Data Classification and PII

Here’s the question every organisation asks when they start an AI project: can we use our customer data?

The answer is almost always: not directly. Not with a public model. Not without understanding exactly what you have and where it sits. Most companies have PII scattered across many systems, such as names, addresses, account numbers, health data and financial records, often in places nobody has looked at recently. Putting that into a public model isn’t just a GDPR risk. It’s a reputational one. Classification is the work that happens before any of that.

Data classification

We build classification pipelines that scan your estate and tag data by sensitivity level: public, internal, confidential or restricted. Not manually. Automatically, at scale, across structured and unstructured sources. This gives you a living map of your data by classification level, updated as new data arrives, feeding directly into your governance controls.

PII detection and mapping

We identify where PII lives across your sources: which tables, which fields, which documents. We distinguish between categories: direct identifiers like names and emails, indirect identifiers like postcodes and dates of birth, sensitive categories like health and financial data. For each source you get a PII map: what’s there, what regulation applies, what risk it carries if exposed.

Masking, tokenisation and redaction

Masking replaces real values with realistic but fictional ones, useful for development and testing environments where real data has no business being.

Tokenisation replaces sensitive values with a reversible token. Meaningless outside your system, but the relationship between records is preserved. Useful when you need to process data through a model but retrieve real values for specific downstream actions.

Redaction removes the value entirely. Right for cases where the field has no analytical value and only carries risk.

We build the pipelines that apply the right treatment to the right data automatically, at ingestion or transformation time.

Synthetic data generation

For AI training and testing, sometimes the cleanest solution is data that was never real to begin with. We generate synthetic datasets that have the same statistical properties as your production data: same distributions, same relationships, same edge cases, and no real personal data.

Regulatory context

GDPR sets the floor. Sector-specific rules can add requirements, such as FCA rules for financial data, CQC standards for health data and DORA for operational resilience. DataPhoenix documents classification decisions against the relevant legal basis, and the output is defensible: decisions are logged, justified and auditable.

Want to learn more? Classification is one stage of onboarding a data source; from raw to ready shows where it sits among the others. Why every enterprise AI product needs a professional data platform explains why it cannot be skipped. The secure data platform case study is a worked example with personal data at its centre.