PII Detection Tool - Find Personal Data in PDF Documents

What the scanner looks for

Personally identifiable information is anything that points to a specific person, on its own or with a little extra context. The scanner groups what it finds by how much harm a leak could do:

• High risk: Aadhaar, PAN, payment card numbers, US Social Security numbers, IBANs, bank account numbers and passport numbers.
• Medium risk: GSTIN, Voter ID (EPIC), Indian driving licence numbers, UK National Insurance numbers, dates of birth and phone numbers.
• Low risk: email addresses and IP addresses.

How it avoids false alarms

Plenty of numbers have the shape of an ID without being one. An invoice number or an order ID can be twelve digits long, the same as an Aadhaar number. So wherever an ID format has a built-in check digit, the scanner tests it: the Luhn check for cards, Verhoeff for Aadhaar, and mod-97 for IBANs. A number that fails its check is ignored.

Some formats have no check digit and a very common shape, such as passport numbers, bank account numbers, dates of birth and Voter IDs. Those only count when a label sits right in front of them, like "Passport No:" or "DOB". The scanner will miss the odd unlabelled one, but it will not bury you in false matches.

One more safeguard: once part of the text is matched as something specific, nothing weaker can claim it. In testing, a 16-digit card number was first being reported a second time as a phone number. Now each number is reported once, under the most specific type.

Once you have found it

First ask whether the data needs to be in the document at all. If not, remove it from the original. If the file has to go out without it, use Redact PDF, which deletes the text under each box rather than just covering it, and then scan the result again.

Scanned documents need OCR before they can be checked. A scan with no text layer gets a "no text to scan" result, not a false all-clear.