Packages / Legal And Law Enforcement
Legal privilege, investigations, enforcement, case material, and evidentiary records.
Detects documents containing intelligence holdings, surveillance methods, evidence gaps, and investigative strategy against active criminal investigation targets. These target packages reveal the full picture of what police know and do not know about a suspect, enabling counter-surveillance and evidence destruction if disclosed.
Detects pre-release adoption records including birth parent identities, adoptee matching assessments, placement recommendations, relinquishment consents, and contact vetoes under the Adoption Act 2009 (Qld). These records contain information that individuals have a legal right to control — premature or unauthorised disclosure can cause profound emotional harm and breach court-sealed orders.
Detects populated compliance assessment and audit reports: the report title (compliance assessment / audit / review report, regulatory compliance assessment, gap analysis report) together with populated finding, control, status, rating and remediation fields.
Detects populated data breach reports and assessments under the Commonwealth Notifiable Data Breaches (NDB) scheme (Privacy Act 1988 Part IIIC): breach report / notification / assessment titles together with populated breach record fields (entity, dates, individuals affected, information involved, incident reference). The Queensland mandatory notification of data breach scheme (IPA 2009 Chapter 3A) is out of scope and will be a separate classifier.
Detects charge sheets, court briefs, court lists, criminal histories and corrections records for domestic and family violence offences against an identified person: Queensland coercive control (Criminal Code s334C, from 26 May 2025) and engaging in domestic violence to aid a respondent (s179A); NSW abusive behaviour towards current or former intimate partners (Crimes Act s54D, from 1 July 2024); Tasmanian persistent family violence (Criminal Code s170A), economic abuse and emotional abuse or intimidation (Family Violence Act 2004 ss8-9); SA coercive control (Criminal Law Consolidation Act s20C, not yet proclaimed); contraventions of protection, intervention and restraining orders in every jurisdiction; and "domestic violence offence" notations (Qld Criminal Code s1 and Penalties and Sentences Act s12A; NSW Crimes (Domestic and Personal Violence) Act s12).
Detects police domestic and family violence (DFV) incident records and the referrals police send to specialist and government services: Queensland QPRIME DV occurrences, Victoria Police L17 Family Violence Reports, NSW DV events, and DFV incident, call-out and attendance records in other jurisdictions. These records travel beyond police to housing, child safety, health, education and specialist DFV services, so they turn up in general agency mailboxes and file shares.
Detects domestic and family violence protection orders, police-issued notices and directions, and applications for them, in every Australian jurisdiction, when the document names the parties. Covers Qld protection orders, temporary protection orders, Police Protection Notices and Police Protection Directions; NSW apprehended domestic violence orders (including provisional orders); Vic family violence intervention orders and family violence safety notices; WA family violence restraining orders; SA intervention orders; Tas police family violence orders and family violence orders; ACT family violence orders (interim and after-hours); NT domestic violence orders; and recognised DVOs under the National Domestic Violence Order Scheme. Complements the Queensland-specific domestic-violence-order-application classifier.
Detects completed domestic and family violence (DFV) risk assessments, safety plans and multi-agency risk meeting records for an identified person, across Australian frameworks: Qld Common Risk and Safety Framework (CRASF), QPS Domestic Violence Protective Assessment Framework (DV-PAF) and High Risk Teams; NSW Domestic Violence Safety Assessment Tool (DVSAT) and Safety Action Meetings; Vic MARAM; WA CRARMF; SA and NT Family Safety Framework meetings and Positive Action Plans; NT RAMF Common Risk Assessment Tool; and generic DFV risk assessments and safety plans.
Detects Australian enterprise agreement and enterprise bargaining content under the Fair Work Act 2009 - agreement text and drafts (single-enterprise and greenfields agreements, nominal expiry, better off overall test), Fair Work Commission agreement codes (AE followed by six digits), and bargaining process artefacts (notice of employee representational rights, protected action ballots, logs of claims).
Detects completed Notices of Child Abuse, Family Violence or Risk filed in parenting proceedings in the Federal Circuit and Family Court of Australia (Family Law Act 1975 ss67Z, 67ZBA, 69ZQ(1)(aa)), including the earlier "Notice of Child Abuse, Family Violence or Risk of Family Violence" and the Family Court of Western Australia Form 4 "Notice of Child Abuse and Family Violence (or Risk)". The notice records allegations of child abuse or neglect, family violence, substance misuse, mental health issues and abduction threats against named parties and children, and child abuse allegations are reported to the prescribed child welfare authority.
Detects Freedom of Information Act exemption section references (sections 33-38 and 42-47) in Australian government documents. Requires FOI/freedom of information keyword context.
Detects populated Australian loan agreements and credit contracts: a loan agreement / credit contract / loan facility phrase combined with named borrower or lender fields, a stated loan amount or repayment, or a loan/facility reference number. Phrase-only mentions stay discovery-only.
Detects the Australian Government PROTECTED protective marking (PSPF / QGISCF) in both email and document forms, sweeping up its IMM/caveat variants (Personal-Privacy, Legal-Privilege, Legislative-Secrecy, CABINET, NATIONAL-CABINET). SECRET and TOP SECRET roll up here so they receive at-least-PROTECTED handling. Regex logic ported from Microsoft's canonical PSPF SIT guidance; matched case-sensitively.
Detects the Australian Government SENSITIVE tier in both email and document forms: Commonwealth OFFICIAL: Sensitive (including its IMM/caveat variants such as Personal-Privacy, Legal-Privilege, Legislative-Secrecy) and the Queensland (QGISCF) standalone SENSITIVE marking. Regex logic ported from Microsoft's canonical PSPF SIT guidance; matched case-sensitively.
Detects populated Australian mortgage documents (mortgage deeds, home loan contracts, registered mortgages, discharges): the mortgage phrase combined with named mortgagor/mortgagee fields, a security property or title reference, or a secured loan amount. Phrase-only mentions stay discovery-only.
Reportable incident notifications and investigation records for a named NDIS participant: death, serious injury, abuse or neglect, unlawful sexual or physical contact, sexual misconduct and unauthorised use of a restrictive practice (24-hour immediate notification and 5-business-day report).
Detects Nationally Coordinated Criminal History Check (National Police Check) certificate and application reference numbers issued through the ACIC National Police Checking Service. Matches a police check phrase near a reference / certificate / receipt value that identifies a specific check.
Detects Queensland blue card (working with children check) applications, renewals and screening outcomes for a named applicant - blue card application or renewal records, positive or negative notices and exemption cards - when the phrase sits with populated applicant identifiers and application fields.
Notifications to the Crime and Corruption Commission of suspected corrupt conduct (Crime and Corruption Act 2001 s38), s40 direction assessments and internal corrupt-conduct assessment and investigation records that name the subject officer.
Council records of requests for CCTV footage and of footage released: request forms from residents, insurers and businesses, police requests, and release registers or logs recording the camera, the footage period, the incident or Queensland Police Service (QPS) reference, and who received the footage. No Queensland statute deals specifically with council CCTV. Councils handle footage as personal information under the Information Privacy Act 2009 and their CCTV policy. A disclosure to a law enforcement agency relies on QPP 6.2(e) (disclosure reasonably necessary for enforcement-related activities), and QPP 6.5 requires the agency to make a written note of that disclosure. That note is the basis of the release register. Council CCTV policies, published camera location lists, legislation and news are decoys.
Queensland Corrective Services Victims Register applications (Form 49), referrals (Form 49a), nominee registrations and notifications linking a registered victim or eligible person to a named offender (parole, discharge, escape, transfer, death). Around 60% of registrations relate to domestic and family violence.
Queensland Corrective Services statutory orders and decisions about a named prisoner: safety orders (including temporary and consecutive), maximum security orders, separate confinement orders, breach of discipline, transfer orders, leave of absence, discharge orders and security classification decisions under the Corrective Services Act 2006.
Council agenda reports, attachments and minutes for business closed to the public under Local Government Regulation 2012 s254J: CEO or staff appointment, discipline or dismissal; rating concessions; commercial negotiations; land acquisition; legal advice and other confidential matters.
Council-issued infringement notices for local law and animal management offences, and the default certificates and referral records that send unpaid notices to the State Penalties Enforcement Registry (SPER). Under State Penalties Enforcement Act 1999 s 15, an infringement notice must state a unique number for the notice, its date, the alleged offender's full name and address, the offence particulars (place, time and date, and identifying particulars for any animal or vehicle), and the fine. s 22 and s 23 set out payment, court election and instalments within 28 days. When the alleged offender defaults, the administering authority may give SPER a default certificate (s 33), and SPER may then issue an enforcement order (s 38). Council compliance and remedial notices (Local Government Act 2009 s 138AA) often precede the infringement. Local law registers are public, but individual notices and SPER referral batches are not.
Complaints, assessments, investigations and referrals about councillor conduct handled by the Office of the Independent Assessor (OIA), councils and the Councillor Conduct Tribunal: conduct breaches, misconduct, unsuitable meeting conduct, conflicts of interest and release of confidential information.
Completed enduring powers of attorney (Form 2 short form, Form 3 long form) and advance health directives (Form 4) under the Powers of Attorney Act 1998: principal and attorney details, financial and personal/health powers, life-sustaining treatment directions and capacity statements.
Detects completed Queensland patient consent records - informed, treatment, surgical and anaesthetic consent forms, advance health directives and enduring power of attorney (health) documents - when the consent phrase sits with populated patient identifiers and consent form fields.
Detects Queensland mental health assessment and involuntary treatment records - psychiatric assessments and evaluations, mental state examinations, examination and treatment authorities, forensic orders, recommendations for assessment and Mental Health Review Tribunal matters - when the phrase sits with populated patient identifiers and assessment fields.
Elector-level records from ECQ's compulsory voting enforcement process: apparent failure to vote notices issued after a State or local government election (Electoral Act 1992 (Qld) s 134), elector responses giving a valid and sufficient reason for not voting or saying that they did vote and giving the details, payment records (s 135), infringement notices for failing to vote (s 186; LGEA 2011 ss 165, 166, 168), and referrals of unpaid notices to the State Penalties Enforcement Registry (SPER). ECQ's published process is apparent failure to vote notice, then infringement notice, then SPER referral. Excuses often disclose health conditions, hospital admissions, disability, bereavement, travel, religious duty (s 186(2)) or family circumstances. The "Do I have to vote?" page, penalty unit value statements, aggregate non-voter statistics and blank response forms are decoys.
Parole applications, Parole Board Queensland decisions and parole orders for a named prisoner: court ordered and board ordered parole, exceptional circumstances parole, conditions, show-cause notices and amendment, suspension or cancellation orders.
Tenancy enforcement records for named social housing tenants: Antisocial Behaviour Policy warnings and strikes, Acceptable Behaviour Agreements, Notice to remedy breach (Form 11), Notice to leave (Form 12) and termination and QCAT tenancy applications.
Public interest disclosures under the Public Interest Disclosure Act 2010 (Qld) and the records that identify the discloser: assessments, reprisal risk assessments, referrals to a proper authority and investigation files. Disclosure of a discloser's identity is an offence and exposes them to reprisal.
QCAT applications and orders appointing or reviewing guardians and administrators for adults with impaired decision-making capacity (Form 10), interim orders and supporting health-professional reports.
Queensland council animal management enforcement records under the Animal Management (Cats and Dogs) Act 2008. Covers proposed declaration notices (s 90: breed, colour, sex, distinguishing marks, reasons, written representations within at least 14 days), regulated dog declarations (s 89 and s 94: declared dangerous or declared menacing dog), information notices (s 95), destruction orders (s 127A) and dog attack investigation or complaint records (attack offences ss 194-195). These records name the owner, the dog, the address and, for attacks, the victim and their injuries. The state regulated dog register may be inspected only by officers, owners and similar persons (s 173). The council dog registry is open to inspection, but owner information is excluded (s 179(2)), so a registry extract without owner details is not matched at enforce tiers. Restricted dog provisions survive only as transitional permits after the 2024 amendments (Act No. 17 of 2024), which introduced prohibited dogs (s 127).
Completed notifications and reports under the Queensland Reportable Conduct Scheme in the Child Safe Organisations Act 2024 (Qld), which commenced on 1 July 2026 and is regulated by the Queensland Family and Child Commission (QFCC). The head of an entity must give QFCC an initial notification within 3 business days of becoming aware of a reportable allegation or conviction, an interim report within 30 business days and a final report with the investigation findings. A populated record names the worker (name, date of birth, role, Blue Card or exemption notice number), the child, the head of entity or delegate, the type of reportable conduct (child sexual offence, sexual misconduct, ill-treatment, significant neglect, physical violence, or behaviour causing significant emotional or psychological harm), dates, and risk-management steps. The scheme page, the QFCC guideline, the Act and blank forms are decoys. Reportable conduct records from other states' schemes (NSW, Vic, ACT) that use the same labels can also reach 75; the Queensland-specific corroborative terms mostly lift only Queensland records to 85.
Positive behaviour support plans, restrictive practice approvals and authorisations for a named adult with disability: containment, seclusion, chemical, mechanical and physical restraint and restricted access to objects; short-term approvals by the Office of the Public Guardian and QCAT approvals under the Disability Services Act 2006 Part 6.
Case records for access applications under the Right to Information Act 2009 (Qld): the s 24 access application (including the combined Right to Information and Information Privacy Access Application form), s 37 consultation with a relevant third party, and the s 54 decision notice giving reasons, with refusal grounds under s 47(3) - exempt information (s 48, schedule 3) and contrary to public interest information (s 49, schedule 4) - plus internal review (s 80) and external review by the Information Commissioner (s 85). A populated record carries the applicant's name, the application reference, dates received/decided, the documents sought, page counts, third parties consulted, the decision maker and the outcome. Published disclosure logs (s 78A) are public and treated as decoys, as are the Act, OIC/RTI guidance and blank forms. Overlaps with au-foi-exemption-references, which matches Commonwealth FOI Act exemption section references (ss 33-47) and does not cover Queensland schedule 3/4 grounds. India's Right to Information Act 2005 applications are excluded.
Completed applications for financial assistance under the Victims of Crime Assistance Act 2009 (Qld) ss 51-52, made on the Victim Assist Queensland "Financial Assistance Application Form: Primary victim" (Form 1, Version 5, effective 14 September 2023) or recorded in Victim Assist case files: the primary victim's name and date of birth, the act of violence (what happened, key dates, offender name), police report details (reference number, station, investigating officer) or special primary victim report details (for example a domestic violence worker), injuries, recognition payment (special assistance) and recovery expense claims, and safe contact arrangements. Acts of violence include domestic and family violence, sexual offences and child abuse. The blank form, qld.gov.au application guidance and media coverage are decoys.
Youth justice orders and detention records for a named young person under the Youth Justice Act 1992: detention and conditional release orders, restorative justice orders and agreements, and youth detention centre records (Brisbane Youth Detention Centre, Cleveland Youth Detention Centre, Wacol Youth Remand Facility).
Identifies Australian physical addresses using structural street-number + street-name regex combined with road-type, state/territory, and postcode corroborative evidence. Covers the implemented road-type endings: the standard abbreviated set plus the declared extended endings (Rise, View, Gardens, Loop, Trail, Track, Pass, Heights) — not the full GNAF classification list.
Records that carriers and carriage service providers must make of disclosures of protected information (Telecommunications Act 1997 (Cth) Part 13, s 276 primary offence) to law enforcement and enforcement agencies: the s 306 record (made within 5 days of the disclosure and kept for 3 years) and the s 306A record for prospective authorisations. A populated record gives the name of the person who disclosed the information, the date of disclosure, the grounds (for example s 280 authorised by law, s 313 assistance), warrant or authorisation details including authorisations under ss 178, 179 or 180 of the Telecommunications (Interception and Access) Act 1979, the authorising officer and date, the requesting agency and request date, the service disclosed and the s 187AA data-set items. The same fields appear in agency authorisation / request notices received by the provider. OAIC guidance, the Acts, ACMA and TIA Act annual report statistics and blank templates are decoys. Overlaps with lawful-interception-warrant, which covers interception and stored communications warrants (TIA Act secrecy) rather than Part 13 disclosure records; a record that cites the TIA Act next to a service number may also fire that classifier.
Academic misconduct and academic integrity case records for a named student: allegations and findings of plagiarism, collusion, contract cheating, fabrication or recycling, notices of allegation, hearings, penalties and appeals (TEQSA Threshold Standard 5.2).
Identifies documents containing references to legal full name in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to lawful intercept transcripts in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
Detects bail condition documents including bail undertakings, surety arrangements, and conditions imposed on accused persons under the Bail Act 1980 (Qld). These documents contain personal details of accused persons, reporting obligations, curfew details, exclusion zones, and no-contact conditions.
Detects Canada Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
Detects legal annexures to Cabinet submissions containing privileged legal analysis supporting Cabinet decision-making. These documents carry dual protection: Cabinet confidentiality (Westminster convention) and legal professional privilege. Disclosure breaches both simultaneously with no remediation possible.
Detects Swiss passport numbers issued by fedpol (Federal Office of Police). Passports of the 2003, 2006 and 2010 series carry an eight-character number consisting of one uppercase letter followed by seven digits (e.g. E1234567); the 2010 series always begins with the letter X. The letters O and I are never used, to avoid confusion with the digits 0 and 1. The 2022 series (the only series issued since October 2022) has no published fixed structure — fedpol deliberately keeps the numbering rules non-public — so 2022-series numbers may not match this shape. Only the documented 2010-and-earlier format is covered.
Detects documents containing child exploitation investigation case files including victim identification data, offender network intelligence, and investigative techniques used against CSAM distribution networks. QPS Task Force Argos is the primary Queensland unit. Disclosure re-victimises children and compromises active rescue operations.
Detects child safety investigation case files containing child identifiers, harm notifications, investigation outcomes, child protection orders, and out-of-home care placements under the Child Protection Act 1999 (Qld). These files contain highly sensitive information about vulnerable children including substantiated abuse details — unauthorised disclosure endangers child safety and compromises ongoing investigations.
Detects defence strategy documents for class action proceedings against the State or State entities. These documents reveal the State's vulnerability assessment and defence approach for claims potentially affecting thousands of claimants. Note: trainable classifier recommended for production using class action document structural features.
Detects Mainland China Unified Social Credit Codes (统一社会信用代码) assigned to legal persons and other organisations. The code is 18 characters using a restricted alphabet (digits and selected letters excluding I, O, Z, S, V), with an embedded administrative division code in positions 3-8.
Detects draft legal submissions to Commissions of Inquiry established under the Commissions of Inquiry Act 1950 (Qld). Disclosure prejudices the State's participation and may breach statutory confidentiality.
Detects community-based corrections orders including probation orders, parole conditions, and community service orders issued under the Corrective Services Act 2006 (Qld). These documents contain offender details, supervision conditions, approved addresses, and compliance assessments by Queensland Corrective Services.
Detects documents containing the identities of police informants (confidential human sources, confidential / registered informants, registered sources) embedded within criminal organisations. Informant identity is the single most sensitive category of law enforcement information globally. Disclosure has historically resulted in murders and creates immediate lethal risk. Absorbs the former confidential-informant-identities classifier.
Detects controlled operation authorisations under PPRA 2000 (Qld) Part 5. Controlled operations involve officers in criminal activity under legal authority. Disclosure reveals officers and operational scope.
Detects published coronial findings and recommendations under the Coroners Act 2003 (Qld). Although coronial findings are public documents, they contain sensitive details about the circumstances and cause of death, manner of death, and identity of deceased persons. Government agencies handling these documents should classify them as SENSITIVE Legal due to the distressing nature of the content.
Detects draft government submissions to coronial inquests before filing. These submissions address deaths in government settings (custody, hospitals, child safety) and reveal the State's candid position on systemic failures before formal filing.
Detects pre-publication coronial investigation files including evidence, witness statements, and draft findings. Published coronial findings are SENS_Law, not PROT_Law.
Detects documents containing prison intelligence reports including gang assessments, inmate risk ratings, informant identities within correctional facilities, and security threat group (STG) analyses. Disclosure endangers correctional staff, informant inmates, and undermines facility security.
Detects documents containing terrorism threat assessments, persons of interest profiles, and counter-terrorism operational capabilities. Disclosure enables counter-surveillance by terrorist subjects and compromises national security monitoring. Includes JCTT (Joint Counter Terrorism Team) and QPS Security and Counter-Terrorism Group documents.
Detects court filing references from Queensland courts (Magistrates Court, District Court, Supreme Court) containing proceeding numbers, party names, and registry details. Unpublished filings contain personal details of parties, allegations, and evidence that are not yet in the public domain.
Detects documents containing the true identities of undercover law enforcement officers deployed within criminal organisations. These records link assumed identities (legends) to real identities and are among the most life-critical records in law enforcement. Disclosure directly endangers the lives of deployed operatives and destroys years of infiltration work.
Detects documents containing intelligence shared between Australian and international law enforcement agencies under formal exchange agreements. Disclosure damages international trust relationships, violates originator control (ORCON) principles, and compromises joint operations.
Detects privileged legal opinions issued by the Queensland Crown Solicitor or Office of the Crown Solicitor. These documents constitute the highest level of legal professional privilege in Queensland Government and their disclosure permanently waives privilege under Evidence Act 1977 (Qld) s.14.
Detects cybercrime investigation technical evidence including digital forensics, malware analysis, cryptocurrency tracing, dark web investigations, and covert online personas. Disclosure enables cybercriminals to develop countermeasures.
Detects domestic violence order applications and conditions under the Domestic and Family Violence Protection Act 2012 (Qld). These documents contain details of aggrieved persons, respondent details, allegations of domestic violence, ouster conditions, and protection order terms. Disclosure could endanger the aggrieved person.
Detects donor conception records including donor identity information, recipient details, offspring matching, and assisted reproductive technology treatment records under the Status of Children Act 1978 (Qld). These records contain the most sensitive reproductive information — donor identities, recipient medical details, and biological parentage links. Unauthorised disclosure can permanently alter family relationships and breach legal confidentiality protections.
Detects documents containing drug trafficking investigation intelligence including targets, supply chain mapping, precursor chemical tracking, clandestine laboratory intelligence, and cross-border interdiction plans. QPS Drug and Serious Crime Group is the primary unit. Disclosure enables traffickers to destroy evidence, alter supply routes, and eliminate informants.
Detects EU declarations of conformity for high-risk AI systems under Article 47 and Annex V of the EU AI Act (Regulation (EU) 2024/1689). By drawing up the declaration the provider assumes responsibility for compliance; pre-signature drafts and the surrounding conformity-assessment correspondence reveal the provider's compliance posture, notified-body findings, and certificate details before market placement.
Detects deployer-side fundamental rights impact assessments (FRIA) under Article 27 of the EU AI Act (Regulation (EU) 2024/1689). A FRIA is performed before deploying certain high-risk AI systems by public bodies, private providers of public services, and deployers of credit-scoring and life/health-insurance pricing systems (Annex III points 5(b) and (c)). Completed FRIAs contain candid assessments of risks of harm to specific categories of natural persons and are sensitive before notification and remediation.
Detects general-purpose AI (GPAI) model provider documentation under Article 53 of the EU AI Act (Regulation (EU) 2024/1689): Annex XI technical documentation for the AI Office, Annex XII information packs for downstream providers, the Article 53(1)(d) public summary of training content, and Article 55 systemic-risk evaluation material (adversarial testing / red-teaming reports). Pre-publication drafts reveal model internals, training-data provenance, compute and energy figures, and systemic-risk findings.
Detects Article 11 / Annex IV technical documentation for high-risk AI systems under the EU AI Act (Regulation (EU) 2024/1689). This documentation must demonstrate compliance of the high-risk AI system before placing on the market and contains commercially sensitive material — system architecture, design specifications, training-data datasheets, risk management findings, and known limitations — whose uncontrolled disclosure exposes trade secrets and the provider's compliance posture.
Detects forensic evidence and chain-of-custody records for active criminal or security investigations, including exhibit registers, DNA/fingerprint/ballistics results, custody handovers, and formal chain-of-custody documentation.
Catalogue reference for the Microsoft Purview built-in All Physical Addresses bundled named-entity SIT, which contains country and region physical-address SITs including Australia physical addresses. This YAML-only record supplies supplementary address vocabulary for registry search and testing; it does not reproduce Microsoft's opaque named-entity resources and is not a custom XML clone.
Detects commercial lease agreements containing premises details, rental terms, and tenant obligations.
Detects sensitive employment case records about an identified worker: workplace investigations, disciplinary action and show cause notices, grievance and harassment complaints, workers compensation and return to work plans, termination and redundancy notices.
Detects populated guarantee and indemnity instruments (personal/corporate/continuing guarantees, deeds of guarantee, guarantor agreements) that name the guarantor or borrower, state a guaranteed amount or limit, or carry an ABN/ACN. Phrase-only mentions stay discovery-only.
Detects ISO 17442 Legal Entity Identifiers (LEIs) — the 20-character uppercase alphanumeric codes issued under the Global LEI System (GLEIF) that uniquely identify legal entities in financial transactions. Structure: characters 1-4 are the LEI-issuer (LOU) prefix, characters 5-6 are reserved and set to "00", characters 7-18 are the entity-specific part, and characters 19-20 are numeric check digits (ISO 7064 MOD 97-10). Requiring the literal "00" at positions 5-6 and two digits at positions 19-20 makes the format far more distinctive than a generic 20-character alphanumeric run. Known recall cost: pre-2013 CICI-era legacy LEIs — interim identifiers issued before the "00" reservation, grandfathered into the GLEIF system and still live and checksum-valid — do not carry "00" at positions 5-6 and are NOT matched. This class includes major counterparties such as Microsoft (INR2EJN1ERAN0W5ZP974), Deutsche Bank (7LTWFZYICNSX8D621K86) and Apple (HWUPKR0MPOU8FGXBT394), so documents dealing with such entities' LEIs will be missed. This is a deliberate precision-over-recall trade-off: dropping the "00" anchor would widen the pattern to any 20-character uppercase alphanumeric run ending in two digits.
Detects references to nationality/citizenship/immigration-status disclosure: nationality fields, national origin, citizenship status, visa status, and naturalization records. Unlike the three sibling Art-9 patterns in this wave (sexual-orientation, religious-beliefs, racial-ethnic-origin), nationality is NOT a GDPR Article 9 special category — it is processed under GDPR's ordinary Article 6 lawful-basis regime. It is grouped with the Art-9 set here because it shares the same detection problem (an attribute value with no fixed format) and was bundled with them in the C3 deprecation/gap analysis, and because national origin carries real discrimination risk. Topic-grade detector, low confidence by design.
Detects populated security agreements and PPSR registrations: a security agreement / PPSR / personal property securities phrase combined with a named grantor or secured party, a PPSR registration or financing statement number, or described collateral. Phrase-only mentions stay discovery-only.
Detects religious or philosophical belief information in person-linked membership, patient, workforce, census, pastoral-care, and accommodation records. The detector recognises explicit belief, affiliation, observance, denomination, and structured religion-field terminology, then raises confidence only for person records and populated belief or accommodation statements. Religious or philosophical beliefs are protected under GDPR Article 9 and Australian anti-discrimination and privacy law. Topic-grade detector, low confidence by design.
Detects references to reproductive and sexual-health data: pregnancy, abortion, contraception, fertility treatment, gender-affirming care and STI/HIV status. Washington's My Health My Data Act (and a wave of post-Dobbs state consumer-health-data laws) treat this as protected consumer health data. Topic-grade vocabulary detector.
Detects populated residential tenancy agreements (including Queensland Form 18a general tenancy agreements): the tenancy-agreement phrase combined with named tenant/lessor fields, a numbered premises address, a stated rent or bond amount, or a bond number. Phrase-only mentions stay discovery-only.
Detects populated cyber security incident reports: incident report / post-incident review titles together with incident record fields (incident ID, severity, detection time, affected hosts, source IPs) or technical artefacts (IPv4 addresses, CVE identifiers).
Detects sexual-orientation information in person-linked workforce, patient, survey, member, relationship, intake, and case records. The detector recognises the explicit sexual orientation phrase, orientation-specific identification statements, coming-out statements, and same-sex partner or spouse references, then raises confidence only for person records and populated attributions. It deliberately excludes transgender status, gender identity, and pronouns because those are distinct attributes. Sexual orientation is protected under GDPR Article 9 and Australian anti-discrimination and privacy law. Topic-grade detector, low confidence by design.
Detects subscription agreements, recurring billing terms, and SaaS licence documentation.
Identifies personal records that link a person to previous legal names or aliases (former, maiden, birth or assumed names, deed-poll name changes, also-known-as entries) with populated identity fields.
Identifies documents containing references to police identity number in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to prisoner identification number in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to workplace investigation files in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Detects references to payment fraud investigation files in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Identifies documents containing references to procurement fraud investigation files in international contexts. These are investigative and procurement-sensitive records that may contain personal allegations; the category is not blanket personally identifiable information.
Identifies legal advice memoranda, legal opinions and privileged lawyer-client communications (legal professional privilege / client legal privilege, solicitor-client or attorney-client privilege, privilege logs). These are privileged or confidential legal advice records; the category is not personally identifiable information, and a match does not prove that privilege attaches. Absorbed global-top500-164-attorney-client-privileged-communications (2026-09-24).
Identifies antitrust / competition-law legal analyses prepared as memos or advice: competition-law topic phrases inside a populated legal document header, with competition-specific analysis evidence at the high tier. These are commercially and legally sensitive analyses; the category is not personally identifiable information.
Identifies board and adviser plans for defending against shareholder activists or hostile bids (activist defence, proxy fight, poison pill, takeover defence, white knight) prepared as populated board papers or memos. Commercial and legal information, not personally identifiable information.
Identifies documents containing references to field failure investigation reports in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Detects forensic disk-image acquisition records: image or acquisition-log wording with evidence/exhibit numbers, examiner, device serials, image file names and verification hashes. Topic wording alone is discovery-only.
Detects insider-threat investigation files: insider-risk or employee investigation wording with populated subject details (employee, position, case number, allegation) and user-activity evidence. Topic wording alone is discovery-only.
Identifies academic misconduct / plagiarism investigation files about an identified student or researcher: investigation vocabulary together with populated student and case fields (name, student ID, unit, assessment, similarity score, allegation, outcome).
Identifies criminal history records and police identifying-particulars records (custody / booking photographs, photograph index numbers, fingerprints and other identifying particulars taken, linked to a named person, date of birth and police person numbers). Absorbs the former mugshot-image-repositories classifier. This information is personally identifiable law-enforcement information under applicable privacy regulations.
Identifies documents containing references to witness identity records in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to investigation case notes in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to surveillance video evidence in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to ballistics evidence records in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations. Coverage differentiates forensic ballistics records and findings from education and general firearms discussion; generic firearms-analysis language is discovery-only unless independent forensic case or examination-result evidence is present.
Identifies documents containing references to forensic dna profile records in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
Identifies documents containing references to probation and parole files in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies detention and custody records about an identified person (watch-house custody records, booking and intake records, prisoner and detainee records) with populated person and custody fields.
Identifies documents containing references to juvenile justice records in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies sealed or suppressed court filings (documents filed under seal, sealed orders and indictments, suppression / non-publication orders) with populated proceeding and party fields.
Identifies documents containing references to plea negotiation documentation in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to victim impact statements in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Detects domestic abuse protective, restraining and barring orders, police-issued protection notices, and applications for them, when the document names the parties. Covers the generic English-language order names used across jurisdictions plus United States (order of protection, protection from abuse, domestic violence restraining order, temporary restraining order, injunction for protection), United Kingdom (non-molestation order, occupation order, DVPN/DVPO, domestic abuse protection notice/order, non-harassment order), Ireland (barring, interim barring and emergency barring orders; bare "safety order" is excluded as too generic), Canada (emergency protection order, peace bond) and New Zealand (Police Safety Order) instruments. Australian state and territory DFV orders are covered in more depth by au-dfv-protection-order; the slug is retained from the earlier topic-phrase classifier.
Identifies documents containing references to evidence handling logs in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to leak investigation records in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Detects whole-of-government or agency-level insurance coverage schedules, self-insurance reserves, indemnity limits, and excess/deductible structures, and quantified contract liability and insurance schedules (liability caps, limits of liability, required professional indemnity and public liability cover), that reveal the State's financial exposure limits. Absorbed global-top500-178-indemnity-and-liability-schedules (2026-09-24).
Detects government defence materials for judicial review of administrative decisions. These files contain the State's candid assessment of decision-making deficiencies and legal vulnerabilities. Disclosure directly prejudices the State's defence and may establish precedent affecting thousands of similar decisions.
Detects telecommunications interception warrants, stored communications warrants and the intercept product they produce (call transcripts, line / session logs, intercepted communications) under the Telecommunications (Interception and Access) Act 1979 (Cth). Disclosure of the existence of an interception warrant or of interception product is a criminal offence under the TIA Act and alerts targets to switch to unmonitored channels. Absorbs the former lawful-intercept-transcripts classifier.
Detects internal assessments evaluating whether specific documents or communications attract legal professional privilege, including analysis of privilege vulnerabilities. These meta-privilege documents map where the State's privilege claims are strong and where they are vulnerable.
Detects Numéro d'identification national (entités) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects legal opinions and due diligence reports for mergers, acquisitions, or privatisations involving Government Owned Corporations (GOCs) or government assets. Disclosure is market-sensitive and commercially prejudicial, potentially breaching continuous disclosure obligations.
Detects privileged litigation strategy documents and related case strategy materials, including high-exposure matters (significant financial exposure or systemic policy impact), defence strategy content, prospects assessments, and settlement posture. Covers both formal major-matter strategy packs and general litigation strategy document references in Australian legal contexts.
Detects legal strategy documents for native title negotiations, ILUAs, and compensation claims under the Native Title Act 1993 (Cth). Disclosure reveals the State's negotiation position on land rights with multi-generational consequences and multi-billion dollar implications.
Detects Norwegian passport numbers issued by the police (politiet). The 2020 series uses a nine-character document number: ordinary (C) and emergency (K) passports are one prefix letter plus two characters that may be letters or digits plus six digits (specimen CCC002251); diplomatic (FG), service (FH), special (FJ), travel-document (FK) and foreigner (FL) passports are a two-letter prefix plus one letter-or-digit plus six digits. Pre-2020 series passports (in circulation until October 2030) carry an eight-digit document number.
Detects the New Zealand Government CONFIDENTIAL national-security classification under the Protective Security Requirements (PSR) classification system: the verified control/dissemination marking separator (CONFIDENTIAL//..., e.g. CONFIDENTIAL//NZEO) and a gated bracket form ([CONFIDENTIAL]). Deliberately narrow v1: no bare-word tier (CONFIDENTIAL is overwhelmingly common as generic business/legal boilerplate — NDAs, email footers, "STRICTLY CONFIDENTIAL", "PRIVATE AND CONFIDENTIAL" — and would swamp any bare-word detector), and the bracket tier is hard-gated by New Zealand government context because, unlike its sibling markings, [CONFIDENTIAL] is not a verified SEEMail trigger word. Regex logic verified directly against official PSR marking-format guidance (protectivesecurity.govt.nz); matched case-sensitively.
Detects documents containing strategic and tactical intelligence on organised crime networks including network mapping, financial flow analysis, key facilitator identification, and cross-jurisdictional cooperation intelligence. QPS Taskforce Maxima handles OMCG investigations. Disclosure enables criminal organisations to restructure and eliminate suspected informants.
Detects legal strategy for patent prosecution before filing, including prior art assessments, claim drafting strategy, and freedom-to-operate opinions. Disclosure destroys patent novelty or reveals prosecution strategy to competitors. Note: trainable classifier recommended for production deployment.
Detects metadata records from police body-worn camera (BWC) systems including activation timestamps, officer identification, incident cross-references, and footage catalogue entries. This pattern targets the metadata and logs, NOT the footage itself. BWC metadata reveals which officers attended which incidents, activation patterns, and evidence chain-of-custody details.
Detects internal investigation documents of police use of lethal or serious force, including compelled officer statements under s.7.2 PPRA and Ethical Standards Command evidence before investigation completion.
Detects Queensland Police Service (QPS) incident reports containing operational details about reported offences, informant information, and occurrence records. These are non-covert operational documents that are sensitive due to informant and victim details but do not involve covert methodology or life-safety risks.
Detects legal defence strategy prepared in response to regulatory investigations by bodies such as ACCC, ASIC, APRA, OAIC, and Queensland regulators (CCC, OIA). Disclosure reveals the target's assessment of its own regulatory exposure and defence approach.
Detects prosecution briefs prepared by Queensland regulatory bodies (Workplace Health and Safety, Environmental Protection Authority, Office of Fair Trading) for enforcement action. Disclosure compromises prosecution integrity and alerts enforcement targets.
Detects draft submissions to Royal Commissions before formal tabling. Pre-tabling drafts reveal the State's narrative strategy, admissions under consideration, and positions not yet finalised. Disclosure prejudices the State's participation in proceedings of national significance.
Detects internal legal assessments evaluating compliance with sanctions regimes (DFAT, OFAC, EU). Disclosure reveals identified compliance gaps, risk exposures, and remediation strategies before implementation, exposing the organisation to criminal prosecution under the Autonomous Sanctions Act 2011.
Detects documents authorising settlement ranges, negotiation floors/ceilings, and approved concession parameters, and unexecuted draft settlement instruments (draft deeds of settlement/release, settlement agreements, terms of settlement) carrying a proposed settlement sum. Disclosure reveals the State's maximum position or proposed terms, destroying negotiation leverage and potentially costing tens of millions in lost bargaining position. Absorbed global-top500-166-settlement-agreement-drafts (2026-09-24).
Detects sexual assault counselling records and the legal material that seeks or protects them, for an identified person: counselling session notes, trauma counselling and victim/survivor support records, forensic medical examination referrals, specialist sexual assault service records (Queensland SARAS, Centres Against Sexual Assault, Yarrow Place, Sexual Assault Resource Centre, sexual assault response teams), and subpoena or privilege material about protected counselling communications — Qld sexual assault counselling privilege (Evidence Act 1977 Pt 2 Div 2A), NSW sexual assault communications privilege (Criminal Procedure Act 1986 ss295-306), Vic confidential communications (Evidence (Miscellaneous Provisions) Act 1958 Div 2A), and WA, SA, Tas, ACT and NT equivalents. These records are subject to strong statutory privilege and carry the highest privacy protections — disclosure can re-traumatise survivors, compromise criminal proceedings, and endanger safety.
Detects Singapore Unique Entity Numbers (UEN) issued by ACRA and other agencies to businesses and other entities. Common forms are 8 or 9 digits plus a check letter (local companies) and the issued-year form TyyPQnnnnX / SyyPQnnnnX / RyyPQnnnnX used for other entities.
Detects internal legal assessments quantifying the State's liability exposure on specific matters (tort, contract, statutory). Disclosure reveals the State's own estimate of its likely loss, undermining defence and settlement positions across multiple related matters. Note: trainable classifier recommended for production using liability document structural features.
Detects surrogacy arrangement records including parentage orders, surrogacy agreements, birth mother medical records, and intended parent assessments under the Surrogacy Act 2010 (Qld). These records contain deeply personal information about reproductive choices, medical procedures, and legal parentage transfers — disclosure can cause severe emotional distress and breach court-sealed parentage orders.
Detects documents containing physical and electronic surveillance operation plans including observation post positions, equipment deployments, team compositions, and target movement tracking plans. Disclosure enables counter-surveillance by criminal targets and compromises reusable surveillance positions and techniques.
Detects terrorism and national security watchlist entries including risk ratings, monitoring status, intelligence basis, and border alert configurations. Disclosure enables subjects to evade monitoring and compromises border security.
Detects the Turkish tax identification number (Vergi Kimlik Numarası, VKN) issued by the Turkish Revenue Administration (Gelir İdaresi Başkanlığı, GİB). The VKN is a 10-digit number structured as a 3-digit alpha group code (001-999), a 6-digit sequence number and a single check digit. Since 1 July 2006 Turkish citizens use their 11-digit T.C. Kimlik Numarası as their tax number (covered by the separate tr-national-id pattern); the 10-digit VKN remains the tax identifier for legal entities, ordinary partnerships, foreign legal entities and foreign nationals without a Foreign Identity Number.
Detects traffic camera and speed camera infringement records containing driver identification details, vehicle registration, and photographic evidence references, and automatic number plate recognition (ANPR / ALPR) read records that place a plate at a camera site, lane, direction and time. These records link specific vehicles and individuals to locations and traffic offences via camera evidence under the Transport Operations (Road Use Management) Act 1995 (Qld). Absorbs the former automated-plate-reader-data classifier.
Detects the UK Government Security Classifications Policy (GSCP) OFFICIAL classification and its -SENSITIVE marking, written OFFICIAL-SENSITIVE and applied immediately after the OFFICIAL classification per the current policy. Matches the verified structured "CLASSIFICATION - HANDLING INSTRUCTION[- DESCRIPTOR]" format (e.g. OFFICIAL-SENSITIVE - RECIPIENTS ONLY, OFFICIAL-SENSITIVE - COMMERCIAL) using the centrally-defined GSCP handling-instruction and descriptor vocabulary, the bare OFFICIAL-SENSITIVE banner, and — at a lower, UK-government-context gated tier — bare OFFICIAL alone, which is a common English word. Regex logic verified directly against the current Government Security Classifications Policy (gov.uk, version 2.0, August 2024); matched case-sensitively so ordinary lowercase English use of "official"/"official-sensitive" does not trigger it.
Detects U.K. Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
Detects USCIS Alien Registration Numbers (A-Numbers). An A-Number is the unique identifier the Department of Homeland Security assigns to a noncitizen: the letter "A" followed by 7-9 digits, written compactly (A012345678) or grouped (A-123-456-789). A-Numbers appear on Green Cards, EADs, immigration court records, and Form I-9 / E-Verify data held by virtually every U.S. employer.
Detects U.S. Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
Detects documents containing witness protection program records including new identities, relocation details, and safe house locations for protected witnesses. Disclosure directly endangers the lives of witnesses and their families who have testified against violent criminals.