A schema-only classifier that finds personal data without reading it

When someone asks an engineer for a list of everywhere personal data is stored, the usual answer is a manual crawl through production databases. A new approach instead reads only the schema — table and column names and their types, never the actual values. Because it touches nothing but information_schema, it can run without a security review, which is what lets the resulting map stay current.

A naive substring matcher fails badly at this: a column called trace_id contains "race" and gets flagged as ethnicity data — a GDPR Article 9 special-category flag that costs a compliance team a week to clear. The classifier instead tokenizes column names on underscores, dashes, digits and camelCase, matching only whole tokens or consecutive token sequences. Its loosest matching mode, stem matching, is restricted to special-category and criminal-offence rules, where missing a hit is worse than over-flagging.

The system is a rule engine, not a model: every flag shows which term matched, so a reviewer can audit a decision at a glance and fix errors with a one-line rule change instead of retraining. On a held-out benchmark of 349 hand-labelled columns across English, German, French and Dutch, recall on ordinary personal data clears an 0.85 CI floor per language, while a separate trap set of infrastructure columns returns zero false special-category flags.

The approach's real ceiling is stated openly: accuracy drops to 66.7% on context-dependent categories like employment fields and national identifiers, where a bare column name isn't enough. That's why output is labelled DRAFT, with every flag carrying its own explanation — a data map that arrives in minutes but is built for human review, not blind trust.