> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/workflows/define-workflow-settings/action-settings/query/data-scan.md). # Data scan DoControl's DLP data scan goes beyond basic PII and regex detection. To reduce the risk of data breaches and maintain regulatory compliance, you can scan your assets for sensitive data classifiers and regex patterns. {% hint style="success" %} * Data scans are leveraged as action steps in workflows, so only the triggering assets are scanned. * You need to give [consent](#consent-for-data-scanning) to enable the data scan action in workflows. {% endhint %} With real-time data scanning you can automatically identify and classify files and messages that contain high-risk content. This proactive approach enables you to enforce access controls, prevent unauthorized sharing, and respond to incidents within minutes. You can scan assets for: * [Data classifiers](#data-classifiers) - Over 230 natural language terms categorize data based on sensitivity, type, or regulatory requirements. Classifiers are regulated by compliance standards that aim to protect your personal, banking or health data from exposure. * [Regex patterns](#regex-patterns) - Strings that meet regular expression or pattern criteria, for example, a string that refers to a confidential topic, or a predefined regex pattern, such as a social security number. ## **Use cases** Primary use cases for scanning files and messages for sensitive data classifiers and regex patterns include: * **Regulatory compliance** - Organizations are required to proactively identify protected data types such as personally identifiable information (PII), payment card information (PCI), and protected health information (PHI). Data scans enable you to enforce policies aligned with GDPR, HIPAA, and SOC 2, reducing audit risks and penalties. * **Data breach prevention** - You can detect accidental or malicious sharing of credentials, API keys, or financial data. Data scans enable you to intercept high-risk content in messages or files before external exposure, mitigating insider threats and external exfiltration attempts. * **Intellectual property (IP) protection** - Monitor unauthorized sharing of trade secrets, proprietary code, or strategic documents. Regex patterns customized to internal IP formats, such as project codenames or patent references, can help to surface IP violations. ## Benefits of data scanning DoControl's unified and scalable DLP data scan gives you: * **230+ built-in data classifiers** - Detect sensitive file content, including source-code secrets, global IDs, financial, and health information * **Intelligent match context** - Capture exact matches with offsets, masked snippets, and full context to point you straight to the leak * **OCR for images and PDFs** – Scan contracts, passports, screenshots, and IDs for broader visibility * **Categorized findings** – Flag issues by data type (security, PII, finance) for faster triage * **Compliance drift detection** – Remediate any exposed assets to ensure compliance with relevant regulations, such as SOC 2, HIPAA, and ISO 27001 * **Custom regex and match logic –** Set thresholds, match limits, and fine-tune rules * **Confidence scoring** – Leverage probability-based match scoring to reduce false positives and make smarter decisions ## Supported file types Data scans run in Google Drive, Slack and Slack Enterprise for these entities:

App	Scanned entities
Google Drive	Files
Slack	Files
Slack Enterprise	Files and conversations

DoControl supports these files types when scanning for data classifiers and regex patterns:

App	File type	MIME type
General	TXT (text) CSV (comma separated values) TSV (tab separated values) PDF (portable document format) XML HTML	text/plain text/csv text/tab-separated-values application/pdf application/xml text/html
ODF (open document format)	ODT (text) ODS (spreadsheets) ODP (presentations) ODG (drawings) ODF (formulas) ODC (charts)	application/vnd.oasis.opendocument.text application/vnd.oasis.opendocument.spreadsheet application/vnd.oasis.opendocument.presentation application/vnd.oasis.opendocument.graphics application/vnd.oasis.opendocument.formula application/vnd.oasis.opendocument.chart
Image files	PNG JPG BMP GIF	image/png image/jpeg image/bmp or image/x-ms-bmp image/gif
Email format	MSG EML	application/vnd.ms-outlook message/rfc822
Compressed files	ZIP RAR GZIP 7ZIP	application/zip application/vnd.rar application/gzip application/x-7z-compressed
Google Drive	GDOC (Google Docs) GSLIDES (Google Slides) GSHEET (Google Sheets)	application/vnd.google-apps.document application/vnd.google-apps.presentation application/vnd.google-apps.spreadsheet
Microsoft	DOC/DOCX (Word version 2007 and up) XLS (Excel up to version 2003) XLS/XLSX (Excel version 2007 and up), XLT PPT/PPTX (Powerpoint version 2007 and up)	application/vnd.ms-excel application/vnd.openxmlformats-officedocument.spreadsheetml.sheet application/vnd.openxmlformats-officedocument.wordprocessingml.document application/vnd.openxmlformats-officedocument.presentationml.presentation

## Data classifiers Data classifiers categorize data based on [data categories](#data-categories) or [regulatory requirements](#compliance-standards). With classifiers, you can proactively identify and protect your personal, banking or health data from exposure. If high-probability matches are found, you can remediate any exposed assets to ensure compliance with the relevant regulations.

### Compliance standards Depending on your business sector and customer region, different compliance standards apply. When scanning files for data classifiers, select the compliance standards that are most relevant to your organization.

Each compliance standard includes a number of relevant data classifiers. You can search for up to 50 data classifiers in one scan. See [Data classifier list](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/query/data-scan/data-classifier-list.md) for the full list. {% hint style="success" %} For example: If you select the **HIPAA** category, all data classifiers related to US medical records and health information are scanned for. {% endhint %}

Compliance standard	Description
GDPR	The General Data Protection Regulation (GDPR) governs how companies collect, process, and store personal data pertaining to individuals in the European Union and European Economic Area
HIPAA	The Health Insurance Portability and Accountability Act (HIPAA) is a US regulation that safeguards patients' protected health information to ensure privacy and security
PCI	The Payment Card Industry Data Security Standard (PCI DSS) is a global standard mandating security practices for organizations that handle payment card transactions. It aims to protect cardholder data and prevent fraud.
FERPA	The Family Educational Rights and Privacy Act (FERPA) is a US federal law governing access to and disclosure of student educational records. This regulation protects student privacy in educational institutions that receive federal funding.
LGPD	The Lei Geral de Proteção de Dados Pessoais (LGPD) is Brazil’s general data protection law that establishes rules for processing the personal data of individuals in Brazil to ensure privacy protection
CCPA	The California Consumer Privacy Act (CCPA) is a California state law that grants residents rights over their personal information held by businesses, including the right to know, delete, and opt out of its sale
POPI	The Protection of Personal Information Act (POPI) is South Africa’s data protection law. It requires organizations to secure and govern the processing of personal information to protect individual privacy rights.
PDPO	The Personal Data (Privacy) Ordinance (PDPO) is Hong Kong’s principal data protection law. It regulates the collection, use, and handling of personal data by both public and private sector organizations
GLBA	The Gramm-Leach-Bliley Act (GLBA) is a US federal law requiring financial institutions to protect consumer financial data and explain their information-sharing practices to customers

### Data categories Depending on your business sector and customer population, different data categories apply. When scanning files for data classifiers, select the data categories that are most relevant to your organization.

Each data category includes a number of relevant data classifiers. You can search for up to 50 data classifiers in one scan. See [Data classifier list](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/query/data-scan/data-classifier-list.md) for the full list. {% hint style="success" %} For example: If you select the **Financial** category, all data classifiers related to banking, payments and investments are scanned for. {% endhint %}

Data category	Description
Government	Information managed by government bodies, including classified materials or data subject to public sector disclosure rules
Financial	Data related to banking, payments, investments, transactions, or other financial activities. Exposing this data can lead to fraud.
PII	Data that directly or indirectly identifies an individual, such as names, addresses, or national identification numbers. This data is protected due to the risk of identity theft.
Cryptocurrency	Digital wallet details, cryptographic keys, and transaction information for digital assets, where unauthorized access can lead to loss of funds
Credentials	Authentication details such as passwords, API keys, or tokens that, if compromised, allow access to protected systems or information
Medical	Healthcare records or information about diagnoses, treatments, insurance, or prescriptions. This data is highly regulated to protect individual privacy.
Logistics	Supply chain, delivery, and transport data. Disclosing this data could impact operations or business competitiveness.
Business	Proprietary corporate data, including trade secrets, internal strategies, or confidential plans. This data is essential to maintaining a business advantage.
Cryptographic	Encryption keys and digital certificates vital for securing communications and data. Exposing this data undermines all protected information.
Networking	Details about IT infrastructure, including IP addresses, network diagrams, or configurations that could enable cyberattacks if leaked
Educational	Academic records, grades, or research data pertaining to students or staff. This data is protected to comply with privacy laws and maintain trust.

## Regex patterns Regex (regular expression) is a string or pattern sequence of symbols and characters that is searched for in documents. Regular expressions are a powerful and flexible way of matching all characters or portions of text in a string. With the Data scan action, you can scan for customized patterns that are specific to your organization, such as customer data and sensitive company information. Common use cases for running a regex scan include references to salary, internal documents, executives in the company, or specific confidential topics. An example of a regex string is: `(\W|^)[\w.-]{0,25}@(yahoo|hotmail|gmail).com(\W|$)` The results return any email address match from these domains: yahoo.com, hotmail.com, and gmail.com, such as johndoe\@gmail, . A regex example to match any email address from a specific domain can be found [here](). ### What does a Regex pattern look for? A regex scan uses a deterministic scanning algorithm to detect a specific expression, string or pattern in a file. If you accurately configure a regular expression, the regex scan will find any relevant results in the file and display them in the step output. ### **When to use a Regex** pattern**?** We recommend using a regex pattern when you know the textual structure, or pattern, of the keywords you are looking for and would like to view clear, unequivocal results. Alternatively, use a regex pattern when you're looking for proprietary sensitive information that is not considered as personally identifiable information (PII). This could include sensitive internal company items, budget data, or unique customer data. ### Regex syntax limitations When using syntax in the regex scan, be aware of these limitations. * DoControl uses [RE2 syntax ](https://cran.r-project.org/web/packages/re2/vignettes/re2_syntax.html)for regular expressions. * You can enter between 5-1000 characters in the regex expression; otherwise it might return too many results * The file size is limited to 10MB. * If the result is greater than 70 characters, the `Expression too wide` error is returned. * If it takes more than two minutes to run the regex scan, the `Expression too wide` error is returned. ## Consent for data scanning You need to enable data scanning in workflows before using the Data scan action. Workflows with data, PII and regex scan actions will scan assets for sensitive data (PII, financial and health information) across all supported SaaS apps. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/workflows/define-workflow-settings/action-settings/query/data-scan.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.