Section 2: Business Requirements and Data Analysis. Lesson 11.
Whenever a migration moves personal or business data from one place to another, the team must understand how that data has to be handled by law and by policy. Two related ideas govern this: data compliance and data sensitivity.
Definitions
Data compliance is the ongoing process of managing and protecting sensitive or personal information in line with relevant laws, industry standards and internal security policies. It ensures customer and employee data is collected, stored, processed and disposed of safely and legally.
Data sensitivity is the level of confidentiality and criticality of information. It dictates how securely data must be stored, accessed and transmitted to prevent unauthorised exposure, legal penalties, or harm to individuals and organisations.
Together they describe the process of identifying, classifying, protecting and managing data according to its sensitivity level and the regulations that apply to it.
Example: which dataset is more sensitive?
- Dataset A: customer reviews and ratings. Lower sensitivity. Reviews are often public, but they can still contain personal data (reviewer names, emails, photos), so data protection still applies.
- Dataset B: business dealings and formal contracts. High sensitivity. Contains commercial terms, pricing, counterparties and legal obligations, so exposure could cause legal and financial harm.
Not all data carries the same importance or risk. A public product catalogue can be freely shared, while contracts need strict access control. Classification decides how much protection each dataset gets during the migration.
Key compliance regulations
Compliance requirements are the rules, laws, standards and industry regulations an organisation must follow.
- GDPR (General Data Protection Regulation, EU): a strict privacy and security law governing how organisations anywhere in the world handle the personal data of EU residents. Includes rights to access and erasure, lawful basis for processing, data residency and cross-border transfer rules, and breach notification within 72 hours.
- HIPAA (Health Insurance Portability and Accountability Act, US, 1996): federal law setting national standards to protect sensitive patient health information (PHI).
- PCI DSS (Payment Card Industry Data Security Standard): a global standard created by the major card brands to prevent fraud and breaches. Any business that accepts, processes, stores or transmits card data must comply.
- Others: SOX (US financial reporting), CCPA/CPRA (California privacy), India's DPDP Act, UK GDPR, and sector or local laws.
Failing to comply can bring severe legal penalties (GDPR fines reach up to 4% of global annual turnover or €20 million, whichever is higher), financial losses, reputational damage and operational disruption.
The four sensitivity levels
- Public: intended for everyone. Examples: marketing materials, press releases, public blog posts, the product catalogue. Exposure causes no harm.
- Internal: for employees and the company only. Examples: internal system rules, company policies, org charts. Exposure causes minor harm.
- Confidential: limited to controlled-access systems. Examples: customer lists, contracts, financial reports. Exposure could harm individuals or the business's reputation.
- Restricted (highly confidential): the most protected data. Examples: national ID numbers, payment card data, health records, passwords and keys. Exposure could cause severe legal consequences, identity theft or financial ruin.
| Level | Example | Migration handling |
|---|---|---|
| Public | Product catalogue | Standard process |
| Internal | Company policies | Access limited to staff |
| Confidential | Contracts, customer lists | Encryption, role-based access, audit |
| Restricted | Card data, health records | Encryption, masking, least privilege, full audit trail |
Applying it to a migration
- Discover and classify: scan sources for PII, PHI and card data, and tag every table and field with a sensitivity level.
- Map requirements: record which regulations apply to which data, including residency rules on where the target may be hosted.
- Minimise: don't migrate what you don't need. Archive or delete data past its retention period.
- Protect in transit and at rest: TLS, encryption, and tokenisation or masking in test environments.
- Control access: least-privilege, time-limited credentials for migration jobs, and access controls recreated in the target.
- Audit and validate: log what moved, who accessed it and when, and confirm compliance before sign-off.
- Clean up: securely delete staging copies, exports and temporary files.
Key takeaways
- Compliance means following laws and policies for handling data; sensitivity means how confidential and critical the data is.
- Not all data is equal: classify before migrating (public, internal, confidential, restricted).
- Know the key regulations: GDPR, HIPAA and PCI DSS, plus local laws.
- Identify, protect and manage sensitive data throughout the migration to reduce risk, avoid penalties and keep customer trust.
This completes Section 2: Business Requirements and Data Analysis.