Skip to content
Contact (852) 2763 3180
Book an Assessment

Solution Blueprint · Cyber Resilience & Compliance

Sensitive Data:
Discover, Classify And Control

Know where personal and confidential data sits, and apply one policy wherever it moves: email, web, cloud, endpoints and AI tools.

Layers
Protect
Products
Forcepoint
Reading time
4 minutes
Last reviewed
October 2026
Book an Assessment
See all insights

The Problem

You’ll recognise this if:

Nobody can say where HKID numbers, card data or client files are stored.

Staff paste company data into public generative-AI tools.

Data leaves by email, cloud uploads and USB drives.

Data protection rules apply, but controls are manual.

What Good Looks Like

We agree these measures with you as the exit criteria of the PoC. We report what we measure; we do not promise a figure in advance.

  • Sensitive files and records found, by location and type
  • Over-exposed data: open shares, stale copies and broad permissions
  • Policy matches in monitor mode, with false positives tuned
  • Incidents blocked or coached once enforcement starts
Vendor figure

Forcepoint states that DSPM scans about 1 million files an hour and classifies them with AI Mesh, which combines a small language model with other AI components. Source: Forcepoint DSPM documentation: features and benefits (opens in a new tab)

Reference Architecture

The Kepro data ecosystem from Foundation upwards, with the layers this blueprint uses highlighted. Product names link to their pages.

  1. Visualise (Not Used In This Blueprint)
  2. Analyse (Not Used In This Blueprint)
  3. Prepare (Not Used In This Blueprint)
  4. Connect (Not Used In This Blueprint)
  5. Foundation (Not Used In This Blueprint)
Protect · Secure

Forcepoint DSPM scans file shares, Microsoft 365 and cloud storage, classifies what it finds and flags over-exposure. Forcepoint DLP applies one policy at endpoints and in email, web and cloud applications, including prompts to AI tools. Forcepoint DDR watches data activity continuously. A label set at discovery is enforced without reclassifying.

With Forcepoint

Data flows bottom → top

Data sourcesFile shares, Microsoft 365, cloud storage, databases, endpoints, email and web traffic.

Technology Stack

Technology stack for this blueprint
LayerProductEdition / ModelRoleKey Specification
ProtectForcepointForcepoint DSPMDiscovery and classificationAI Mesh classification; on-premise, public or private cloud deployment
ProtectForcepointForcepoint DLPPolicy enforcementEndpoint, email, web, cloud and network; data in use, in motion and at rest
ProtectForcepointForcepoint DDRContinuous detectionFlags risky data activity as it happens

How We Deliver

Five steps, each with a clear exit before the next. The timeline is agreed with you in the Design step.

  1. 01

    Data Readiness Assessment

    Where sensitive data is likely to sit, which channels matter and which rules apply.

    From youData owners and the regulations you follow.

  2. 02

    PoC

    Read-only discovery on agreed repositories, with a classification and exposure report.

    From youRead access to the repositories in scope.

  3. 03

    Design

    Classification scheme, policies for each channel and the enforcement plan.

    From youBusiness owners to decide what is allowed.

  4. 04

    Implementation

    Policies run in monitor mode first, are tuned with your teams, then enforced in stages.

    From youUser communications and a point of contact in each department.

  5. 05

    Support & Optimisation

    Monthly posture reviews and policy tuning.

    From youNotice of new systems and data stores.

Standards And Controls

  • PDPO Data Protection Principle 4

    Reasonable security for personal data: knowing where it is and controlling how it moves.

  • PCPD Checklist On Generative AI (March 2025)

    Supports rules on what staff may enter into AI tools.

  • ISO/IEC 27001:2022

    Supports controls for information classification and data leakage prevention.

Before You Start

Readiness Checklist

  • A data classification scheme, or agreement to create one.
  • Business owners who can decide what is allowed.

Risks And How We Handle Them

  • Blocking legitimate workMonitor mode first, then staged enforcement with user coaching.
  • Too many alertsPolicies are tuned on real matches before enforcement.

Sources

  1. Forcepoint DSPM (opens in a new tab)
  2. Forcepoint DLP (opens in a new tab)
  3. Forcepoint DDR (opens in a new tab)
  4. PCPD: Checklist on Guidelines for the Use of Generative AI by Employees (opens in a new tab)
  5. PCPD: The Personal Data (Privacy) Ordinance (opens in a new tab)

Last reviewed October 2026. Vendor facts change; the linked sources are the reference.

Related

Products In This Blueprint

Forcepoint
Sensitive-data discovery, classification and loss prevention.

Related Blueprints

Infrastructure For Data & AI

Private AI: Start On A Desk, Scale In Your Data Centre

Generative AI for your teams with models and data kept on-premise, starting with one department and growing to production.

Layers: Foundation, Protect
Read blueprint
Real-Time Data & AI

Real-Time Customer 360: One Live Record Across Every System

A governed customer record that every channel, dashboard and AI assistant can use, built from the systems you already run.

Layers: Visualise, Analyse, Connect, Foundation, Protect
Read blueprint
Real-Time Data & AI

Healthcare Operations Data: Live Views, With Patient Data Protected

One current view of capacity, waiting times and turnaround across clinical and business systems, with personal health data classified and controlled.

Layers: Visualise, Analyse, Connect, Foundation, Protect
Read blueprint

Data Readiness Assessment

Talk To Our Architects About This Blueprint

Start with a Data Readiness Assessment: we map your data sources, pain points and risks, and recommend what fits your situation, not a preset product.

Book a Data Readiness Assessment
See all insights