# Automatic Detection of Sensitive Data Using Transformer-Based Classifiers
## 3 Background  
### Sensitive Data Discovery  
The implications of the GDPR are a topic of great relevance in many fields [2; 3; 4] because its restrictions affect the way data are collected, stored and processed. Sensitive Data Discovery is the process of locating and identifying specific types of personal data from unstructured and structured data sources to be able to protect or remove them according to the regulations' requirements. This is a crucial step for security teams to be GDPR-ready, to ensure the privacy of their organizations' customers and employees and to prevent data breaches and leaks. Since new data are created on a daily basis, data discovery is an ongoing endeavor that security professionals must proactively pursue to build a strong and secure foundation. Sensitive data discovery becomes essential for heavily-audited organizations, such as healthcare, financial services, telecommunication companies and government offices. These organizations adhere to strict sensitive data discovery protocols and follow specific industry-based rules and regulations.  
Sensitive Data Discovery is a topic of great relevance that has been discussed in some publications; in [5], the authors describe two different algorithms for discovering the most frequent patterns in a data set of sensitive records: one is based on the _exponential mechanism_ of [PERSON] and [PERSON] [6], while the other is based on the analysis of the established technique of adding Laplace noise to released statistics to preserve global statistics while protecting individual pieces of information [7]. In an extensive review paper [8], all the methods taken into consideration are divided into two main categories: rule-based approaches (lookup tables, regular expressions, metadata analysis) and machine learning methods. Considering the latter, most sensitive-topic and data-detection systems are based on deep learning or other computational intelligence methods. One of the main reasons for the prevalence of neural-network-based approaches lies in the sub-symbolic distribution of knowledge over thousands of weights that make neural networks generally robust to small input changes, weight alterations or disconnections. This is certainly one of the key properties that allow neural networks to perform well in the presence of noisy or uncertain data. Related approaches [9; 10] use fuzzy logic methods [11], mainly for hiding the correlations between sensitive data. This approach is particularly relevant when dealing with medical records coming from different centers, where direct references between records should be avoided to preserve privacy.  
With respect to our project's goals and a possible significant comparison of the methods they describe with ours, most papers are either outdated or deal with definitions of sensitive data that differ from those given in the GDPR.  
A few commercial tools are available for detecting sensitive data, for example, (IBM Security Guardium [12], Azure Information Protection [13] and Rubrik [14], etc.). Unfortunately, all these applications are proprietary software, so it is not possible to study their approach to the problem in depth or to adapt them to different regulations.