You need one Sensitive Information Type (SIT) per distinct information pattern. The minimum set that covers both SharePoint and Exchange is:
Credit Card Number (built#in) - used for documents and email.
UK National Health Service Number (built#in) - used for documents and email.
EU/UK Physical Address (built#in "EU PII: Physical address").
User credentials (built#in "Credentials"/"User credentials").
Custom keyword#based SIT for the sensitive project names ("Project Tailspin", "Project Contoso", "Project Falcon") - can be one SIT using a keyword list.
SITs are reusable across locations, so you don't count duplicates for email and documents.
References: