A method and a sensitive data discovery engine (SDDE) are provided for discovering substantial sensitive data in source systems spanning across similar and variant data sources and applications. The SDDE configures a scanning pathway for scanning data based on a predefined or configurable unique data classification. The scanning pathway defines a sequence of one or more match operations including master data field, dictionary, code, pattern and exact data matches to be performed on the data for the unique data classification. The SDDE executes the match operations in the scanning pathway on the data based on a scan level, scores the data, and determines sensitive data. The SDDE generates a sensitive data discovery map report including locations of the sensitive data and discovery metadata including information of users and programs that access the sensitive data, generated by inspecting application codes, for use in downstream data protection and governance operations.