Pluggable data taxonomy and processing

1 . A data protection method performed by a computing system, the method comprising:

accessing a taxonomy-agnostic data protection framework of the computing system, the taxonomy-agnostic data protection framework comprising a data classification taxonomy definition, the data classification taxonomy definition comprising a taxonomy identifier and a set of data classification indicators, the taxonomy-agnostic data protection framework configured to be interoperable with a future data classification taxonomy definition as a result of the future data classification taxonomy definition being plugged into the taxonomy-agnostic data protection framework without recompiling or rebuilding the taxonomy-agnostic data protection framework;

performing a static analysis of a source code based on at least the data classification indicators; and

reporting at least one of the following determinations based on at least a result of the static analysis: the source code correctly propagates a particular data classification, the source code does not correctly propagate a particular data classification, or the source code does not apply a particular data classification to particular data even though the particular data has a data type or a data format which is compatible with the particular data classification.

2 . The method of claim 1 , further comprising generating an annotated data transport structure by annotating a data transport structure with a particular data classification indicator, and sending data over a network connection, wherein the data conforms to the annotated data transport structure.

3 . The method of claim 1 , further comprising receiving data, generating annotated data by annotating the data with a particular data classification indicator, and forwarding the annotated data over a network connection.

4 . The method of claim 1 , further comprising acquiring an automatically generated data annotation suggestion to annotate a part of the source code with a particular data classification indicator, and presenting the automatically generated data annotation suggestion in a user interface.

5 . The method of claim 1 , further comprising receiving sensitive data which is annotated with a particular data classification indicator, using a mapping mechanism to identify a particular data classification processing routine based on at least the particular data classification indicator, and invoking the particular data classification processing routine on the sensitive data.

6 . The method of claim 5 , further comprising mapping a data classification annotation on the sensitive data to multiple data classifications in the data classification taxonomy definition.

7 . The method of claim 5 , further comprising auditing and reporting which data classification processing routines were invoked for a specified set of data.

8 . The method of claim 1 , further comprising resolving a conflict between data classification annotations.

9 . The method of claim 1 , wherein accessing the taxonomy-agnostic data protection framework comprises:

reading at least a portion of the data classification indicators from at least one of: source code annotations, a sidecar file, an online database, or a compiler-based mapping.

10 . The method of claim 1 , further comprising:

using a particular data classification indicator to identify a default processing routine.

11 . The method of claim 1 , further comprising:

corresponding a particular data classification indicator to a bit position in a bit vector.

12 . The method of claim 1 , wherein performing the static analysis of the source code comprises:

determining that the source code correctly propagates the particular data classification.

13 . The method of claim 1 , wherein performing the static analysis of the source code comprises:

determining that the source code does not correctly propagate the particular data classification.

14 . The method of claim 1 , wherein performing the static analysis of the source code comprises:

determining that the source code does not apply the particular data classification to the particular data.

15 . The method of claim 1 , further comprising:

combining at least two data classification indicators to produce another data classification indicator.

16 . A computer-readable storage device storing instructions which upon execution by a processor cause a computing system to perform operations, the operations comprising:

accessing a taxonomy-agnostic data protection framework of the computing system, the taxonomy-agnostic data protection framework comprising a data classification taxonomy definition, the data classification taxonomy definition comprising a taxonomy identifier and a set of data classification indicators, the taxonomy-agnostic data protection framework configured to be interoperable with a future data classification taxonomy definition as a result of the future data classification taxonomy definition being plugged into the taxonomy-agnostic data protection framework without recompiling or rebuilding the taxonomy-agnostic data protection framework; and

annotating a source code based on at least one of the data classification indicators.

17 . The computer-readable storage device of claim 16 , wherein the taxonomy-agnostic data protection framework further comprises:

a set of data classification processing routines; and

a mapping mechanism which maps between data classification processing routines and data classification indicators; and

wherein the operations further comprise:

invoking a particular data classification processing routine on particular data based at least in part on a particular data classification indicator which is associated with the particular data.

18 . The computer-readable storage device of claim 17 , wherein the operations further comprise:

performing at least one of the following actions on the particular data using the particular data classification processing routine: deletion, redaction, anonymization, pseudonymization, or hashing.

19 . The computer-readable storage device of claim 17 , wherein the operations further comprise:

performing at least one of the following actions on the particular data using the particular data classification processing routine: encryption or enrichment.

20 . The computer-readable storage device of claim 17 , wherein the operations further comprise:

auditing multiple invocations of data classification processing routines; and

reporting a result of the auditing.

21 . A system comprising:

a processor system; and

a memory that stores computer-executable instructions that are executable by the processor system to at least:

access a taxonomy-agnostic data protection framework of the computing system, the taxonomy-agnostic data protection framework comprising a plurality of data classification taxonomy definitions of a plurality of respective data classification taxonomies, the plurality of data classification taxonomy definitions comprising a plurality of respective data classification indicators that correspond to a plurality of respective per-taxonomy data protection actions, the plurality of data classification taxonomy definitions comprising a data classification taxonomy definition that comprises a taxonomy identifier and a set of data classification indicators that includes a respective data classification indicator from the plurality of respective data classification indicators;

perform a static analysis of a source code based on at least the data classification indicators; and

report at least one of the following determinations based on at least a result of the static analysis: the source code correctly propagates a particular data classification, the source code does not correctly propagate a particular data classification, or the source code does not apply a particular data classification to particular data even though the particular data has a data type or a data format which is compatible with the particular data classification.

22 . The system of claim 21 , wherein the computer-executable instructions are executable by the processor system further to at least:

generate an annotated data transport structure by annotating a data transport structure with a particular data classification indicator; and

send data, which conforms to the annotated data transport structure, over a network connection.

23 . The system of claim 21 , wherein the computer-executable instructions are executable by the processor system further to at least:

generate annotated data by annotating received data with a particular data classification indicator; and

forward the annotated data over a network connection.

24 . The system of claim 21 , wherein the computer-executable instructions are executable by the processor system further to at least:

acquire an automatically generated data annotation suggestion to annotate a part of the source code with a particular data classification indicator; and

present the automatically generated data annotation suggestion in a user interface.

25 . The system of claim 21 , wherein the computer-executable instructions are executable by the processor system further to at least:

receive sensitive data that is annotated with a particular data classification indicator;

use a mapping mechanism to identify a particular data classification processing routine based on at least the particular data classification indicator; and

invoke the particular data classification processing routine on the sensitive data.

26 . The system of claim 25 , wherein the computer-executable instructions are executable by the processor system further to at least:

map a data classification annotation on the sensitive data to multiple data classifications in the data classification taxonomy definition.

27 . The system of claim 25 , wherein the computer-executable instructions are executable by the processor system further to at least:

audit and report which data classification processing routines are invoked for a specified set of data.