Sensitive data identification, tagging, and protection for GDPR/CCPA