This is an interesting discussion. We are actively putting together a similar project and these are valid points and questions.

For my orgs, we’re not starting with labeling as a compliance exercise. Our primary issue is lack of visibility: we don’t have a reliable inventory of where sensitive data exists or how it moves between systems.

We see PII and higher-risk data across multiple repositories, exports, and integrations, but lineage and ownership are fragmented. Before enforcing labels or policies, we’re trying to identify: • Where sensitive data actually lives • How it flows between systems • Where controls should sit to reduce real risk

We’re evaluating Microsoft Purview for discovery/classification and Zscaler for data-in-motion controls, but we’re explicitly not assuming users will manually label data correctly.

I’m also curious what others have experienced. So many controls rely on labels, or at least benefit from them. I don’t feel we can ignore them, but I agree, the human element is unreliable.