UNIVERSAL_PII_INPUT_001

rules/regulations/universal/pii_input_detection.yaml

Citation

Cross-jurisdiction PII detection

Condition

Covers personally identifiable information in user inputs to prevent inadvertent disclosure

Layer 1 detects

a US Social Security number written as three, two and four digits with hyphens (123-45-6789), with single spaces, or with nothing between the groups, so any standalone run of nine digits matches; a card number written as one run of digits: 13 or 16 digits starting with 4, 16 digits starting with 51 to 55, or 15 digits starting with 34 or 37; and the same 16-digit numbers in four groups of four, and the 15-digit ones in groups of 4, 6 and 5, separated throughout by the same single space or hyphen. It checks the format only: it runs no checksum and no range check, so any number of those shapes fires, an order or tracking number included, and a card number of any other prefix or grouping is missed. It reads no names, addresses, email addresses or phone numbers, and it does not judge whether a disclosure is necessary. Whether the text discloses personal information is judged in Layer 2.

Condition type

regex

Status in the file

review