A Boolean PII Flag Is Not Enough

Every data catalog lets you tag a column as PII, true or false. For a platform processing student data under GDPR this single bit drops the questions a data protection officer actually asks: Does the column identify on its own or in combination? Is it raw, pseudonymised, or anonymised? Did a human assert the classification, or did a tool infer it? We classify on two axes plus provenance and…