A non-transitory, computer-readable storage medium having stored thereon a plurality of instructions, which, when executed by a processor of a client computer or a server, cause the processor to:
- identify data stored at one or more network-enabled locations on the client computer;
- determine that a subset of the identified data is personal data representing data relating to an identifiable individual;
- create a policy based on the determined subset of the identified data stored at the one or more locations;
- apply the created policy to monitor only the subset of the identified data at the one or more network-enabled locations where the subset is stored;
- detect an attempted access of the subset of identified data in violation of the created policy;
- and
- generate an alert indicating the attempt to access the subset of identified data in violation of the created policy.