Why businesses should identify the information theyre holding