# Sensitive-data discovery checklist

PrivacyBuilt Editorial

A working starting point for global organisations. Adapt to the processing, role and relevant law; this is educational guidance, not legal advice or a compliance determination.

- [ ] Define discovery objectives, boundaries and accountable owners.
- [ ] Agree sensitive-data categories and context-specific classification rules.
- [ ] Inventory in-scope repositories, systems and environments.
- [ ] Arrange authorised access and separate tool licensing where needed.
- [ ] Choose proportionate discovery methods, exclusions and sampling.
- [ ] Validate findings for false positives and missing coverage.
- [ ] Assess exposure using sensitivity, access, sharing and retention context.
- [ ] Assign remediation actions and owners without unnecessary data copying.
- [ ] Document evidence, scope limitations and remediation validation.
- [ ] Set rediscovery cadence and change-driven review triggers.

## Review record

Owner:
Scope:
Evidence references:
Open questions:
Decision and conditions:
Next review:

Avoid entering personal data, credentials or confidential source material in public tools.