Abstract: There is described a method for determining a level of sensitivity of information in an electronic document. The method comprises scanning a computer location to select the electronic document, such as an unstructured document in which the sensitive nature of a given portion of the contents is not trivial. In the electronic document, contents and metadata of the electronic document are scanned, and each occurrence of sensitive data is identified by classifying each portion of the contents forming the electronic document as sensitive, or not sensitive, per se. For each occurrence of the sensitive data, there are determined a type of the sensitive data and a risk score associated to the type of the sensitive data, for example from a knowledge base. Using the risk score of each occurrence of the sensitive data, one can determine an exposure risk score of the electronic document.