We use AI to find personal data. We don't let it delete anything.

Classification produces a probability. Deletion is irreversible. Any vendor who connects those two directly is selling you a confidence they cannot justify.

The asymmetry that decides the architecture

Every data classification system produces the same output: a score. Some number between zero and one expressing how likely it is that this document contains a passport number, or health data, or a contract that triggers a retention rule.

It is never a fact. It is an estimate, and it will be wrong in both directions.

Those two directions are not symmetric, and this is the whole argument.

A false negative — you missed personal data that was there — leaves you where you already were. The risk is unchanged. You will find it on the next pass, with a better model or a new pattern. It is a bad outcome that degrades gracefully.

A false positive that triggers deletion destroys something you needed. There is no next pass. If the classifier decided a signed employment contract under a seven-year statutory retention obligation was an obsolete draft, that document is gone, and the first time you learn about it is when a lawyer asks for it.

One failure mode costs you time. The other ends the programme, because after the first incident nobody in the organisation will authorise deletion again for three years. I have watched this happen.

That asymmetry is why the pipeline has a human in it. Not because the AI is weak — because the consequences are not symmetric, and no confidence score is a decision.

What PII detection accuracy actually looks like

There is a persistent belief that PII detection is a solved problem, usually held by people who have read a vendor datasheet rather than run a benchmark.

So we ran one. We put Microsoft Purview against 89,521 real files from live environments — not synthetic test data, not generated samples, actual enterprise documents — and measured it.

Passport numbers: 99.8% misclassified. Payment card details: 91% error rate. With substantial gaps against the categories GDPR actually cares about.

Those numbers are not an indictment of Microsoft's engineering. They are a description of how hard the problem is when you leave the lab.

Consider a Danish CPR number. The format is ten digits, historically with a modulus-11 check on the final digit. A pattern matcher finds every ten-digit string in your estate. That includes order numbers, product codes, and long integers in a spreadsheet column. Add the check digit and you cut the noise — but Denmark stopped enforcing modulus-11 for numbers issued after 2007, so strict validation now produces false negatives on younger data subjects. Loosen it and the false positives return.

Now do that for a payment card in an invoice PDF where OCR read a 5 as an S. For a passport number written with a space in the middle. For a health condition mentioned in a Danish sentence in an email whose subject line is in English. For a spreadsheet whose column header — Medarbejder, CPR, Diagnose — carries the meaning that the cell contents alone do not.

Context does most of the work, and context is exactly what a pattern matcher does not have. This is where language models are genuinely, materially better than the previous generation of tooling. They read the document rather than scanning it. That is a real advance and we use it heavily.

It still produces a probability.

If you are evaluating a Purview alternative on the back of numbers like these, the accuracy figure is the wrong thing to compare first. Ask instead what the tool does with the score. A product that reports findings and stops has handed you a spreadsheet. A product that acts on the score by itself has handed you a liability. The question worth asking a vendor is what happens between those two.

Where the human belongs, and where they don't

The instinct, when you accept that a human must review, is to route everything to the compliance team. That fails immediately on volume. A mid-sized organisation generates more classification results in a week than a two-person DPO function can review in a year, and a queue that never empties is the same as no control at all.

The human in the loop is not a reviewer. It is the data owner.

The person who created the folder knows whether the 2019 export still matters. The HR lead knows which contracts are under statutory retention. The project manager knows the tender closed and the CVs can go. None of them need to see a confidence score, and none of them need to understand classification. They need to see their own data, described in business terms, and answer one question: does this still have a purpose?

That distributes review across the organisation in proportion to where the data was created. It also puts the decision with the only person who holds the context the classifier is missing — which is the actual reason it works, not just a throughput trick.

The classifier's job is to make that question answerable: reduce millions of items to a structured, deduplicated, prioritised set with a clear proposal attached. That is a genuinely hard machine learning problem and it is the right one to point a model at.

The classifier's job is not to answer it.

What a defensible deletion record contains

Article 5(2) requires you to demonstrate compliance, and Article 17 gives people the right to erasure. Both mean that "we deleted it" is worth nothing without evidence.

If your platform cannot produce all of the following per deletion, you have automation without accountability:

• What was deleted — identifier, location, hash, and enough metadata to identify it without retaining its contents

• Why — the retention rule or erasure request that triggered it, cited specifically

• Who authorised it — a named person, not a service account, and not "the system"

• When — proposal, decision, and execution as three separate timestamps

• What the classifier said — the category and confidence at decision time, so the reasoning is reconstructible

• Where the copies were — backups, archives, replicas, and their disposition

That last one is where most implementations quietly fail. Deleting the primary and leaving it in a backup set is not erasure. It is erasure from the only copy you were looking at.

The honest position

We use AI aggressively. It reads documents in four languages, in formats that defeat pattern matchers, at a volume no human team could approach. Without it none of this is possible.

We are also not finished. There is personal data our classification does not yet catch, and security information we have not learned to identify. Anyone in this market telling you their classification is complete is either not measuring or not telling you.

What we do not do is let a probability trigger an irreversible act.

Classify with the machine. Verify with the person who owns the data. Delete with a record you would be comfortable handing to a supervisory authority.

The middle step is the slow one, and it is the one that makes the other two defensible.

If you want to know what is actually sitting in your unstructured data, we run a free review.