Data Classification and Sensitivity Handling Questions

Classifying data by sensitivity and applying controls proportionate to that classification: identifying personal, sensitive, and special-category data and tagging it through its lifecycle. Covers classification schemes, labeling, and how classification drives access, encryption, and retention decisions. Includes assessing the impact of a given data type on privacy and security risk.

MediumSystem Design

28 practiced

Design an approach to implement automated data classification in a hybrid environment consisting of on-prem relational databases, file servers, and multi-cloud object storage. Describe components, scanning and labeling techniques, integration points with IAM, DLP, KMS, propagation of metadata, handling of false positives, and operational rollout steps.

Sample Answer

**Clarify goals & constraints**- Classify sensitive data (PII, PHI, IP) across on‑prem RDBMS, file shares, and multi‑cloud object stores with automated labeling, integration into DLP/IAM/KMS, low performance impact, and auditable provenance.

**High‑level architecture / components**- Scanner fleet: lightweight agents for on‑prem, serverless scanners for cloud, central orchestration service.- Classification engine: rules + ML models (NER, regex, entropy) hosted centrally.- Metadata catalog: centralized metadata store (object tags, DB columns, CMDB entries).- Integration layers: connectors to IAM, DLP, KMS, SIEM, ticketing.- Policy manager & UI for exceptions/feedback.

**Scanning & labeling techniques**- Use hybrid approach: deterministic (regex, dictionary, checksum) + probabilistic ML (NER, contextual embeddings) per data type.- DBs: column profiling using JDBC with sampling, schema inference.- File servers: content and filename scanning, hash-based de‑duplication.- Object stores: event-driven scans on PUT + periodic full scans.

**IAM / DLP / KMS integrations**- IAM: map sensitivity to roles/attributes for fine‑grained access controls (ABAC). Push tags into IAM policies.- DLP: feed labels and confidence scores to enforce blocking/alerting workflows.- KMS: auto‑apply encryption scopes (envelope encryption) based on classifications; rotate/bring‑your‑own keys for high sensitivity.

**Metadata propagation & provenance**- Write labels as immutable metadata: object tags, DB extended properties, file system ACL attributes, and catalog entries.- Store provenance (scanner id, rule/model, confidence, timestamp) in catalog for audit.

**False positives & feedback loop**- Provide analyst UI for review and correction; store labeled ground truth to retrain models.- Confidence thresholds with quarantine workflows; human review for high‑impact actions.- Rate limit enforcement to avoid operational disruption.

**Operational rollout**1. Pilot on low‑risk dataset; validate detection & FP rates.2. Tune rules/models; integrate with DLP and KMS in monitor mode.3. Phased expansion by business unit; add automation for enforcement gradually.4. Full production: enforce policies, continuous monitoring, periodic retraining, compliance reporting.

**Trade‑offs**- Sampling vs full scan (cost/perf), deterministic vs ML (explainability), on‑agent vs network scanning (coverage vs latency).

EasyTechnical

31 practiced

Define data classification and describe how you would integrate a data classification scheme into an enterprise architecture. Include who should own classifications, how classifications map to controls (e.g., encryption, retention, access policies), enforcement points across services (APIs, storage, messaging), and how to handle reclassification and exceptions.

Unlock Full Question Bank

Get access to hundreds of Data Classification and Sensitivity Handling interview questions and detailed answers.

Join thousands of developers preparing for their dream job.