Behind the scenes: how DataMapper finds sensitive data

The short answer: DataMapper utilises a combination of technologies such as Text Extraction, OCR, Language Detection, Indexing Keywords, ML and LLM to scan files for sensitive content efficiently. It filters out irrelevant data and only presents files that contain actual sensitive information, ensuring GDPR compliance and data security without the guesswork.

Identifying sensitive information across a company’s data landscape is never straightforward—regardless of whether you rely on manual searches or an automated tool. It’s a complex task for a variety of reasons. Here are just a few of the reasons why:

• The volume of data
  Manually reviewing millions of files, emails, attachments, and documents is slow, inconsistent, and nearly impossible to scale. The sheer volume alone makes traditional methods unfit for the task.

• A growing and evolving list of sensitive expressions
  Privacy regulations like GDPR are comprehensive and continuously updated. New risk terms emerge regularly, and each organisation may have its own definition of what’s considered sensitive or business-critical.

• Sensitive data can appear anywhere
  It’s not just buried in text documents—sensitive expressions can be hidden in screenshots, scanned contracts, handwritten notes, or photos of ID cards. Without OCR and automation, every image would have to be reviewed manually, which is both time-consuming and error-prone.

• Context is everything
  A word or number becomes sensitive only when it relates to a person. For example, “COVID” or “Muslim” on their own aren’t necessarily sensitive, but in a sentence like “She was dismissed after revealing she had COVID”, the context makes it sensitive under GDPR.

• Language and format complexity
  Sensitive information can appear in multiple languages and follow different regional formats. A Danish CPR number looks different from a US social security number, and even the same word can carry different meanings depending on the language.

• Technology limitations Scanning complex documents like Excel sheets with multiple rows and columns can be particularly challenging. OCR technology typically reads text vertically, similar to traditional reading patterns, but rows and columns often contain data arranged in ways that don’t align with this vertical scanning logic. Consequently, additional logic and sophisticated processing are necessary to accurately interpret and extract sensitive information from these structured documents

To address these challenges, we have developed DataMapper.

Unlike other search methods that rely on basic keyword matching or rule-based scanning, DataMapper follows a sophisticated, AI-powered process to extract, analyse, and validate sensitive data across millions of documents—not in days or weeks, but in hours or even minutes. Many other data discovery solutions can detect certain types of information using pattern recognition or metadata filtering. However, they often fall short when it comes to image-based content, multilingual data, and understanding context. This leads to missed risks or overwhelming false positives, giving teams more noise than value.

DataMapper takes a different approach—using a combination of advanced technologies to deliver results that are not only fast, but highly accurate. It surfaces only the truly sensitive data buried within millions of documents, cutting through the noise and reducing false positives.

1. Text Extraction
2. Optical Character Recognition (OCR)
3. Language Detection
4. Indexing Keywords
5. Machine Learning (ML) and Regular expressions (RegEX)
6. Large Language Model (LLM)

4. Indexing Keywords

Once the text has been extracted and the language identified, DataMapper creates a complete index of every word and number across all scanned files. This ensures that no term slips through the cracks—every piece of data becomes searchable and measurable against a carefully built taxonomy of sensitive terms. This taxonomy is designed to align with privacy regulations like the GDPR and has been developed in collaboration with legal and compliance experts.

The taxonomy includes 3 categories of sensitive information:

• Personally Identifiable Data (PII) – e.g. name, date of birth, social security number
• Sensitive Personal Data – e.g. health information, trade union membership, sexual orientation
• Business-Critical Terms – e.g. contracts, budgets, intellectual property documents

The taxonomy is used as a predefined vocabulary of risk indicators and is continuously updated as privacy standards evolve.

But identifying keywords alone isn’t enough—we take it a step further by applying machine learning to validate patterns and reduce false positives.

5. Machine Learning (ML) and Regular expressions (RegEX)

Many types of sensitive data follow recognisable patterns. For example:

• A credit card number is always 16 digits long.
• A social security number (SSN) might follow a XXX-XX-XXXX format.
• An IBAN (international bank account number) has a country-specific structure.

DataMapper uses RegEx to detect these patterns—but pattern matching alone isn’t enough. This is where machine learning (ML) steps in. ML models help DataMapper understand context and validate what the patterns actually mean in the surrounding text. They differentiate between a real social security number and, say, a phone number that just looks similar.

For example: If “555-55-5555” appears in a document, a simple pattern search might flag it as an SSN. But if it’s actually just a mistyped phone number, the ML model picks up on that and avoids a false positive. In short: ML adds the intelligence that rule-based systems lack—ensuring structured data isn’t just detected, but correctly understood.

6. Large Language Model (LLM)

Even after machine learning and pattern recognition, context still matters. A phone number in a contact list? Probably not sensitive. But that same phone number in a medical report or HR file? That’s a different story. This is where Large Language Models (LLMs) come into play.

LLMs combined with data vectorisation allow DataMapper to go a step further than pattern recognition. They analyse the surrounding language and context to assess whether something is actually sensitive. To do this, DataMapper vectorises relevant text snippets and transforms them into a format that the LLM can understand. The model is trained to determine whether something is sensitive or not.

Real-world example:

“Ben Islam from finance, was a great co-worker. In his spare time he was a member of the lonely hearts dart club and was a great cook. I would recommend him for a promotion. By the way, his painting ‘bypass operation with COVID’ was amazing.”

In this case, the LLM analysis does not detect any sensitive content. Why? Because the bypass operation is mentioned in the context of art, not as a real medical event. Now compare that to this version:

“Ben Islam from finance… By the way, his recent bypass operation was done when he had COVID. It went amazing.”

Here, the LLM correctly detects sensitive content in the form of health information.

This is how LLMs reduce false positives and sharpen accuracy—helping companies avoid sifting through thousands of irrelevant documents. In minutes, you get a refined, accurate set of results that truly require attention—nothing more, nothing less.