pii-detection

name	pii-detection
description	Detect personally identifiable information (PII) in code, data, and agent outputs before processing or storage. Multi-language, GDPR-aware.
version	1.0.0
last-updated	2026-04-17
model_tested	claude-sonnet-4-6
category	privacy
platforms	["claude-code","codex","gemini-cli","cursor","copilot","windsurf","cline"]
language	en
geo_relevance	["global","eu","fr"]
priority	high
dependencies	{"mcp":[],"skills":[],"apis":[],"data":[]}
update_sources	[{"url":"https://www.cnil.fr/fr/reglement-europeen-protection-donnees","check_frequency":"yearly","last_checked":"2026-04-21"}]
license	MIT

PII Detection

DISCLAIMER: This skill provides detection patterns only. It does not guarantee complete PII identification. Always verify with a DPO for GDPR compliance decisions.

When to Use

• Before sending data to an LLM API
• Before logging or storing agent outputs
• During data pipeline design
• When reviewing code that handles user data
• Before sharing datasets or exports

PII Categories

High Sensitivity (must always detect)

Category	Patterns	Examples
Email	\b[\w.-]+@[\w.-]+\.\w+\b	[e-mail]
Phone	\+?\d[\d\s\-().]{7,}\d	[phone]
SSN (FR)	\b[12]\s?\d{2}\s?\d{2}\s?\d{2}\s?\d{3}\s?\d{3}\s?\d{2}\b	1 85 05 75 123 456 78
SSN (US)	\b\d{3}-\d{2}-\d{4}\b	123-45-6789
Credit Card	\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b	4111-1111-1111-1111
IBAN	\b[A-Z]{2}\d{2}[\s]?[\dA-Z]{4}[\s]?[\dA-Z]{4}[\s]?[\dA-Z]{4}	FR76 1234 5678 9012
Passport	Context-dependent	12AB34567

Medium Sensitivity (detect in context)

Category	Patterns	Notes
Full name	Named entity recognition	Combine first + last name
Address	Street + city + postal code	Multi-format per country
Date of birth	Date near age/birth context	Not all dates are PII
IP Address	\b\d{1,3}(\.\d{1,3}){3}\b	IPv4; check if user-linked
Vehicle plate	Country-specific format	FR: AA-123-BB

Low Sensitivity (flag only)

Category	Notes
Age	PII only when combinable
Gender	PII only when combinable
Location (city)	PII only when precise
Job title	PII only with employer

Detection Process

1. Scan the input text for high-sensitivity patterns
2. Flag medium-sensitivity items with context check
3. Report findings with location and category
4. Recommend action: redact, anonymize, or approve

Remediation Actions

Action	When	Method
Redact	Before logging	Replace with [REDACTED]
Pseudonymize	Before analysis	Replace with consistent fake (e.g., hash-based)
Anonymize	Before sharing	Remove irreversibly (k-anonymity, differential privacy)
Encrypt	Before storage	AES-256 at rest, TLS in transit
Approve	Legitimate purpose	Document legal basis (GDPR Art. 6)

GDPR Special Categories (Article 9)

These require explicit consent or legal basis:

• Racial or ethnic origin
• Political opinions
• Religious beliefs
• Trade union membership
• Genetic data
• Biometric data (for identification)
• Health data
• Sex life or sexual orientation

Detection: Use keyword lists + context analysis. Never store without documented legal basis.

Output Format

PII SCAN REPORT
Source: {file/variable/output}
Items found: {count}

[HIGH] Email: [e-mail] (line 42)
[HIGH] Phone: [phone] (line 67)
[MED]  Full name: "Jean Dupont" (line 12, with address context)
[LOW]  City: "Paris" (line 15, no combination risk)

Recommendation: Redact HIGH items before processing.
GDPR basis required: YES (personal data detected)

What This Skill Does NOT Do

• Does not encrypt or store data (patterns only)
• Does not determine GDPR legal basis (legal decision)
• Does not handle consent management (UI/UX concern)
• Does not replace a DPO assessment