Global PII: SSN, CPF, Aadhaar & More
The US-Centric PII Tool Problem
Most PII tools were built in the United States. They target US data formats. The Social Security Number has nine digits in AAA-BB-CCCC format. Its area, group, and serial segments follow documented rules. US-focused tools catch it well. They also detect US phone numbers, email addresses, and driver's licenses. They miss every national ID used outside the US.
GDPR does not allow a US-only exemption. Take the German Steuer-ID. It is an 11-digit tax ID. The Bundeszentralamt für Steuern issues it. Its final digit is a checksum. It identifies a German resident just as an SSN identifies an American. GDPR Article 4 covers "any information relating to an identified or identifiable natural person." A Steuer-ID fits that definition. It is personal data. That is true whether or not your tool knows the format.
GDPR fines have followed EU-specific PII exposure in systems using US-only tools. The compliance gap is real. Enforcement actions have resulted. See our GDPR compliance guide for context.
The European Identifier Landscape
The coverage gap is large. Here is a country-by-country breakdown.
Germany: Steuer-ID — 11 digits, checksum-validated. Sozialversicherungsnummer — 12 fields, structured. Reisepass — 10 characters with authority codes.
France: NIR is the national social security ID. It has 15 digits. They encode gender, birth year, birth month, department, commune, and a check key. SIRET has 14 digits. SIREN has nine.
Sweden: Personnummer uses format YYMMDD-XXXX. Samordningsnummer covers non-residents. The day value is offset by 60.
Norway: Fødselsnummer has 11 values in format DDMMYYNNNKK. Gender is encoded in the middle group. D-nummer offsets the day value by 40.
Brazil: CPF — Cadastro de Pessoas Físicas — has 11 digits with two check values. CNPJ is the 14-number business ID.
India: Aadhaar is a 12-digit biometric ID. It uses a Verhoeff check. PAN is a 10-digit tax ID with letters and numbers.
UAE: Emirates ID has 15 numbers in the format 784-birth year-sequence-check.
A global HR team covering 12 countries needs one tool. It must handle all 12 national ID formats in a single pass. Maintaining separate regex libraries per country is not workable.
The 285+ Entity Type Architecture
The 285+ entity type library covers all EU member state formats. It also covers major APAC IDs. Those include Aadhaar, PAN, CPF, CNPJ, Emirates ID, and Thai citizen ID. US formats — SSN, EIN, state driver's licenses — are included too. One engine handles them all. The library updates as formats change.
This is the gap most tools leave open. See the entities reference to review what is covered. For API pricing by volume, visit pricing.
When This Approach Has Limits
A single engine that recognizes 285+ national formats genuinely closes the coverage gap that US-built tools leave open. But broad format coverage carries its own limits worth stating plainly.
A format in the library is not the same as a reliable catch. Knowing the structure of a Steuer-ID, NIR, or CPF lets the engine match it, but real documents carry these IDs with inconsistent spacing, OCR errors, local punctuation, and labels in the national language. Checksum validation reduces false positives yet can also reject a correct number transcribed with a typo. Coverage of a format sets the ceiling on detection; it does not guarantee every instance in your files is found. Test the engine against your own country mix rather than trusting the count of supported types.
Formats drift, and a static library goes stale. National identifier schemes change: new ranges open, check algorithms get revised, and entirely new IDs appear. A library that covered a format last year can miss a reissued variant this year unless it is deliberately updated. The article's promise that the library updates as formats change is the mitigation, but it only holds if those updates actually reach your deployment. Confirm how and when format definitions are refreshed for the version you run.
Removing the listed IDs does not by itself anonymize. Even with every national identifier stripped, names, dates of birth, postal codes, and job titles can re-identify a person in combination. Detecting 285+ ID types addresses direct identifiers; it does not resolve the quasi-identifier problem that keeps a dataset pseudonymized rather than anonymized under GDPR. Where the goal is genuine anonymization, plan for generalization or suppression of those combinations on top of identifier detection.