Protecting sensitive data starts with knowing where the copies are

Controls are usually designed around the primary database, because that is where the data is understood to live. It is rarely where the exposure is.

The security posture of sensitive data is the posture of its least protected copy. Encryption on the production database is worth very little if the same records sit unencrypted in an analytics tool, a support system, a staging environment and a spreadsheet somebody exported in 2024.

Finding those copies is one of the more productive parts of an it audit services engagement, and it is usually faster than people expect.

Where the copies actually are

Six places, and the last three are the ones that get missed.

Replicas and warehouses. Deliberate copies for reporting. Usually secured to a lower standard than production, because they are seen as derived rather than real.

Backups. By design, complete. Retention means a record deleted from production still exists in backup for the retention period, which matters for deletion obligations as much as for security.

Support and CRM tools. Staff paste records into tickets to diagnose problems. Free-text fields accumulate anything at all, and nobody is auditing what.

Analytics. Event payloads carry more than intended. An identifier plus an email address plus a page path is often enough to reconstruct something sensitive.

Non-production environments. Loaded with a production copy for realism, protected as a development system, accessible to contractors.

Local machines. An export for a board pack, a CSV for a migration, a screenshot in a chat thread. This one cannot be solved technically and has to be solved by not needing exports.

Finding them, cheaply

Follow one real record rather than surveying systems.

Take a single customer, and find every place their data exists. It takes an afternoon and it reliably surfaces two or three copies nobody in the room knew about. It works because it follows what the system does rather than what the documentation says it does.

Do it again with a record that was deleted six months ago. That second pass tells you whether deletion actually propagates, which is the question that matters legally and the one most systems fail.

The controls in order of return

Stop making copies you do not need. The cheapest protection is absence. An analytics event that carries an identifier instead of an email address removes a copy permanently.

Mask non-production data. Realistic, not real. This is a day of work that removes a whole category of exposure, and it is the highest-return item on this list for most organisations.

Restrict export. Most exposure through local machines starts with a legitimate export. Making the common cases unnecessary — a report in the product rather than a spreadsheet — removes the motive rather than policing the act.

Apply retention automatically. Manual deletion is not applied. A stated period per data category, enforced by a job, is the only version that holds.

Encrypt, and know what that covers. Encryption at rest protects against a stolen disk. It does nothing against a compromised application account, which is the more likely event. Worth having, worth not over-claiming.

Classification, kept simple

Elaborate schemes with five tiers get ignored. Two categories are enough for most organisations: data that would require notifying someone if it leaked, and everything else.

That single distinction drives every decision above — where it may be copied, how long it is kept, who may export it — and it can be applied by people who do not work in security.

The conversation that removes most of the risk

Ask, per data field, why it is collected. A surprising proportion of sensitive data is held because a form asked for it once and nobody revisited the decision.

Fields that serve no current purpose can be dropped from collection and purged from history, which removes every copy at once — the primary, the replicas, the warehouse, the backups after retention. No control is as effective as not having the data, and no other measure protects the copies you have not found.

This is a product conversation rather than a security one, which is why it rarely happens. It is also the highest-return item available.

What this does not address

It does not address a compromised account with legitimate access. Every control above governs where data sits and who may reach it; none of them distinguishes an authorised user from someone using that user’s credentials. That is the detection problem, and it is a different discipline.

It also does not make you compliant with any particular regime. Knowing where the copies are is a precondition for almost every obligation, and it is not itself an obligation met. What your jurisdiction requires is a question for a lawyer, and I would not guess at it.

Related reading: information security covers the wider control set and what can honestly be claimed, compliance information covers the records these controls have to produce, and information systems covers building the inventory that all of this is applied per-system.