Finding Sensitive Data Before Masking: A Human-in-the-Loop Pipeline

Presentation Title: Finding Sensitive Data Before Masking: A Human-in-the-Loop Pipeline for Enterprise Test Data

Abstract:
Most data masking projects begin with a list of columns to transform. But where did that list come from? And what happens when sensitive information is hidden in fields such as notes, comments, and free-text descriptions?

This session presents a practical, human-in-the-loop pipeline for identifying sensitive columns before production data is copied into test environments. The workflow combines column-name and pattern signals, historical masking decisions, sampled values, NLP and LLM review, and final analyst approval.

Using an enterprise Test Data Management case study, I will explain how this approach reduced sensitive-data analysis time for a medium-sized schema of approximately 100 tables from about 64 hours to about 2 hours, while reaching approximately 93% agreement with parallel manual review. The session also examines false positives versus false negatives, sample minimization, responsible API use, preservation of data usability, and the reuse of approved decisions during future refresh cycles.

The session is vendor-neutral and uses only synthetic examples. Attendees will leave with an implementation blueprint they can adapt to their own data platforms and governance processes.
Available Week(s)

Learning Objective:
By the end of this session, attendees will be able to:
1\. Design a multi\-stage pipeline that combines metadata rules\, historical decisions\, sampled values\, NLP/LLM analysis\, and human review\.
2\. Decide which columns can be classified deterministically and which require value\-level analysis or analyst escalation\.
3\. Evaluate false positives\, false negatives\, sampling cost\, and privacy exposure when using AI for sensitive\-data discovery\.
4\. Build a reusable decision repository and feedback loop for future test\-data refresh cycles\.