Data Classification

Here’s the question every organisation asks when they start an AI project: can we use our customer data?

The answer is almost always: not directly. Not with a public model. Not without understanding exactly what you have and where it sits. Most companies have PII scattered across dozens of systems — names, addresses, account numbers, health data, financial records — often in places nobody has looked at recently. Putting that into a public model isn’t just a GDPR risk. It’s a reputational one. Classification is the work that happens before any of that.

Data classification

We build classification pipelines that scan your estate and tag data by sensitivity level — public, internal, confidential, restricted. Not manually. Automatically, at scale, across structured and unstructured sources. This gives you a living map of your data by classification level, updated as new data arrives, feeding directly into your governance controls.

PII detection and mapping

We identify where PII lives across your sources: which tables, which fields, which documents. We distinguish between categories — direct identifiers like names and emails, indirect identifiers like postcodes and dates of birth, sensitive categories like health and financial data. For each source you get a PII map: what’s there, what regulation applies, what risk it carries if exposed.

Masking, tokenisation and redaction

Masking replaces real values with realistic but fictional ones — useful for development and testing environments where real data has no business being.

Tokenisation replaces sensitive values with a reversible token. Meaningless outside your system, but the relationship between records is preserved. Useful when you need to process data through a model but retrieve real values for specific downstream actions.

Redaction removes the value entirely. Right for cases where the field has no analytical value and only carries risk.

We build the pipelines that apply the right treatment to the right data automatically, at ingestion or transformation time.

Synthetic data generation

For AI training and testing, sometimes the cleanest solution is data that was never real to begin with. We generate synthetic datasets that have the same statistical properties as your production data — same distributions, same relationships, same edge cases — with zero PII risk.

Regulatory context

GDPR sets the floor. Depending on your sector there may be additional requirements — FCA rules for financial data, CQC standards for health data, DORA for operational resilience. We work within whichever regulatory framework applies and document classification decisions against the relevant legal basis. The output is defensible — decisions are logged, justified, and auditable.