The same problem wearing four different job titles.
A records clerk, a privacy officer, a compliance lead and a managing partner will describe entirely different pressures to you.
Underneath each account sits one question: where did the data go, and who can still reach it.
Public sector
Municipalities, provincial and state bodies, school boards and agencies. Records accumulate across decades and systems bought a decade apart, and much of the oldest material was scanned rather than typed.
Access requests arrive on a statutory clock. Answering them from staff memory works until the person who remembers leaves.
| Pressure | What changes |
|---|---|
| Access to information requests | Searched against an index instead of a filing cabinet, with the source path attached to every hit |
| Statutory security programs | An inventory that exists before the reporting obligation does |
| Scanned archives | Optical character recognition brings paper records into the same search |
| Residency policy | Deployment kept inside the jurisdiction the policy names |
Healthcare
Health information rarely stays inside the clinical system. It ends up in referral letters, intake forms, scanned consent, and mailboxes belonging to people who left.
Identifier formats are region specific, so detection has to know what a provincial health number looks like alongside a US medical record number.
Financial services
Banks, credit unions, insurers and fintech firms carry the heaviest identifier load: card numbers, account numbers, and financial values scattered across exports that were meant to be temporary.
Scope reduction is the practical win. Every system proven clear of cardholder data is a system that leaves the assessment.
| Detected by default | Coverage |
|---|---|
| Payment cards | American Express, China Union Pay, Diners Club, Discover, JCB, Laser, Maestro, Mastercard, Visa |
| Financial fields | CVV, PIN, stored passwords |
| Currency values | Recognized as monetary amounts rather than plain numbers |
| National identifiers | Regional formats across the three markets |
- Matter files
- Client material spread across shared drives after a merger or a migration
- Departed staff
- Mailboxes and personal folders nobody has audited since handover
- Retention
- Files held past their purpose, found and dealt with under policy
- Client assurance
- A defensible answer when a client asks how their material is protected
Legal and professional services
Confidentiality is the product. The exposure tends to sit in the least glamorous places: an old matter folder, a scanned engagement letter, an export from a system that was replaced two years ago.
Triggers that start an engagement
| Use case | Starting point | What good looks like |
|---|---|---|
| Access and subject requests | A request arrived with a deadline attached | Every matching record found, with its source path, inside an afternoon |
| Audit readiness | An assessment is scheduled | Inventory, classification coverage and action history already documented |
| Legacy cleanup | Storage growth, or a migration exposed old shares | Duplicates and expired records removed under owner approval |
| Cardholder scope reduction | Assessment scope is larger than it should be | Systems proven clear, then taken out of scope |
| Post-incident review | Something was exposed and the question is how much | A defensible statement of what the affected system held |
| Merger or divestment | Data is moving between organizations | What is being handed over, identified before it moves |
Bring the version of this you are living with
The sector matters less than the trigger. Describe what prompted the search and we will scope a session against a system that represents the problem.