The trigger matters more than the sector
A records clerk, a privacy officer, a compliance lead and a managing partner will describe entirely different pressures to you. Underneath each account sits one question, which is where the data went and who can still reach it.
Four sectors, one underlying problem
| Sector | What creates the pressure | Where the exposure sits |
|---|---|---|
| Public sector | Access to information requests on a statutory clock, and provincial security programs | Decades of records across systems bought years apart, much of it scanned rather than typed |
| Healthcare | PHIPA and HIPAA limits on who reaches health information | Referral letters, intake forms, scanned consent, and mailboxes belonging to people who left |
| Financial services | PCI DSS assessment scope, GLBA safeguards, audit findings | Card and account numbers inside exports that were meant to be temporary |
| Legal and professional | Client confidentiality obligations and security questionnaires | Old matter folders, scanned engagement letters, systems replaced two years ago |
Municipalities, agencies and school boards
Records accumulate across decades and across systems bought a decade apart. Much of the oldest material was scanned rather than typed, which puts it outside the reach of anything that searches text alone.
Access requests arrive on a statutory clock. Answering them from staff memory works right up until the person who remembers leaves.
| Pressure | What changes |
|---|---|
| Access to information requests | Searched against an index, with the source path attached to every hit |
| Statutory security programs | An inventory that exists before the reporting obligation does |
| Scanned archives | Optical character recognition brings paper records into the same search |
| Residency policy | Deployment kept inside the jurisdiction the policy names |
Health information rarely stays in the clinical system
It ends up in referral letters, intake forms, scanned consent, and mailboxes belonging to people who left the organization years ago. Identifier formats are region specific, so detection has to know what a provincial health number looks like alongside a United States medical record number.
A provincial health number and a social insurance number sitting together in the same scanned PDF is the finding that starts most healthcare engagements.
Banks, credit unions, insurers and fintech firms
These accounts carry the heaviest identifier load. Scope reduction is the practical win, since every system proven clear of cardholder data is a system that leaves the assessment.
Payment cards
American Express, China Union Pay, Diners Club, Discover, JCB, Laser, Maestro, Mastercard, Visa
Financial fields
CVV, PIN, stored passwords
Currency values
Recognized as monetary amounts rather than plain numbers, which keeps the false positive rate down.
National identifiers
Regional formats across all three markets, shipped by default rather than configured.
Legal and professional services
Confidentiality is the product, and the exposure sits in the least glamorous places.
Matter files
Client material spread across shared drives after a merger or a migration.
Departed staff
Mailboxes and personal folders nobody has audited since handover.
Retention
Files held past their purpose, found and dealt with under policy.
Client assurance
A defensible answer when a client asks how their material is protected.
Six situations that start an engagement
Almost nobody buys discovery software on a Tuesday for no reason. Something happened first.
| Use case | Starting point | What good looks like |
|---|---|---|
| Access and subject requests | A request arrived with a deadline attached | Every matching record found, with its source path, inside an afternoon |
| Audit readiness | An assessment is scheduled | Inventory, classification coverage and action history already documented |
| Legacy cleanup | Storage growth, or a migration exposed old shares | Duplicates and expired records removed under owner approval |
| Cardholder scope reduction | Assessment scope is larger than it should be | Systems proven clear, then taken out of scope |
| Post-incident review | Something was exposed and the question is how much | A defensible statement of what the affected system held |
| Merger or divestment | Data is moving between organizations | What is being handed over, identified before it moves |
Bring the version of this you are living with
Describe what prompted the search and we scope a session against a system that represents the problem.