EU ID Gap: Steuer-ID, NIR, Personnummer
US-built PII tools were made for American data. They detect SSNs, US phone formats, and US driver's licenses well. EU identifiers work differently. They follow different structures and different check rules. A US regex will not match a German Steuer-ID. The structural gap is not a minor one.
Why EU Identifiers Are Different
The German Steuer-ID has 11 positions. The first cannot be zero. No position value may repeat more than three times in a row. A checksum formula validates the last position. It is published by the Bundeszentralamt für Steuern. No US SSN pattern will find this.
The French NIR has 15 positions total. Each carries meaning. Position 1 encodes gender. Positions 2–3 encode birth year. Positions 4–5 encode birth month. Positions 6–7 encode the department of birth. Positions 14–15 form a check key. No US format pattern will find a NIR.
The Swedish Personnummer follows the form YYMMDD-XXXX. The Norwegian Fødselsnummer has 11 positions with a two-stage checksum. These formats are not minor US variations. They are set by national law. There is no US equivalent.
The Compliance Gap in Practice
A pan-European HR platform using a US-built PII tool for 18 EU countries will miss most national IDs. Every file with a Steuer-ID, NIR, Personnummer, or Fødselsnummer passes through with that ID exposed.
This gap is systematic. It is not a configuration issue. The tool was simply not built to see these formats.
Full EU Coverage Requirements
Minimum EU coverage for GDPR compliance includes identifiers across several regions.
DACH: German Steuer-ID and Reisepass; Austrian Sozialversicherungsnummer; Swiss AHV-Nr with check value.
France: NIR, Carte Vitale, SIRET, and SIREN.
UK: NHS Number, National Insurance number (AA-NN-NN-NN-A format), and UTR.
Nordic: Swedish Personnummer (YYMMDD-XXXX), Norwegian Fødselsnummer, Finnish Henkilötunnus (DDMMYY-XXXX), and Danish CPR (DDMMYY-XXXX).
Southern EU: Spanish DNI/NIE, Italian Codice Fiscale (16-character alphanumeric), Polish PESEL, and Czech Rodné číslo.
Organizations switching from US-built tools to EU-comprehensive coverage often find their prior tool achieved only 30–40% detection of EU identifiers. Most European national IDs went undetected.
For more on GDPR technical obligations, see GDPR compliance resources.
What Full Coverage Looks Like
A managed EU entity library covers all the formats above. Updates ship when national formats change. No custom code or pull request is needed from your team.
For IDs outside the standard library, a custom entity builder lets you add patterns without writing code. See security and compliance details for how updates and audit trails work.
When This Approach Has Limits
A managed library built specifically for EU and Nordic identifier structures and checksums is the right answer to a US-only tool that scores 30 to 40 percent on European IDs. But limits remain worth stating plainly.
Structural coverage still meets messy real data. Knowing that a NIR has 15 meaningful positions or that a Fodselsnummer uses a two-stage checksum lets the engine match clean values, but documents contain these IDs with national thousands separators, mixed spacing, OCR substitutions, and inconsistent labels across 18 languages. Strict checksum validation cuts false positives yet can also reject a correct number that was mistyped at entry. The library raises detection well above a US-only baseline; it does not reach every instance automatically. Test against your own country-by-country document mix.
National schemes change, and the library has to keep up. Sweden's coordination numbers, revised check rules, and newly issued formats all shift over time. A definition that was current when you deployed can miss a reissued variant later. The article's commitment that updates ship when national formats change is the safeguard, but only if those updates actually reach the version you run. Confirm the update cadence and how custom additions are tested before relying on them for a compliance claim.
Detecting the national ID is necessary, not sufficient. Stripping a Steuer-ID or Personnummer removes one strong direct identifier, but names, birth dates encoded elsewhere, postal codes, and employer details can re-identify a person in combination. Catching the national ID leaves the data pseudonymized rather than anonymized under GDPR, with the obligations that distinction carries. Where true anonymization is the goal, plan to generalize or suppress those quasi-identifiers as well.