Why does an organisation need to know where personal data is stored?
Almost every obligation under data protection law presupposes this knowledge. The record of processing activities (Art. 12 FADP, Art. 30 GDPR) describes which data is processed where. A response to an access request (Art. 25 FADP, Art. 15 GDPR) must cover all of a person's data. And personal data must be deleted or anonymised as soon as it is no longer needed for its purpose (Art. 6 para. 4 FADP, Art. 5 para. 1 let. e GDPR).
Looking only at the known systems means overlooking copies, exports and old storage locations. That is often exactly where the most sensitive data lies – and the greatest risks in the event of a data breach.
Where is personal data typically stored?
In legacy IT landscapes, personal data is not stored only in business applications:
- Business applications and their databases, for example for customers, contracts, HR or cases.
- File storage with exports, lists, spreadsheets and scanned documents.
- Mailboxes in which documents are passed back and forth as attachments.
- SharePoint, OneDrive and Teams – often shared more widely than intended.
- Test and analytics environments with copies of production data.
- AI services: prompts, chat histories and meeting transcripts.
Which information counts as personal data?
Personal data is not just names. Identifiers that can be used to identify a person are also included. An overview:
| Type | Examples |
|---|---|
| Identifiers | AHV number (Swiss social security number), IBAN, ID document, insurance, customer and policy number |
| Person and contact | Name, address, date of birth, email address, phone number, employee number |
| Sensitive personal data (Art. 5 let. c FADP) | Health, religious, ideological or political views, trade union, intimate sphere, ethnicity, genetic data, biometric data that uniquely identifies a person, administrative and criminal proceedings and sanctions, social assistance measures |
The GDPR has a similar list known as “special categories of personal data” (Art. 9 GDPR).
How do you find personal data reliably?
A search only becomes reliable when several methods are combined. Rules detect identifiers with a fixed structure, such as the AHV number or an IBAN. Free-text detection finds names and addresses. Text recognition makes scanned documents searchable. Custom search patterns add whatever is specific to your organisation, such as customer or contract numbers.
Handling the results is just as important: false positives must be permanently suppressible, and repeated scans should show what has been added and what has disappeared. And because the search reads the content, it belongs in your own environment – the data should not leave your premises for it.
Data Discovery: what a scanner must deliver
There are many tools for data discovery and classification. For data protection, these points matter most:
- Breadth of sources: file storage, databases and Microsoft 365, not just a single system.
- Swiss and European identifiers, not just American ones.
- Read-only: nothing is changed in the sources.
- Store findings, not content.
- Confirm findings or suppress them as false positives – and retain the decision in the next run.
- Reuse findings: for the register, for access requests and for deletion.