Data Discovery & Classification

SL-04

The hub every other module consumes. Find personal data wherever it lives, classify it, bind it to a consent and a purpose, and let that binding drive retention, enforcement and rights fulfilment everywhere else.

DischargesS.4 S.8(7)R.8 S.9

Data sources

2 sources are not being scanned

Legacy Pension Archive (Tape) · Skill Development Portal (connector error). An unscanned source is a blind spot in every downstream module — rights requests, breach impact assessments and retention all inherit the gap.

2 scans running

Live progress across connected sources.

All scans

AI Assistant Knowledge Base62% · 1.14 L objects

Field Officer Endpoints18% · 33.1 K objects

Personal data elements

230

View

Children's data

Verifiable guardian consent required

Not accessed in over a year

Regulatory classification

What the Act treats each element as.

230elements

Personal data124
High-risk personal data57
Children's personal data38
Employee personal data11

Consent binding

Every element must trace to consent or a legitimate use. Anything else is processing without a ground.

Consent expired25
Active consent108
Legitimate use43
No basis recorded30
Consent withdrawn24

Highest-risk repositories

By composite risk score.

All

CriticalSkill Development Portal39 elements · 190 GB95 CriticalFamily ID Core Registry214 elements · 4.1 TB93 CriticalAnalytics Data Lake203 elements · 23.4 TB93 CriticalHealth Card Registry112 elements · 640 GB91 CriticalPension Disbursement Ledger78 elements · 1.2 TB85 CriticalGrievance Case Management64 elements · 420 GB83

Personal data by source type

Unstructured sources — file shares, email, collaboration, document stores — routinely hold more children's data than the databases anyone thinks to look at first.

Where discovery output goes

Data Loss PreventionPolicies evaluate classification and consent state rather than static patterns, which is what turns blind blocking into precision enforcement.Database Activity MonitoringColumn-level sensitivity drives alert severity, so a mass read on a classified table outranks a mass read on a lookup table.AI Processing GuardGuardrails know which data exists, its consent scope, and whether it may be used in AI processing at all.Breach impact assessmentIdentifying affected Data Principals within hours instead of days depends entirely on the coverage of this module.

Coverage

Connected sources

Scanning now

Errored

Never scanned

Last completed scan 2 days ago. Weekly dashboard refresh SLA: first scan within 10 weeks of work order