Scoping is accurate when the response team can explain the specific data involved, its owner, its copies across systems, and the obligations attached to it without relying on guesswork. If the conclusion depends on sample files or manual interviews alone, the organisation still lacks defensible blast-radius clarity.