Sensitive data protection requires more than encryption at rest. It requires a controlled path from application access through backups, replicas, logs, and non-production environments.
Control layers that must agree
- Identity: individual identities, short-lived privileged access, service-account ownership, MFA at the access gateway, and periodic entitlement review.
- Authorization: application roles separated from DBA roles, least privilege by schema/table, controlled impersonation, and documented emergency access.
- Data protection: TLS, encryption at rest where supported, protected key lifecycle, masked extracts, and prohibited use of production data in development without an approved exception.
- Evidence: audit trails for privileged actions, schema changes, bulk exports, backup jobs, restore tests, and access-review decisions.
Backups are part of the database
A protected production cluster is not adequate if dump files, physical backups, WAL archives, snapshots, and restore targets can be copied or restored without equivalent controls. We review encryption, repository access, retention, restore authorization and test evidence.
Deliverable
The result is a prioritized control matrix: asset, data class, current control, gap, owner, remediation, validation method and operational dependency. Legal interpretation remains with the client’s DPO and counsel.