What are the steps to map and classify PII fields to a file plan so privacy controls follow the records wherever they live?

Privacy controls only “follow the records” when they are tied to the file plan itself rather than to a particular system or storage location. The goal is to treat personally identifiable information (PII) as an attribute of a record series, so that retention, access, masking, and disposition rules apply consistently wherever copies live. The following steps describe a repeatable, principle-based approach.

1. Inventory and map PII at the field level

Begin by identifying where PII actually resides. Build (or update) a data inventory that lists systems, repositories, and shared drives, then map specific fields — names, identifiers, contact details, financial or health data — down to the record series they belong to. Note who originates the data, who uses it, and where it flows. This field-level mapping is the foundation; classification is unreliable without it.

2. Classify by sensitivity and authority

Group fields by sensitivity and by the authority that governs them. Distinguish ordinary PII from sensitive categories that may carry heightened obligations. Where federal context applies, note whether information falls under privacy law or a controlled-information regime, since those designations drive handling rules. Record the legal or policy basis for each classification so decisions are defensible.

3. Bind classifications to the file plan

Add PII classification as a metadata attribute on each record series in your file plan, alongside the retention and disposition authority. The file plan — not the storage system — becomes the single source of truth. When a series is tagged, every record assigned to it inherits the same privacy posture.

4. Translate classifications into enforceable controls

For each classification, define the controls that must travel with the record: access restrictions, encryption or masking, redaction expectations for disclosure, and disposition timing. Apply these consistently across primary records and copies, including backups and exports.

5. Govern, audit, and maintain

Assign ownership, document the scheme, and audit periodically. Re-map when systems or data flows change, and reconcile the inventory against the file plan so classifications stay current.

For related guidance, see the privacy and PII topic hub.

A risk-based framework can help align these controls with organizational goals and applicable obligations.