Data governance & privacy

Governance is mostly process and platform. Don't build your own catalogue in .NET; feed an existing one.

// Your taxonomy, matching the classification standard
public static class BankData
{
    public static string Name => "BankData";
    public static DataClassification Confidential => new(Name, nameof(Confidential));
    public static DataClassification Restricted => new(Name, nameof(Restricted));
}
public sealed class RestrictedAttribute() : DataClassificationAttribute(BankData.Restricted) { }

// Program.cs: redact classified values in logs
builder.Logging.EnableRedaction();
builder.Services.AddRedaction(r =>
{
    r.SetRedactor<ErasingRedactor>(BankData.Restricted);   // TFN, card number: removed
    r.SetHmacRedactor(builder.Configuration.GetSection("Hmac"),
                      BankData.Confidential);              // stable hash: still joinable
});

public static partial class Log
{
    [LoggerMessage(LogLevel.Information, "Loan application received for {Tfn}")]
    public static partial void LoanReceived(this ILogger logger, [Restricted] string tfn);
}

public sealed class TfnProtector(IDataProtectionProvider provider)
{
    // The purpose string isolates this use: a protector for "Marketing" can't read these
    private readonly IDataProtector _protector = provider.CreateProtector("Customer.Tfn.v1");

    public string Protect(string tfn) => _protector.Protect(tfn);
    public string Unprotect(string stored) => _protector.Unprotect(stored);
}

// Program.cs: persist and protect the key ring so data survives restarts and scale-out
builder.Services.AddDataProtection()
    .PersistKeysToAzureBlobStorage(blobUri, new DefaultAzureCredential())
    .ProtectKeysWithAzureKeyVault(keyUri, new DefaultAzureCredential());

If you lose the Data Protection key ring, anything you stored with it can never be decrypted. Persist it, back it up, and never delete old keys while data still uses them.

var cosmos = new CosmosClient(accountEndpoint, new DefaultAzureCredential(), new CosmosClientOptions
{
    // The account itself only replicates to these two AU regions
    ApplicationPreferredRegions = [Regions.AustraliaEast, Regions.AustraliaSoutheast]
});

The client option only picks between regions the account already has. Residency is decided by which regions you add to the account, and enforced by policy.

protected override void OnModelCreating(ModelBuilder b)
{
    b.Entity<Customer>(e =>
    {
        e.HasQueryFilter(c => !c.IsDeleted);          // soft delete: hidden from normal queries
        e.ToTable("Customers", t => t.IsTemporal());  // SQL Server keeps every old version
    });
}

// Audit question: "what did we hold for this customer on 31 January?"
var asAt = await db.Customers
    .TemporalAsOf(new DateTime(2026, 1, 31, 0, 0, 0, DateTimeKind.Utc))
    .SingleAsync(c => c.Id == customerId);

Temporal history tables and Key Vault soft-delete both keep data on purpose. Your erasure process must purge history rows too, and purge protection on a vault means a deleted key can't be purged until its retention period ends.

public sealed class CustomerRowValidator : AbstractValidator<CustomerRow>
{
    public CustomerRowValidator()
    {
        RuleFor(r => r.CustomerId).NotEmpty();                      // completeness
        RuleFor(r => r.DateOfBirth).NotNull();                      // completeness
        RuleFor(r => r.Postcode).Matches(@"^\d{4}$");               // validity (AU postcode)
        RuleFor(r => r.Balance).GreaterThanOrEqualTo(-1_000_000m);  // sanity range
    }
}

foreach (var row in rows)
{
    var result = validator.Validate(row);
    if (result.IsValid) curated.Add(row);
    else quarantine.Add(new QuarantinedRow(row, result.Errors));  // alert the steward
}

There's no standard .NET MDM library. Real MDM uses a dedicated platform; .NET code usually integrates with it through APIs or events.

var registry = new CachedSchemaRegistryClient(new SchemaRegistryConfig { Url = registryUrl });

var serdeConfig = new AvroSerializerConfig
{
    AutoRegisterSchemas = false,   // only CI may register schemas, after a compatibility check
    UseLatestVersion = true        // serialise with the latest approved version
};

using var producer = new ProducerBuilder<string, PaymentEvent>(producerConfig)
    .SetValueSerializer(new AvroSerializer<PaymentEvent>(registry, serdeConfig))
    .Build();

await producer.ProduceAsync("payments.v1",
    new Message<string, PaymentEvent> { Key = payment.AccountId, Value = payment });

PaymentEvent here is a class generated from the Avro schema (e.g. with avrogen). The schema file, not the C# class, is the contract.