Technology
Most organizations miss 6-13% of sensitive data. Here's how to find it.
Data privacy regulations now demand you know where personal information lives—and prove you're protecting it. A systematic approach to data discovery, classification, and governance closes the gap between compliance requirements and operational reality.
Organizations achieve compliance through three interconnected layers: discovering where sensitive data actually lives across systems, classifying it by risk and regulatory obligation, and building controls (encryption, access limits, audit trails) that work automatically rather than requiring manual enforcement. The gap between world-class and average teams lies not in effort but in systematizing these activities so they happen continuously, not during crises or annual audits.
How performance compares
| Metric | Minimum | Strong | World-class |
|---|---|---|---|
| Customer Record Accuracy ScoreThe proportion of customer records that remain accurate and uncontradicted when validated against authoritative sources or transactional activity. | 80-86% | 86-93% | 93-98% |
| Customer Data Privacy Compliance RateThe percentage of customer records managed in documented compliance with applicable regulatory privacy requirements, including consent tracking and retention policies. | 78-87% | 87-94% | 94-99% |
The spread from minimum to world-class on Customer Record Accuracy Score (80-86% to 93-98%) reflects the difference between organizations that manually track sensitive data and those with automated validation cycles and clear stewardship accountability. On Customer Data Privacy Compliance Rate, minimum-tier organizations (78-87%) typically discover compliance gaps during external audits or after incidents; strong performers (87-94%) run regular internal control audits; world-class teams (94-99%) integrate compliance checking into operational workflows so violations become visible before they become problems.
Industry-Specific Benchmarks
These ranges are cross-industry. The figures differ materially by sector and company size.
Find benchmarks for your industry →Why the gap exists
The transition from minimum to strong performance requires three operational shifts. First, moving from reactive compliance (responding to audit findings) to proactive discovery: running systematic scans across databases, applications, cloud storage, and third-party systems to identify where personal data actually resides, not just where you think it is. Second, automating data classification so new sensitive data is tagged at ingestion rather than discovered months later during a compliance review. Third, embedding accountability: assigning explicit ownership for each data asset so someone is responsible for its protection, not just aware of it.
World-class organizations go further. They maintain continuous discovery—new systems and data flows are inventoried within days, not months. They model the financial impact of non-compliance (both fines and incident costs) so privacy investments compete on equal footing with other capital asks. They extend governance beyond their own systems to third-party vendors and partners, recognizing that a data breach at a processor carries the same regulatory and reputational cost as one at your own facility. Most critically, they instrument their controls so compliance status is measurable and visible to leadership in near-real time, rather than requiring a dedicated compliance team to aggregate findings quarterly.
The organizational pattern differs by company size. Smaller organizations often outperform larger ones at discovery because their systems are less complex; they struggle instead with keeping controls current as data volumes grow. Larger organizations can invest in specialized tools and teams but risk compartmentalization where security, privacy, legal, and data teams operate independently. The consistent differentiator is whether data governance is treated as a technology and process problem (with executive ownership) or as a compliance checkbox delegated to legal.
Proven approaches
Build Privacy Into System Design, Not Around It
Most organizations treat data privacy as a constraint applied after systems are built—a checklist of encryption settings and access policies bolted on when regulations demand it. This approach creates constant friction: systems designed without privacy in mind generate unnecessary data, disperse it across platforms, and make it harder to honor requests like data deletion or portability when someone asks.
Privacy by design inverts this. It starts with the question: what data do we actually need to achieve this business outcome, and how do we minimize collection, retention, and access? A payment processor doesn't need to store full credit card numbers if tokenization works. A marketing system doesn't need year-long browsing history if weekly summaries serve the same segmentation purpose. When these decisions are made at architecture time, they become cheap to implement; retrofitting them is expensive and incomplete.
The mechanism works through concrete practices: data minimization is a requirement in the design review, not a suggestion. Retention policies are set at ingestion—you define when data expires before you collect it. Encryption is default, not optional. Access controls follow the principle of least privilege: people see only the data they need for their specific function, not "their department's data." When an audit uncovers a compliance gap, it's caught by automated detection, not by manual review. Organizations adopting this approach report that the cost of compliance actually drops once the initial systems are redesigned, because governance becomes a natural part of operations rather than a separate function.
Leading Practice Report
Full detail: Data Privacy and Compliance Management
The full report covers:
- Expected benefits
- Core principles
- Key success factors
- Key metrics
- Risks and mitigations
- Implementation roadmap
Inventory Data the Way You Inventory Assets
Organizations typically know their major systems (CRM, ERP, data warehouse) but not where sensitive data actually lives. It accumulates in backup databases, shared folders, data lakes, third-party SaaS applications, and spreadsheets. A customer email address might appear in seven systems, and no one has a reliable map of all seven. When a customer requests deletion under GDPR, you cannot fully comply because you do not know where all their data is.
Data discovery—the systematic cataloging of where sensitive information lives—is foundational. This is not a one-time audit; it's an ongoing inventory similar to how organizations track physical assets or software licenses. The most effective approach combines automated scanning (database profilers, content discovery tools, and cloud storage scans that flag patterns like email addresses and phone numbers) with human curation. Automation finds the obvious cases; curation handles context. The tool flags a column named "customer_contact," but a human has to determine whether it contains sensitive data in this specific business context.
The output is a data asset register: for each system, database, and file store, you document what sensitive data it contains, who accesses it, where it flows next, and what controls protect it. This register becomes the foundation for compliance. Regulatory requests move faster because you know where to look. Audit findings point to this register as evidence you understand your own data landscape. New employees use it to learn where they can and cannot access data. Organizations that mature this practice find they can map the complete journey of a customer record across their enterprise—and identify the gaps in protection along the way.
Leading Practice Report
Full detail: Data Privacy and Compliance Management
Benefits, core principles, success factors, metrics, risks and the implementation roadmap.
Get the full report →Classify Data by Risk, Not Just by Type
Calling something "personal data" is a legal classification, but it does not tell you how to protect it. An email address flagged in a contact list has different risk than the same email address paired with full browsing history. A home address matters more than a work postal code. Sensitive data exists in tiers—regulatory requirements differ, financial exposure differs, customer harm differs—and your controls should reflect that.
Risk-based classification assigns sensitivity levels based on what harm could result if the data were exposed. A four-tier system is typical: public (already published information, no compliance risk), internal-use (operational data, modest exposure risk), confidential (personal or regulated data requiring encryption and access controls), and restricted (highly sensitive categories like financial account numbers or health information with legal liability). Data changes classification as it flows through systems: raw customer data is restricted, anonymized aggregates of the same data may be internal-use.
This classification becomes the trigger for controls. Restricted data must be encrypted at rest and in transit, accessible only with multi-factor authentication, and audited. Confidential data requires encryption and regular access reviews. Internal-use data requires basic access controls. This proportional approach lets you invest protection effort where it matters. It also makes compliance audits concrete: you can show a regulator not just that you encrypted data, but that you encrypted it specifically because you classified it as restricted and applied controls matching its risk tier. Organizations that skip this step often apply either too little protection (treating all personal data the same, some under-protected) or too much (encrypting everything, creating performance and operational overhead that discourages actual use of the governance system).
Leading Practice Report
Full detail: Data Privacy and Compliance Management
Benefits, core principles, success factors, metrics, risks and the implementation roadmap.
Get the full report →First steps
- Audit one critical system (your primary CRM or customer database) to manually document what sensitive data it contains and who accesses it. This usually takes one week and creates the benchmark for automated discovery tools.
- Map the journey of one customer record through your systems: from capture through marketing, operations, support, and eventual deletion or anonymization. Identify where controls exist and where gaps appear.
- Establish a data classification framework (public, internal, confidential, restricted) and apply it to your top 10 data assets. This clarifies which systems need the most protection investment.
Ask Kepler about the assessment roadmap for data governance, or how to determine which systems should be your first discovery targets.
Start free with Ask Kepler →Advanced and emerging approaches
Advanced & Emerging Practices
Emerging practices are included with Ask Kepler Pro and Max.
Unlock these practices →Curious how Ask Kepler Research is produced? Read our research methodology.
Performance Playbook
Customer Data Management: Five metrics that define reliable customer data
Customer data quality, accuracy, and security directly control whether your organization can trust its customer insights and operate compliantly. Learn what world-class looks like on each dimension, where most organizati
Open the playbook →