A method for discovering and protecting sensitive data within an enterprise, the method comprising steps performed by one or more processors, the steps comprising: obtaining database descriptions of enterprise databases, each database description indicating a database attribute of the corresponding database; obtaining a record classification rule for a sensitive data type, the record classification rule specifying at least one field type; identifying sensitive data records of the sensitive data type by matching headers of data records to the at least one field type specified by the record classification rule; identifying a set of dependent databases accessing source data records from the enterprise databases; determining assessment scores for the enterprise databases, an assessment score for the corresponding database determined from a linear combination of: a number of identified sensitive data records in the corresponding database, a number of dependent databases accessing the sensitive data records from the corresponding database, and whether a protection policy has been applied to the sensitive data records of the corresponding database; generating status indicators for groups of enterprise databases each having a common database attribute, a status indicator for an enterprise group reflecting a total number of identified sensitive data records in enterprise databases having membership in the enterprise group; providing an interface comprising the generated status indicators; receiving via the user interface a selection of one of the generated status indicators and a selection of a protection policy, the protection policy indicating one or more protection actions applied to one or more data fields and one or more parameters for the one or more protection actions; and applying the selected protection policy to sensitive data records of an enterprise database having membership in the enterprise group corresponding to the selected status indicator to thereby apply the one or more protection actions to the one or more data fields according to the one or more parameters. obtaining database descriptions of enterprise databases, each database description indicating a database attribute of the corresponding database; obtaining a record classification rule for a sensitive data type, the record classification rule specifying at least one field type; identifying sensitive data records of the sensitive data type by matching headers of data records to the at least one field type specified by the record classification rule; identifying a set of dependent databases accessing source data records from the enterprise databases; determining assessment scores for the enterprise databases, an assessment score for the corresponding database determined from a linear combination of: a number of identified sensitive data records in the corresponding database, a number of dependent databases accessing the sensitive data records from the corresponding database, and whether a protection policy has been applied to the sensitive data records of the corresponding database; generating status indicators for groups of enterprise databases each having a common database attribute, a status indicator for an enterprise group reflecting a total number of identified sensitive data records in enterprise databases having membership in the enterprise group; providing an interface comprising the generated status indicators; receiving via the user interface a selection of one of the generated status indicators and a selection of a protection policy, the protection policy indicating one or more protection actions applied to one or more data fields and one or more parameters for the one or more protection actions; and applying the selected protection policy to sensitive data records of an enterprise database having membership in the enterprise group corresponding to the selected status indicator to thereby apply the one or more protection actions to the one or more data fields according to the one or more parameters.