ALL-DATA0012 · ungoverned_sensitive_field
Count fields the catalog marks sensitive while leaving their governance incomplete.
This is a deterministic rule for all languages. Read its implementation.
Definition
Section titled “Definition”Read the tags the catalog attaches to every field, keep the fields carrying one of
sensitive_tags, and report each of them whose asset names no owner or whose own glossary
terms are empty. A tag says the column holds personal or restricted data, a glossary term says
which written policy governs it, and an owner says who answers when somebody asks to export it.
A tag standing alone is a label nobody can act on, which is the state an access review finds
the week after the data left.
Tag matching folds case and trims whitespace, since a catalog populated by several teams
spells the same label as PII, pii, and a padded variant of both, and treating those as
three different labels would silently exempt two of them.
Evidence
Section titled “Evidence”Each finding names the asset, the field, the tag that made it sensitive, and which of ownership and glossary context it lacks. The value is the number of sensitive fields with an incomplete governance record.
Exceptions
Section titled “Exceptions”A field carrying no tag at all is never reported, because this rule judges what the catalog
declares sensitive rather than guessing sensitivity from a column name. A sensitive field whose
asset names an owner and whose glossary terms are stated is complete and stays quiet. A field
tagged with something outside sensitive_tags is left alone, so a project models its own
vocabulary by stating it rather than by arguing with this list. Whether the named policy is the
correct one is a judgment nobody makes from metadata alone, so presence is all this measures.
Examples
Section titled “Examples”An email field tagged pii on an asset with no owner and no glossary term returns 1. The
same field on an owned asset carrying one glossary term returns 0, and so does an untagged
field on that same unowned asset.
References
Section titled “References”- Cites “DAMA-DMBOK”, data security and privacy management
- Cites “DataHub documentation”, tags and glossary term metadata