Topic starter
10/07/2026 9:17 pm
TL;DR: Unstructured data now represents 80% to 90% of enterprise information, and much of it sits in email, collaboration tools, and cloud storage where access, retention, and policy enforcement are hard to govern at scale, according to OneTrust. The real issue is not data discovery alone, but continuous control over who can reach sensitive content and how long it remains usable.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “How to Govern Unstructured Data in the Age of AI”.
By the numbers:
- Between 80% and 90% of the world’s data is held in an unstructured format, according to OneTrust.
Key questions
Q: What breaks when unstructured data is not classified and controlled?
A: When unstructured data is not classified and controlled, organisations lose track of what content exists, where it resides, and who can use it.
Q: When does unstructured data create more AI risk than value?
A: Unstructured data becomes a liability when organisations cannot tell what is inside it, who should access it, or whether it contains sensitive information.
Q: What are the signs that data retention is creating unnecessary security risk?
A: Look for stale exports, duplicated records, archives no one can justify, and repositories that have no clear owner or business purpose.
Practitioner guidance
- Implement continuous discovery for unstructured repositories Map email, collaboration, and cloud storage locations to the business data they contain, then keep that inventory current as files move and permissions change.
- Tie access reviews to content sensitivity Review who can reach sensitive documents, not just who holds a platform account, and remove broad access where the content value no longer justifies it.
- Align retention with business purpose Set deletion and review triggers for old emails, shared files, and archived content so retention is justified by policy, not by storage convenience.
Bottom line: Unstructured content becomes a governance risk when access, retention, and AI use are managed separately instead of as one control surface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:40 pm
Unstructured data governance is becoming an identity governance problem. When collaboration platforms and cloud repositories hold sensitive business content, the access model effectively becomes the control plane for privacy and security. That means IAM teams cannot stop at user access reviews if the content itself is uncontrolled. The practitioner conclusion is simple: entitlement governance and data governance now have to operate as one discipline.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams govern unstructured data for GenAI use cases?
A: Security teams should govern unstructured data by mapping content to business context, human relevance, and downstream AI use paths, not by relying on labels alone. The practical test is whether the programme can identify what a document means and who it affects before an LLM can ingest or reuse it. That requires combining DSPM, access policy, and business ownership.
👉 Read our full editorial: Unstructured data governance is becoming an AI control problem