Ask for a walkthrough
Menu

Data discovery

Find your sensitive data first.

Card numbers in an old spreadsheet. Personal data on a forgotten file share. Health details in a shared folder. The discovery tool finds them and shows you where they are.

Ask for a walkthrough

What to keep, move or delete is yours to decide.

At a glanceToday
It finds
Card data, personal data (PII) and health data (PHI)
It looks across
File shares, servers and directory-joined networks
It can then
Delete, mask or redact, move or quarantine what it finds
For PCI DSS
Requirement 12.5.2: confirm where your card data is, at least once every 12 months
Who decides your scope
You confirm it. Your QSA validates it

For PCI DSS

Card data where it should not be.

PCI DSS asks you to confirm your scope at least once every 12 months. That includes card data outside the environment you defined, and in file backups (12.5.2).

Service providers confirm it every six months (12.5.2.1). Finding the data is the first step. Settling your scope is the next.

How the platform shows your scope

Sensitive data foundExample
File share · finance/exports214 card numbers in 6 spreadsheetsCard data
Server · support-archive37 card numbers in 4 text filesCard data
Server · payments-db-backupCard numbers, where you expected themCard data
3 locationscard data

Personal and health data

Know what you hold.

The ICO suggests starting with an information audit: finding out what personal data your organisation holds and where. The discovery tool finds personal data and health data on the same file shares and servers.

Sensitive data foundExample
File share · hr/leavers1,240 records with names and addressesPersonal data
File share · clinic/referrals38 documents with health detailsHealth data
2 locationspersonal data · health data

After it is found

Then deal with it.

Finding the data is half the job. The discovery tool can also act on it, when you tell it to.

  • Delete it.
  • Mask or redact it, and keep the file.
  • Move it, or put it in quarantine.

The words for it

PII, PHI, PAN: what each one means.

The United States says PII and PHI. UK and EU law says personal data and health data. The card standard says account data. The discovery tool looks for all of them.

PII
Personally identifiable information in the United States. Personal data under the GDPR: any information relating to an identified or identifiable person
PHI
Protected health information under HIPAA in the United States. Health data, one kind of special category data, under the GDPR
PAN
The card number. PCI DSS calls it, with the rest of what is on a card, account data

The limits

What it does not do.

  • Assess you

    Your QSA does.

  • Decide your scope

    You confirm it. Your QSA validates it.

  • Decide what you keep

    What to keep, move or delete is yours to decide.

  • Act on its own

    It deletes, masks or moves only what you tell it to.

Sources

  1. PCI Security Standards Council, PCI DSS v4.0.1 Report on Compliance Template, revision 3, January 2025, requirements 12.5.2 and 12.5.2.1, in the document library. Read 13 Oct 2026
  2. ICO, How do we document our processing activities? Read 13 Oct 2026
  3. ICO, What is personal data? Read 13 Oct 2026
  4. ICO, What is special category data? Read 13 Oct 2026
  5. United States Code of Federal Regulations, title 45, section 160.103, definitions under HIPAA. Read 13 Oct 2026
  6. NIST Computer Security Resource Center, glossary entry for personally identifiable information. Read 13 Oct 2026

The Council's wording is paraphrased and cited by requirement number.

See what it finds.

Ask for a walkthrough and we will show you the discovery tool on a sample like yours.

Ask for a walkthrough

The button opens an email to info@normatiq.io.