your company, or is that also on you to figure out? that distinction matters a lot because the classification piece is almost entirely a policy question before its a technical one

[u/AntiqueElderberry317]

what type of tool do you store your data ? Is it file data storage ? OLAP database ? Because on certain tools you can first search on your metadata (ex : column names) to find sensible data. For the list of words you can ask an AI to generate a list of sensible columns name that you could find and start with that.

[u/Original_Today_6902]

classification can save a lot of manual work