Identify sensitive data

DCT Compliance identifies sensitive data by analyzing the structure and contents of connected data sources. It uses data classes, classifiers, and discovery policies to detect and categorize sensitive information.

Data classifiers apply detection logic—such as pattern matching, data type analysis, or dictionary matching—to analyze data values and identify potential sensitive data. When a classifier detects a match, the corresponding data class is assigned to the column.

Data classes represent specific types of sensitive information, such as email addresses, phone numbers, or financial identifiers. These classifications help determine how the data should be protected during masking operations.

Discovery policies define which classifiers are used during discovery. By grouping classifiers into policies, you can control how sensitive data detection is performed across different data sources.

Data Control Tower includes several built-in objects that are provided out of the box with the product, including Data Classes, Data Classifiers, and Discovery Policies. These built-in objects are system-defined and cannot be edited or deleted. You can create and manage custom objects as needed.

The discovery workflow typically follows these steps:

  1. Configure data classifiers that detect patterns of sensitive data.

  2. Create or select a discovery policy that determines which classifiers are used during discovery.

  3. Run a discovery job to analyze tables and assign data classes to detected columns.

After sensitive data has been identified, masking rules and algorithms can be configured to protect the detected data.