Privacy Exposure Assessment
This is what we found — and what it puts at risk.
A complete account of the personal information across your document estate — what was found, how sensitive it is, where it lives, and the exposure it creates.
Across 1 scan, this assessment analysed 439,609 files and identified 126,131 containing personally identifiable information (28.7% exposure rate), with 907,185 total PII instances detected. Of these, 48,685 critical and 5,846 high-risk files require immediate attention. Bank Account (BSB + Account) is the most frequently detected PII type (561,443 instances).
PII findings
907,185
Individual findings detected
12 data types
across all sources
By sensitivity
608,760
Restricted items
261,400 confidential
37,025 internal
Identifiability
48,685
Files identifying a person
5,846 identifiable
with extra data
Top PII type
Bank Account (BSB + Account)
Most-found data type
561,443 instances
in 32,588 files
Top actions
1
Review the 608,760 restricted-grade findings flagged in this assessment.
2
Prioritise the highest-sensitivity data — Bank Account (BSB + Account) and Date of Birth.
3
Apply retention policies to aged data — 44,935 findings sit in documents over 10 years old.
4
Assess whether the volume of personal data collected is proportionate to stated purposes (data minimisation).Art-5
5
Identify duplicate records across systems — duplication may violate the accuracy principle.Art-5
6
Redact or quarantine files containing restricted PII.Art-32
Exposure overview
88HIGH
Privacy Posture Score
Elevated exposure
A high share of identifiable records carry restricted-grade PII (TFN, Medicare, passport), concentrated in a small number of documents.
608,760 restricted-grade findingsRisk matrix · sensitivity × category
partial
identified
identifiable
anonymous
Restricted
45,131
Confidential
58,817
3,554
5,846
Internal
12,769
14
Public
Compliance impact
402,315 scanned · 7,442 partial · 3,803 declined · 23,797 excluded · 240 failed
Security of processingCritical
Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
274,043 findings · 93,288 files
Notification of a personal data breach to the supervisory authorityCritical
Data controllers must notify the supervisory authority within 72 hours of becoming aware of a breach where it poses risk to rights and freedoms.
46,746 findings · 19,759 files
Principles relating to processing of personal dataHigh
Data must be processed lawfully, fairly, transparently; collected for specified purposes; adequate, relevant, limited.
268,010 findings · 91,570 files
PII exposure & priority
| # | PII type | Instances | Files | Retention age | Risk | Priority |
|---|---|---|---|---|---|---|
| 1 | Tax File Number (TFN)Restricted | 40,713 | 18,041 | 10/10 | 148 | |
| 2 | Bank Account (BSB + Account)Restricted | 561,443 | 32,588 | 10/10 | 132 | |
| 3 | Passport NumberRestricted | 3,571 | 1,416 | 10/10 | 127 | |
| 4 | Credit Card NumberRestricted | 2,462 | 302 | 10/10 | 121 | |
| 5 | Medicare NumberRestricted | 571 | 354 | 10/10 | 120 | |
| 6 | Date of BirthConfidential | 231,628 | 72,980 | 7/10 | 116 | |
| 7 | Centrelink CRNConfidential | 20,571 | 12,279 | 7/10 | 111 | |
| 8 | Driver's LicenceConfidential | 9,180 | 4,660 | 7/10 | 98 | |
| 9 | Person NameInternal | 36,382 | 18,590 | 4/10 | 84 | |
| 10 | Personal Number (passport MRZ)Confidential | 21 | 21 | 7/10 | 72 | |
| 11 | Australian AddressInternal | 613 | 593 | 4/10 | 53 | |
| 12 | Country of Issue (passport)Internal | 30 | 30 | 4/10 | 48 |
Priority = Risk Weight×10 + Retention-Risk %×0.5 + Volume Bonus (100+ items +10, 1K +20, 10K +30). Retention-age bar: current · 7–10 yrs · 10+ yrs. Top-3 and 30%+-overdue rows are tinted.
File analysis
Duplicate files
68,413
Duplicate files
35,752
Duplicate sets
13,318
Duplicates carrying PII