Understand the data before choosing a control
Personal data can identify someone directly or indirectly. Article 9 adds conditions for categories such as health, genetic information, qualifying biometric information and beliefs. Criminal conviction and offence data have a separate regime under Article 10. A business-sensitive file is not automatically an Article 9 record, and an ordinary identifier still needs protection.
Build a discovery workflow around business context
Start with one process, such as employee onboarding or customer support. List the systems used, the people who can access them and the expected sharing destinations. Include working copies, exports and attachments rather than reviewing only the main database.
For each candidate finding, check whether it relates to a person, whether the processing is necessary and whether the location is approved. Assign a data owner to resolve ambiguous results. Test representative documents before applying broad enforcement. This workflow is a practical implementation suggestion, not a detection method prescribed by the GDPR.
Make classification useful to the people handling data
Keep ordinary personal data, special-category data, criminal-record data and confidential business information distinguishable in your internal classification model. A payroll spreadsheet and a medical attachment may need different access and handling decisions even when both contain names.
Use labels to drive documented choices about access, retention and sharing. Validate both missed detections and false positives. Avoid collecting extra personal information merely to make the classification system more detailed.
Connect findings to security and incident assessment
The GDPR calls for security measures appropriate to the risk. A discovery result should therefore trigger an assessment rather than an automatic conclusion that a breach occurred. Review what was exposed, to whom, for how long and what protections applied.
Sources: [3]
Keep the notification decision separate from the alert
Where required, a controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of awareness. The exception concerns breaches unlikely to create a risk to individuals. A processor informs the controller without undue delay. Record the assessment even when notification is not required; an alert timestamp alone does not determine the legal outcome.
Sources: [4]
Practical checklist
- Define the processing purpose, data owner and approved locations.
- Test discovery with representative personal-data samples and document limitations.
- Review access, sharing destinations and unnecessary copies.
- Assign an incident decision owner and retain the reasoning behind notification decisions.
Applying this with TRIAS
Evaluate TRIAS data discovery and classification against your approved data categories, then connect the results to DLP policies for the channels in your deployment. Confirm detection coverage with a proof of concept; a policy match does not establish a lawful basis or complete GDPR compliance.
Official sources
Last checked: . Practical examples are editorial implementation suggestions. Applicability depends on your organisation and jurisdiction.