PII Data Scanner for Files

About the PII Data Scanner for Files

Before you share an export with a vendor, migrate a database, answer an access request or delete old files, find out what personal data is in them. Choose your files — CSV and spreadsheets, JSON, text and log files, Word documents and PDFs with a text layer, many at once — and the scanner lists, for each file and each column or field, the kind of personal data it holds, how many values and how many different ones, with masked examples and how sure each match is.

It finds e-mail addresses, phone numbers for the country you choose, card numbers with a valid Luhn check digit, IBANs, Aadhaar numbers with a valid Verhoeff check digit, PAN, GSTINs with a valid check character, UPI IDs, US Social Security numbers, UK National Insurance numbers, NHS numbers with a valid modulus 11 check, IP and MAC addresses and dates of birth. Column and field names point to the rest — names, postal addresses, salaries and the special categories of GDPR Article 9 such as health and religion. The free preview shows every count of one file with the first rows of its inventory — of several files, the first ones; scanning many files at once, the full inventory, the CSV for your record of processing and the PDF report need a Premium pass. The files never leave your device.

Common uses

• Checking an export before it goes to a vendor, an agency or an AI tool.
• Mapping the personal data in shared drives and old exports for a record of processing activities.
• Finding where card numbers, Aadhaar numbers or national insurance numbers ended up in logs and spreadsheets.
• Preparing a data migration or a clean-up: what has to move, be masked or be deleted.

How each kind is found

• Checked numbers: card numbers pass the Luhn check (ISO/IEC 7812-1), IBANs the MOD 97-10 check (ISO 13616), Aadhaar numbers the Verhoeff check, GSTINs their mod-36 check character, NHS numbers the modulus 11 check of the NHS Data Dictionary; US Social Security and UK National Insurance numbers follow the issuers’ rules for numbers never issued.
• Formats: e-mail addresses, PAN, UPI IDs, IP and MAC addresses (private, loopback and documentation addresses are left alone unless you untick the option); phone numbers are checked with the libphonenumber metadata for the country you choose, or must start with +.
• Context: NHS numbers count only in a column named for them or after the word “NHS”, and dates of birth only in a column named for them or after “date of birth”, “DOB” or “born” — any other date could be an invoice date.
• Names of columns and fields: names, addresses, ages, nationality, passport and licence numbers, bank accounts, salaries, usernames, passwords and the special categories are reported from the column or field name, marked “from the name”.

Special category data

Racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used to identify a person, health data and data about a person’s sex life or sexual orientation are special categories under Article 9; criminal convictions and offences fall under Article 10. Recital 35 counts a number assigned to identify a person for health purposes — an NHS number — as health data. Processing them needs a condition of Article 9 as well as a lawful basis, and usually a data protection impact assessment (ICO).

From the inventory to a record of processing

Article 30 asks for a record of the categories of data subjects and personal data, the purposes, the recipients, transfers, the time limits for erasure and the security measures. The inventory CSV lists each file, sheet and column with the kind of data, its category and whether it is a special category, and leaves columns ready for the data subjects, purposes, lawful basis, recipients, transfers, retention and security measures you fill in.

Confidence

• High: a check digit or format matched in at least half of a column, or the column is named for the data.
• Medium: matches in part of a column, or a column name alone.
• Low: a check-digit match in only a few values of a column — about one random 16-digit number in ten passes the Luhn check, and one random 12-digit number in ten the Verhoeff check, so order numbers and IDs can look like card or Aadhaar numbers.

Limitations

• Patterns miss names, addresses and other details written in running text, and can flag numbers that only look like identifiers. Read the inventory as a starting point, not a guarantee that a file is clean.
• Scanned PDFs and images have no text to read: run PDF OCR or Image to Text first, then scan the text. Password-protected files are skipped.
• Up to 50 files at a time, 50 MB each; in each file up to 200,000 rows or 2,000,000 cells, or 20 million characters of text; in a JSON file, lists up to 1,000 items and nesting up to 12 levels. Whatever lies past a limit is named in the file’s notes, never skipped silently.
• It reports what the data is, not whether you may hold it: the lawful basis, the purpose and the retention period are yours to decide. Not legal advice.

Privacy

Your files are read and scanned in your browser and never uploaded or stored. The report shows masked examples only. Only your choices under What to look for are remembered in this browser.