As part of a major data discovery initiative to identify personal data across the organization, the project team has identified the proliferation of personal data held as unstructured data as a major risk. What should be done FIRST to address this situation?

The first step in addressing the risk of personal data proliferation is to classify the sensitive unstructured data. Classification provides the necessary context to understand the data's sensitivity, value, and regulatory requirements. This foundational step enables all subsequent data governance activities, such as assigning ownership (D), identifying and controlling access (C), and applying appropriate protection and retention policies. Without knowing what the data is and its level of sensitivity, it is impossible to manage it effectively.

A. Identifying data at the point of creation is a forward-looking, preventative control. It does not address the immediate problem of existing, discovered data proliferation.
C. Identifying who has access is a critical step in access control, but it must follow classification to ensure access rights are appropriate for the data's sensitivity.
D. Assigning an owner is essential for accountability, but this should be done after classification so the appropriate business unit or individual can be assigned responsibility.

1. ISACA. (2020). CDPSE Review Manual. Domain 1: Privacy Governance, Section 1.4 Data Governance. The manual outlines that data classification is a prerequisite for applying other controls like access management and assigning ownership.

2. ISACA. (2018). COBIT 2019 Framework: Governance and Management Objectives. APO14 Managed Data. The framework describes identifying and classifying data as a key practice preceding the management of data quality and security.

3. Stanford University. (n.d.). Data Classification Guideline. This guideline shows that the first step in the data handling process is to classify data based on its sensitivity level, which then dictates all other handling requirements.