Sensitive Data

Sensitive data is a broad group. A customer record, a patient file, a card number, and a product design all need protection, even though they share little else. What they have in common is that exposure can harm a person or an organization through legal, financial, or reputational consequences.

The concept covers structured records in databases and logs, and also unstructured content such as documents, spreadsheets, and chat messages. Before a company can protect such data, it needs to know what counts as sensitive in its own environment, which is the job of data classification.

Sensitive data is usually grouped into recognized categories. Personal data, for example, identifies a specific person, either directly or when combined with other data. The table shows the main groups and the rules that most often apply to them.

There is no single universal list of sensitive data. Each framework defines it for its own scope:

Regional and sector laws, such as CCPA and CPRA in California or Brazil's LGPD, add their own definitions. That is why organizations usually keep one internal data inventory mapped to every framework that applies.

• GDPR protects personal data, meaning any information about an identifiable person. Article 9 special categories need extra justification before processing.
• HIPAA defines protected health information as health data created or handled by a covered entity in any form: electronic, paper, or oral.
• PCI DSS focuses on cardholder data. After authorization, it prohibits storing sensitive authentication data such as full track data, CVV, and PIN.

Detection tools combine several methods, and each one has a different strength:

• Thesauruses: keyword dictionaries for a topic, such as credit card terms or financial vocabulary.
• Patterns: regular expressions that match identifiers, such as bank account numbers, ZIP codes, or the format of the US Social Security number.
• Digital fingerprints and hash banks: exact copies and templates of known documents.
• Sensitivity labels: content that already carries a Microsoft sensitivity label.

Definitions vary by framework, and sensitive content is scattered across systems. Loss of control brings regulatory penalties, breach-notification duties, and reputational damage, so the practical first step is discovery and classification. Sensitive data is the central object of data loss prevention (DLP), which can only protect what it can find.

1. 1

   Discover

   Find where sensitive data resides across your systems, endpoints, and cloud services.

2. 2

   Classify

   Label the data so its sensitivity is clear to people and tools.

3. 3

   Apply controls

   Set protection in proportion to each category's sensitivity, starting with the most exposed channels.

In Anexet DLP, the Objects of analysis tab holds the building blocks of detection. The first frame shows the built-in keyword dictionaries, and the second shows the regular expressions for identifiers with a fixed format. Administrators select them when they build a blocking rule.

1 / 2

• 
• 

Most detection projects fail in the same way: they start with rules instead of a clear list of what must be protected. A dictionary that matches every payroll mention, or a pattern that matches any nine-digit number, floods the queue with false alarms, and staff quickly learn to ignore them.

• Writing rules before a data inventory exists, so the most sensitive stores stay uncovered.
• One keyword list for every department, which blocks normal work.
• Treating a label as proof: it can be missing, wrong, or never applied to copied files.
• Checking only email while ignoring cloud storage, messengers, and removable media, where a data leak can start unnoticed.

Start with the data that would hurt most if it left the company, then the channels it actually travels through. Rules written for every file at once block legitimate work and end up switched off. A narrow first policy that people accept is worth more than a broad one that is disabled after a week.

Further reading: Access Audit to sensitive data and Discretionary Access Control; Top 5 types of data that competitors try to steal.