Where this offering fits
Data discovery supports a grounded view of where relevant information resides. It is useful when repository inventories and privacy records disagree, or when acquisition and cloud growth have introduced unknown stores. A discovered match is evidence to review; it should not automatically be treated as a confirmed personal-data record or complete coverage.
Architecture and rollout decisions
Choose repositories and data categories for a first scan, with approved credentials and a safe scan window. Use authorised sample content to evaluate identification quality and false positives. Record inaccessible locations, encrypted content and unsupported formats as coverage limits. Validate findings with the repository owner, then decide how they update the privacy inventory or trigger another control. The project should define whether it only reports locations or also performs remediation activities.
An evaluation scenario for this offering
Create an authorised test repository containing known sensitive examples, similar benign material and a deliberately inaccessible folder. Compare the reported findings with this ground truth. Ask the repository owner to correct a false match and confirm how that review affects later scans. The inaccessible location should be reported as a gap, not silently counted as clear. Record the formats and permissions used so the exercise remains reproducible when the discovery scope expands.
Evidence to request for this scope
- Reconcile scanned locations with the expected source inventory so omitted repositories remain visible.
- Confirm the treatment of sampled content and who may inspect potential sensitive matches.
- Demonstrate owner review, correction of a mistaken match and rescanning after an approved source change.