Topic starter
23/06/2026 9:23 pm
TL;DR: OCR-based DSPM now extends sensitive-data detection into image files stored in cloud buckets, helping organizations find passport photos, ID cards, and other PII that traditional text-focused discovery can miss, according to Orca Security. The governance issue is broader than storage hygiene: identity proofs are now a data-classification and access-control problem, not just an application upload problem.
Editorial analysis by NHI Mgmt Group, based on content published by Orca Security: “Protect Personally Identifying Information (PII) in Image Files like Passports, Voter Cards, and Driver’s Licenses”.
Key questions
Q: How should teams govern identity documents stored in cloud buckets?
A: Treat identity documents as regulated sensitive data, not as incidental uploads.
Q: When does DSPM miss the real risk in image-based identity workflows?
A: It misses the risk when discovery only scans text objects and ignores image content.
Q: What are the signs that identity proof data is being governed poorly?
A: Look for uploads landing in shared buckets, no documented retention period, broad access to raw images and no evidence that OCR or similar discovery is classifying the files.
Practitioner guidance
- Define identity image data classes Classify passport scans, ID photos, voter cards and driver’s licences as regulated identity evidence, not generic uploads.
- Enable OCR in DSPM workflows Validate that sensitive-data discovery includes image files in object storage, especially cloud buckets used by onboarding and verification flows.
- Tie object storage to retention rules Assign retention, deletion and review periods to identity documents based on the business process that collected them.
Bottom line: Image-based identity documents create a discovery blind spot when organisations rely on text-focused scanning alone.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
25/06/2026 2:40 am
OCR turns identity documents into a governance object, not just a file format problem. Once a passport photo or driver’s licence image lands in cloud storage, the question is no longer whether the upload succeeded. The question is whether the organisation can classify that object as regulated identity evidence and bind it to policy. That is why DSPM and IAM now overlap at the point of ingestion, not after the fact.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What is the difference between storing identity documents and governing them?
A: Storing a file only places it in a bucket. Governing it means the organisation knows what the file contains, why it exists, who may view it, how long it may stay, and when it must be deleted or redacted.
👉 Read our full editorial: Image-file DSPM expands sensitive-data detection in cloud buckets
This post was modified 2 days ago by NHI Mgmt Group