Desk review etiquette when exports contain sensitive fields

Sensitive exports force creativity, not evasion. We ask teams to pre-aggregate where possible: cohort counts instead of row-level keys, hashed identifiers instead of raw email, and truncated timelines when necessary.

Facilitators annotate with questions, not demands. The goal is to reveal structural risk, not to shame incomplete hygiene.

When redaction removes too much texture, we substitute curated Korean-market sample sets and ask teams to map their process onto the sample. That keeps drills kinetic even when data is constrained.

Document what was redacted and why in the session notes so legal can trace decisions later. Good etiquette here prevents retroactive suspicion when audits arrive.