DLP Detection Patterns
1337 community-built patterns for detecting sensitive data across 78 jurisdictions.
All patterns
Detects documents containing intelligence holdings, surveillance methods, evidence gaps, and investigative strategy against active criminal investigation targets. These target packages reveal the full picture of what police know and do not know about a suspect, enabling counter-surveillance and evidence destruction if disclosed.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Police Powers and Responsibilities Act 2000 (Qld), Police Service Administration Act 1990 (Qld)
- Frameworks
- QGISCF
Detects pre-release adoption records including birth parent identities, adoptee matching assessments, placement recommendations, relinquishment consents, and contact vetoes under the Adoption Act 2009 (Qld). These records contain information that individuals have a legal right to control — premature or unauthorised disclosure can cause profound emotional harm and breach court-sealed orders.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Adoption Act 2009 (Qld), Child Protection Act 1999 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Detects Emirates Id patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ae
- Regulations
- UAE PDPL
- Frameworks
- ISO 27001, ISO 27701
Detects UAE passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ae
- Regulations
- UAE PDPL
- Frameworks
- ISO 27001, ISO 27701
Detects agent tool-misuse / high-risk action instructions in AI/agent context: destructive or irreversible action language coupled with a high-impact target or an approval-bypass clause (OWASP LLM06 / Agentic Top 10). The action verb and target must co-occur to suppress IT-runbook false positives.
- Type
- regex
- Confidence
- low
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Criminal Code Act 1899 (Qld), Regulation (EU) 2024/1689 (AI Act)
- Frameworks
- ISO 27001, OWASP LLM Top 10 2025, NIST AI RMF GenAI Profile
Detects data-exfiltration carriers in AI/LLM output: markdown images or links and HTML img tags whose URL points off-tenant and carries an encoded data payload in the path or query. This is an EchoLeak-style (cf. CVE-2025-32711) generic markdown/HTML exfiltration-carrier marker - it flags the carrier shape, not the full CVE mechanism (which also involves XPIA evasion and a Teams proxy/CSP bypass).
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), GDPR, Criminal Code Act 1995 (Cth)
- Frameworks
- ISO 27001, OWASP LLM Top 10 2025, NIST AI RMF GenAI Profile
Detects hidden or encoded content carriers used for indirect prompt injection (OWASP LLM01): zero-width / bidirectional / homoglyph Unicode control characters that conceal instructions in otherwise benign prose, and abnormally long base64 strings embedded inline in text. These carriers smuggle attacker instructions into documents, emails, and web content that an LLM later ingests.
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Criminal Code Act 1899 (Qld), Regulation (EU) 2024/1689 (AI Act)
- Frameworks
- ISO 27001, OWASP LLM Top 10 2025, NIST AI RMF GenAI Profile
Detects overt jailbreak / roleplay-persona framings in AI/LLM input (OWASP LLM01): persona-override framings (DAN, developer mode), restriction-removal roleplay, and "for research/educational purposes" pretexts. Curated from public jailbreak taxonomies; no novel jailbreaks authored.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- global
- Regulations
- Regulation (EU) 2024/1689 (AI Act)
- Frameworks
- ISO 27001, OWASP LLM Top 10 2025, NIST AI RMF GenAI Profile
Detects risky MCP / plugin / connector descriptors: tool manifests requesting over-broad or unexplained scopes, or encouraging autonomous action that bypasses user approval (OWASP LLM06 / Agentic Top 10). Phrase detection is corroborated by AI-context markers.
- Type
- regex
- Confidence
- low
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), GDPR
- Frameworks
- ISO 27001, OWASP LLM Top 10 2025, NIST AI RMF GenAI Profile
Detects directives intended to persist across sessions or to be written into model memory that change the assistant's role, priority or policy (OWASP LLM08 persistent-context poisoning). Phrase detection is corroborated by AI-context markers.
- Type
- regex
- Confidence
- low
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Criminal Code Act 1899 (Qld), Regulation (EU) 2024/1689 (AI Act)
- Frameworks
- ISO 27001, OWASP LLM Top 10 2025, NIST AI RMF GenAI Profile
Marks AI-generated output context (responses, generated files, chat exports) so existing PII/secret SITs can be re-scoped to it. Detection of the sensitive data itself is delegated to those SITs via the ai-threat-classifiers collection; this pattern supplies the AI-output context signal.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), GDPR
- Frameworks
- ISO 27001, OWASP LLM Top 10 2025, NIST AI RMF GenAI Profile
Detects direct prompt-injection / goal-hijack attempts in AI/LLM input: imperative phrases that try to override higher-priority (system) instructions, change the model's role or goal, or bypass approval guardrails (OWASP LLM01). Phrase detection is corroborated by AI-context markers.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Criminal Code Act 1899 (Qld), Regulation (EU) 2024/1689 (AI Act)
- Frameworks
- ISO 27001, OWASP LLM Top 10 2025, NIST AI RMF GenAI Profile
Detects instruction-like content embedded inside reference / retrieval material (RAG sources): directives addressed to a retrieval AI, high-imperative density, or sudden authority claims that attempt to steer downstream model behaviour (OWASP LLM08 retrieval poisoning). Phrase detection is corroborated by AI-context markers.
- Type
- regex
- Confidence
- low
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Regulation (EU) 2024/1689 (AI Act)
- Frameworks
- ISO 27001, OWASP LLM Top 10 2025, NIST AI RMF GenAI Profile
Detects instructions embedded in repository text (README, AGENTS.md, comments, issues) that target an AI coding agent and direct it to take risky action - skipping review/tests, exfiltrating data, or committing secrets (OWASP LLM01 indirect injection via source control).
- Type
- regex
- Confidence
- low
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Criminal Code Act 1899 (Qld), Regulation (EU) 2024/1689 (AI Act)
- Frameworks
- ISO 27001, OWASP LLM Top 10 2025, NIST AI RMF GenAI Profile
Detects secrets and credentials surfaced in AI/LLM context: private-key headers (RSA / EC / OpenSSH / generic) and connection-string passwords (password= / pwd=) pasted into prompts, chat exports, or AI-generated output. Reuses the intent of built-in credential SITs, re-scoped to the AI surface.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Criminal Code Act 1899 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, OWASP LLM Top 10 2025, NIST AI RMF GenAI Profile
Supplies the AI-prompt context signal (typed prompts, Copilot/Copilot Chat/Studio, uploaded files) so existing PII/regulated-data SITs can be re-scoped to AI prompts via the ai-threat-classifiers collection. Known coverage gap (from the library): native DLP scans typed prompt text, not uploaded file contents, in the Copilot location.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), GDPR
- Frameworks
- ISO 27001, OWASP LLM Top 10 2025, NIST AI RMF GenAI Profile
Marks the context of data being submitted to external / unapproved AI services (shadow AI destination domains) so existing PII/secret SITs can be re-scoped to it. Detection of the sensitive data itself is delegated to those SITs via the ai-threat-classifiers collection; this pattern supplies the external-AI destination context signal.
- Type
- regex
- Confidence
- low
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), GDPR
- Frameworks
- ISO 27001, OWASP LLM Top 10 2025, NIST AI RMF GenAI Profile
Detects overt attempts to elicit disclosure of an assistant's system prompt, policies, guidelines, or tool schema (OWASP LLM02/LLM07): "reveal/print/show/repeat your system prompt/instructions" and similar extraction phrasings.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Regulation (EU) 2024/1689 (AI Act)
- Frameworks
- ISO 27001, OWASP LLM Top 10 2025, NIST AI RMF GenAI Profile
Detects Cuit Cuil patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ar
- Regulations
- PDPL (Argentina)
- Frameworks
- ISO 27001, ISO 27701
Detects Documento Nacional de Identidad patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ar
- Regulations
- PDPL (Argentina)
- Frameworks
- ISO 27001, ISO 27701
Detects Argentine passport numbers issued by the Registro Nacional de las Personas (RENAPER). Since the 2012 biometric passport series, every booklet carries a unique alphanumeric number of exactly three uppercase letters followed by six digits (e.g. AAC382190). The number is independent of the holder's DNI. Special three-letter series are reserved for travel documents issued to stateless persons (ZZA) and refugees (ZZX) under RENAPER Disposicion 904/2021.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- ar
- Regulations
- PDPL (Argentina)
- Frameworks
- ISO 27001, ISO 27701
Detects Austria driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- at, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Personalausweis patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, at
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Austria passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- at, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Austria Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- at, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Sozialversicherungsnummer patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, at
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Austria Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- at, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Austria Value Added Tax (VAT) Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. VAT numbers have country-specific prefixes that aid detection accuracy.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- at, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Australian Capital Territory driver licence numbers in the established eight-to-ten-digit shape. Enforceable tiers require an explicit driver-licence-number label and ACT context; the strict tier additionally requires Access Canberra or ACT Road Transport Authority evidence.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au-act
- Regulations
- Information Privacy Act 2014 (ACT), Privacy Act 1988 (Cth), Road Transport (Driver Licensing) Act 1999 (ACT)
- Frameworks
- ISO 27001
Generator performance standards (agreed schedule 5.2 standards under S5.2.5.x at the automatic, minimum or negotiated access standard) and the power system model data behind them (NER S5.2.4(b): functional block diagrams, parameters with settings, gains, time constants, delays and deadbands, encrypted models, model source code, releasable user guides, Power System Design and Setting Data Sheets) for a named generating system. The NER treats this as confidential information (cl 3.13.3(k)-(l), 5.3.4 model data, 8.6.1) and AEMO releases model source code only in compiled or encrypted form.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- National Electricity Rules, National Electricity Law
- Frameworks
- ISO 27001
Detects Australian Financial Services Licence (AFSL) numbers issued by ASIC to authorised financial services providers.
- Type
- regex
- Confidence
- low
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Client files kept by aged care and home support providers, including council-run Commonwealth Home Support Programme (CHSP) and Support at Home services funded under the Aged Care Act 2024 (Cth): client intake and profile records, care needs assessments, care plans and home support plans that tie a named older person (name, date of birth, My Aged Care ID or client number) to care needs, medical conditions, medications, mobility and falls risk, and to a carer, next of kin or representative. Serious incident (SIRS) notifications are covered by au-aged-care-serious-incident-notification and are not the target here. Program manuals, provider guidance, blank intake forms and training case studies are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Aged Care Act 2024 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Reportable incident notifications and records under the aged care Serious Incident Response Scheme (SIRS), as continued by the Aged Care Act 2024 (Cth) and the Aged Care Rules 2025 from 1 November 2025, for a named older person receiving funded aged care services (residential care homes and services in home or community settings, including Support at Home). Covers the eight reportable incident types (unreasonable use of force, unlawful sexual contact or inappropriate sexual conduct, psychological or emotional abuse, unexpected death, stealing or financial coercion by a staff member, neglect, inappropriate use of a restrictive practice, unexplained absence from care) and the Priority 1 (report within 24 hours) / Priority 2 (report within 30 calendar days) classification. A populated record names the provider, the older person, the aged care worker or subject of allegation, the incident date, type and priority, and the response (police notified, medical treatment, supporters informed). ACQSC guidance, quick guides, SIRS statistics and blank forms are decoys. Structure modelled on au-ndis-reportable-incident, which covers the NDIS scheme; NDIS signals are excluded from this classifier's enforce tiers, but an aged care SIRS record can also reach 75 in the NDIS classifier because both share generic labels (provider, worker, date of incident).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Aged Care Act 2024 (Cth), Aged Care Rules 2025 (Cth)
- Frameworks
- QGISCF
Detects ASIC registered agent numbers used by agents who lodge company documents with the Australian Securities and Investments Commission. The number is a short (typically 3-6 digit) identifier issued to a registered agent and quoted on ASIC forms and lodgements.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Corporations Act 2001 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Detects Australian Director Identification Numbers (director IDs / DIN) issued by the Australian Business Registry Services (ABRS). A director ID is a 15-digit number beginning with Australia's ISO 3166 country code 036, followed by an 11-digit unique identifier and a single check digit, often written with spaces or hyphens between groups.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Corporations Act 2001 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Issuing-body records about Aviation Security Identification Card (ASIC) and Maritime Security Identification Card (MSIC) holders and applicants: the Register of ASICs (Aviation Transport Security Regulations 2005 reg 6.23) and Register of MSICs (Maritime Transport and Offshore Facilities Security Regulations 2003 reg 6.08T), which hold the holder's name, residential address, card colour/type, the unique number of the card, issue, expiry and cancellation dates and operational need, plus AusCheck background check outcomes and cancellation notices. The card number format is not public (issuer-specific, Secretary-approved), so the card number is matched only by its label.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Aviation Transport Security Regulations 2005 (Cth), Maritime Transport and Offshore Facilities Security Regulations 2003 (Cth)
- Frameworks
- PSPF, QGISCF
Identifies Australian Bank State Branch (BSB) routing codes in 3-digit dash 3-digit or continuous 6-digit formats. Supports space separator. Requires corroborative financial-institution keywords.
- Type
- regex
- Confidence
- low
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects Australian Business Numbers (ABNs), which are unique 11-digit identifiers issued by the Australian Business Register to entities carrying on a business in Australia. ABNs are commonly formatted as groups of 2-3-3-3 digits separated by spaces or hyphens. The ABN includes a check digit mechanism, but this pattern relies on format matching combined with corroborative evidence rather than algorithmic validation.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Identifies Australian mobile telephone numbers in domestic (04XX) and international (+614XX) notation. Uses lookaround boundaries to prevent embedded numeric matches. Supports space-only separation between digit groups for high precision.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects candidate Centrelink Customer Reference Numbers consisting of 9 digits followed by a letter. The bare shape is not unique and requires a CRN/Centrelink label for enforcement.
- Type
- regex
- Confidence
- low
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Commonwealth Higher Education Student Support Number (CHESSN): a 10-digit number identifying a student's HELP loans and Commonwealth support. Being retired in favour of the USI since 2021 but still present on Commonwealth Assistance Notices and legacy records.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Higher Education Support Act 2003 (Cth), Privacy Act 1988 (Cth)
- Frameworks
- QGISCF
Completed incident, injury, trauma and illness records kept by education and care services (long day care, kindergarten, family day care, outside school hours care), including council-run centres, under the Education and Care Services National Law and National Regulations (regulation 87, record; regulation 86, notification to parents; regulation 183, storage - regulation numbers as listed in ACECQA's Incident, injury, trauma and illness policy guidelines). A populated record names the child (name, date of birth or age), the date and time of the incident, the nature of the injury, trauma or illness, first aid or medication given, action taken and when the parent or guardian was notified. The records must be kept confidentially until the child turns 25. ACECQA guidance, service policies, the regulation text, blank forms and training scenarios are decoys. School incident reports are covered by au-qld-school-incident-report.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Education and Care Services National Law (Queensland), Education and Care Services National Regulations, Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Detects Australian Citizenship Certificate number patterns including prefixed formats (ACC, CDM, ACS, CAS followed by 4-8 digits) and numeric-only formats (0 + 10 digits).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Draft mandatory climate-related financial disclosures before release: annual sustainability reports and climate statements under Corporations Act 2001 Part 2M.3 (s 292A who must prepare, s 296A contents, s 296B no material climate risk statement, s 296C compliance with sustainability standards, s 296D climate statement disclosures including the s 296D(2B) two-scenario analysis, s 301A audit) and AASB S2 Climate-related Disclosures (governance, strategy, risk management, metrics and targets: Scope 1 / 2 / 3 emissions, transition plan, climate-related scenario analysis, climate resilience, physical and transition risks, internal carbon price), when the document carries a pre-release marker (DRAFT, not for release, embargoed, subject to Board approval, board paper) and populated metrics or scenario results. Published sustainability reports, AASB S2 and ASIC guidance are public and do not reach enforce tiers.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Corporations Act 2001 (Cth), AASB S2 Climate-related Disclosures (September 2024), Climate Change Act 2022 (Cth)
- Frameworks
- QGISCF, PSPF, AASB S2
Detects Australian Company Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Detects populated compliance assessment and audit reports: the report title (compliance assessment / audit / review report, regulatory compliance assessment, gap analysis report) together with populated finding, control, status, rating and remediation fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth), Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- DISP, ISO 27001, NIST CSF
Completed employee conflict of interest declarations and conflict management plans that name the declaring employee (or panel member or contractor), describe the private interest or relationship, and record how the conflict is managed: procurement and tender evaluation declarations, selection panel declarations required by Directive 07/23, discipline decision-maker declarations under Directive 05/23, and Queensland public sector declarations tied to the work performance and personal conduct principles in Public Sector Act 2022 (Qld) s 40. Built conservatively: 75 already needs two populated structures. Councillor conflict declarations in published meeting minutes and registers of interests are public and are treated as decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Public Sector Act 2022 (Qld), Discipline Directive 05/23 (Qld), Recruitment and Selection Directive 07/23 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Identifies substantive critical-infrastructure and essential-service network or control-system designs. Topic phrases are retained for discovery; enforcement requires segmentation, data-flow, trust-boundary, VLAN, DMZ, firewall, or OT-zone design content, and high confidence also requires a populated address, VLAN, port, device, or rule detail.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Criminal Code Act 1995 (Cth), Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF
Detects populated data breach reports and assessments under the Commonwealth Notifiable Data Breaches (NDB) scheme (Privacy Act 1988 Part IIIC): breach report / notification / assessment titles together with populated breach record fields (entity, dates, individuals affected, information involved, incident reference). The Queensland mandatory notification of data breach scheme (IPA 2009 Chapter 3A) is out of scope and will be a separate classifier.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), NDB Scheme (Cth)
- Frameworks
- ISO 27001
Identifies references to Australian consumer deposit account numbers in financial and compliance documents. Uses structural anchors with proximity constraints.
- Type
- regex
- Confidence
- medium
- Detection quality
- Mixed
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects client, tenant, patient or customer case records that record a disclosure of domestic and family violence (DFV): case notes, intake assessments, service referrals and payment applications that name or number an individual and state that they have disclosed, experienced, fled or are at risk of DFV, coercive control or intimate partner violence. Sector-neutral: the same shape appears in housing, human services, health, education, justice and Commonwealth support records (Leaving Violence Program, the legacy Escaping Violence Payment, and Crisis Payment for extreme circumstances family and domestic violence). Also covers information-sharing requests and disclosures under Part 5A of the Domestic and Family Violence Protection Act 2012 (Qld) - s 169D (assessing a domestic violence threat), s 169E (responding to a serious domestic violence threat) and s 169F (police referral to a specialist DFV service provider) - made or received by prescribed entities (for example state schools, Hospital and Health Services, housing, corrections and police) and specialist DFV service providers, when the record names the requesting or disclosing entity, the person at risk or the person using violence, the information shared, the reason and the date. The Department of Education's Part 5A Instrument of Authorisation, which quotes s 169D verbatim, and the DFV Information Sharing Guidelines are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), Domestic and Family Violence Protection Act 2012 (Qld)
- Frameworks
- QGISCF
Detects records that disclose where a person at risk of domestic and family violence (DFV) is living or sheltering: refuge, shelter, safe house and crisis accommodation addresses, addresses flagged as confidential, suppressed or not to be disclosed, and silent elector entries. This is the highest-harm DFV disclosure, because it tells a person using violence where to find the victim-survivor. Sector-neutral: it applies to housing, human services, health, education, court, police, electoral and payroll records.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), Domestic and Family Violence Protection Act 2012 (Qld), Commonwealth Electoral Act 1918 (Cth)
- Frameworks
- QGISCF
Detects charge sheets, court briefs, court lists, criminal histories and corrections records for domestic and family violence offences against an identified person: Queensland coercive control (Criminal Code s334C, from 26 May 2025) and engaging in domestic violence to aid a respondent (s179A); NSW abusive behaviour towards current or former intimate partners (Crimes Act s54D, from 1 July 2024); Tasmanian persistent family violence (Criminal Code s170A), economic abuse and emotional abuse or intimidation (Family Violence Act 2004 ss8-9); SA coercive control (Criminal Law Consolidation Act s20C, not yet proclaimed); contraventions of protection, intervention and restraining orders in every jurisdiction; and "domestic violence offence" notations (Qld Criminal Code s1 and Penalties and Sentences Act s12A; NSW Crimes (Domestic and Personal Violence) Act s12).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Criminal Code Act 1899 (Qld), Penalties and Sentences Act 1992 (Qld), Domestic and Family Violence Protection Act 2012 (Qld), Crimes Act 1900 (NSW), Crimes (Domestic and Personal Violence) Act 2007 (NSW), Criminal Code Act 1924 (Tas), Family Violence Act 2004 (Tas), Criminal Law Consolidation Act 1935 (SA), Family Violence Protection Act 2008 (Vic), Privacy Act 1988 (Cth)
- Frameworks
- QGISCF
Detects police domestic and family violence (DFV) incident records and the referrals police send to specialist and government services: Queensland QPRIME DV occurrences, Victoria Police L17 Family Violence Reports, NSW DV events, and DFV incident, call-out and attendance records in other jurisdictions. These records travel beyond police to housing, child safety, health, education and specialist DFV services, so they turn up in general agency mailboxes and file shares.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Domestic and Family Violence Protection Act 2012 (Qld), Police Powers and Responsibilities Act 2000 (Qld), Family Violence Protection Act 2008 (Vic), Crimes (Domestic and Personal Violence) Act 2007 (NSW), Privacy Act 1988 (Cth)
- Frameworks
- QGISCF
Detects domestic and family violence protection orders, police-issued notices and directions, and applications for them, in every Australian jurisdiction, when the document names the parties. Covers Qld protection orders, temporary protection orders, Police Protection Notices and Police Protection Directions; NSW apprehended domestic violence orders (including provisional orders); Vic family violence intervention orders and family violence safety notices; WA family violence restraining orders; SA intervention orders; Tas police family violence orders and family violence orders; ACT family violence orders (interim and after-hours); NT domestic violence orders; and recognised DVOs under the National Domestic Violence Order Scheme. Complements the Queensland-specific domestic-violence-order-application classifier.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Domestic and Family Violence Protection Act 2012 (Qld), Crimes (Domestic and Personal Violence) Act 2007 (NSW), Family Violence Protection Act 2008 (Vic), Restraining Orders Act 1997 (WA), Intervention Orders (Prevention of Abuse) Act 2009 (SA), Family Violence Act 2004 (Tas), Family Violence Act 2016 (ACT), Domestic and Family Violence Act 2007 (NT), Privacy Act 1988 (Cth)
- Frameworks
- QGISCF
Detects completed domestic and family violence (DFV) risk assessments, safety plans and multi-agency risk meeting records for an identified person, across Australian frameworks: Qld Common Risk and Safety Framework (CRASF), QPS Domestic Violence Protective Assessment Framework (DV-PAF) and High Risk Teams; NSW Domestic Violence Safety Assessment Tool (DVSAT) and Safety Action Meetings; Vic MARAM; WA CRARMF; SA and NT Family Safety Framework meetings and Positive Action Plans; NT RAMF Common Risk Assessment Tool; and generic DFV risk assessments and safety plans.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Domestic and Family Violence Protection Act 2012 (Qld), Crimes (Domestic and Personal Violence) Act 2007 (NSW), Family Violence Protection Act 2008 (Vic), Restraining Orders Act 1997 (WA), Domestic and Family Violence Act 2007 (NT), Privacy Act 1988 (Cth)
- Frameworks
- QGISCF
Catalogue reference for the Microsoft Purview built-in Australia Driver's License Number sensitive information type. Microsoft recommends medium confidence (75) for the built-in entity. This YAML-only record supports registry search and discovery without reproducing Microsoft's built-in regular expressions, keyword dictionaries, or XML.
- Type
- keyword_list
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects Australian workplace drug and alcohol testing records - screening and confirmatory results under AS/NZS 4308 (urine) and AS/NZS 4760 (oral fluid), laboratory result phrasing (non-negative, cut-off concentrations in ng/mL), and breath/blood alcohol readings recorded in fitness-for-work programs.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), Work Health and Safety Act 2011 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001
Detects populated student attendance and absence record using record context and corroborating fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Education (General Provisions) Act 2006 (Qld), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects populated student excursion consent and medical roster using record context and corroborating fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Education (General Provisions) Act 2006 (Qld), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects populated student guardian and collection permission record using record context and corroborating fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Education (General Provisions) Act 2006 (Qld), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects populated individual student health and emergency plan using record context and corroborating fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Education (General Provisions) Act 2006 (Qld), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects populated student medication administration record using record context and corroborating fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Medicines and Poisons Act 2019 (Qld), Education (General Provisions) Act 2006 (Qld), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Nationally Consistent Collection of Data on School Students with Disability (NCCD) records for a named student: disability category, level of adjustment and the evidence of adjustments provided.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Disability Standards for Education 2005 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Detects populated confidential research funding proposal using record context and corroborating fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Australian Research Council Act 2001 (Cth), Right to Information Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects populated confidential university research invention disclosures: an invention disclosure / research commercialisation disclosure heading combined with labelled inventor, invention title or technical-description fields carrying real values. Phrase-only mentions (policy, process pages, news) stay discovery-only.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Patents Act 1990 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001
Detects populated school student protection and monitoring report using record context and corroborating fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Child Protection Act 1999 (Qld), Education (General Provisions) Act 2006 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Detects populated unreleased education assessment and marking material using record context and corroborating fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Education (Queensland Curriculum and Assessment Authority) Act 2014 (Qld), Right to Information Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
School records showing that a student is the subject of a current family law order or a domestic violence order: the completed "Court Orders" section of the Queensland state school Application for Student Enrolment Form (SEF-1 V8, approved under the Education (General Provisions) Act 2006) - "Family Court Orders" (orders made pursuant to the Family Law Act 1975 concerning the welfare, safety or parenting arrangements of the student) and "Other Court Orders" (such as a domestic violence order) with commencement and end dates - and school file notes recording a parenting or protection order held for a student and the person who may not collect or contact the student. The blank SEF-1 form contains every anchor phrase and is a decoy; enforce tiers need populated order dates and a named student or restricted person. Complements au-qld-student-enrolment-form (form detection) and au-education-guardian-collection-record (collection permissions), which do not tier on court-order content.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Education (General Provisions) Act 2006 (Qld), Family Law Act 1975 (Cth), Domestic and Family Violence Protection Act 2012 (Qld), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- QGISCF
Detects populated student fee and debt statement using record context and corroborating fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Education (General Provisions) Act 2006 (Qld), Higher Education Support Act 2003 (Cth), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects populated labelled education student identifier record using record context and corroborating fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Student Identifiers Act 2014 (Cth), Education (General Provisions) Act 2006 (Qld), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects populated student help and vet loan application or progression using record context and corroborating fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Higher Education Support Act 2003 (Cth), VET Student Loans Act 2016 (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects populated student work placement and apprenticeship record using record context and corroborating fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Further Education and Training Act 2014 (Qld), Education (General Provisions) Act 2006 (Qld), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects populated individual student safety and behaviour support plan using record context and corroborating fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Education (General Provisions) Act 2006 (Qld), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects Australian OTC electricity derivative and power purchase agreement confirmation content - documentation under the June 2006 Australian Electricity Addendum and 2005 ISDA Commodity Definitions, electricity swap/cap/floor/swaption confirmations settled against the AEMO regional reference price, and PPA confirmation phrasing with $/MWh fixed prices.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Corporations Act 2001 (Cth), Competition and Consumer Act 2010 (Cth)
- Frameworks
- ISO 27001
Populated beneficiary and dependant nominations held by superannuation funds and employers: binding and non-binding (including lapsing and non-lapsing) death benefit nominations under Superannuation Industry (Supervision) Regulations 1994 reg 6.17A (made for SIS Act 1993 s 59(1A)), employer group life insurance beneficiary nominations, and HR dependant, next-of-kin and emergency contact records. Each record ties an identified member or employee to named family members, their relationship to the member and, on death benefit forms, the share each person receives, witness details and dates of birth. Bulk member extracts with TFNs and balances belong to superannuation-fund-member-statement-bulk, and super identifiers (USI, member number) on their own belong to global-top500-096-superannuation-identifiers.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Superannuation Industry (Supervision) Act 1993 (Cth), Superannuation Industry (Supervision) Regulations 1994 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701, QGISCF
Energy retailer customer records about hardship, payment plans, concessions and vulnerability. The National Energy Retail Law requires each retailer to have a customer hardship policy (s 43) meeting minimum requirements (s 44), and National Energy Retail Rules Part 3 (rr 70A-75B) sets out hardship customer obligations: informing the customer of the policy (r 71), payment plans set by capacity to pay, arrears and expected consumption (r 72), waiver of late payment fees (r 73), Centrepay (r 74) and the AER Customer Hardship Policy Guideline (r 75A). Queensland Government energy concessions (Electricity Rebate, Reticulated Natural Gas Rebate, Home Energy Emergency Assistance Scheme, Medical Cooling and Heating Electricity Concession Scheme) are applied through the retailer on proof of a Pensioner Concession Card, Health Care Card, Veteran (DVA) Gold Card, Queensland Seniors Card or ImmiCard. Records tie an account holder, customer or account number, NMI/MIRN or supply address to hardship program status, arrears, concession card details, payment plan amounts and "personal circumstances" notes. The incident class is a retailer's outsourced call-centre compromise exposing customer circumstances notes and government concession numbers. Published hardship policies, the AER guideline, blank applications and news are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- National Energy Retail Law, National Energy Retail Rules, AER Customer Hardship Policy Guideline, Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Energy retailer account records that identify a customer as affected by family violence under Part 3A of the National Energy Retail Rules (rules 76A-76M): the account identification made under rule 76C, the preferred or safe method of communication the retailer must record under rule 76H(4), instructions not to disclose affected customer information (rule 76G) to a current or former joint account holder, and assistance notes such as fee or debt waivers, payment plans, hardship program entries and disconnection holds considered under rule 111(2A). Complements the sector-neutral au-dfv-* classifiers with energy account structure (NMI, MIRN, customer/account number, supply address).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- National Energy Retail Rules, Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Portfolio-level wholesale electricity hedge book and contract position reports held by a NEM generator, retailer or gentailer: contracted volumes aggregated by NEM region (QLD1, NSW1, VIC1, SA1, TAS1), product (swap, cap, floor, PPA, futures) and period, in MW or MWh, with strikes in $/MWh, counterparties, mark-to-market and the open or net position against forecast generation or load. Complements au-electricity-derivative-confirmation (single executed trade confirmations) and au-forward-curve-artefact (price curves); this classifier covers the aggregated position report.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Corporations Act 2001 (Cth), Competition and Consumer Act 2010 (Cth)
- Frameworks
- ISO 27001
Life support equipment registration records kept by Australian energy retailers and distributors under Part 7 of the National Energy Retail Rules (rules 123A-126A): completed medical confirmation forms, register entries and deregistration records that tie a premises (NMI, MIRN or supply address) to a customer and to life support equipment from the rule 3 list (oxygen concentrator, intermittent peritoneal dialysis machine, kidney dialysis machine, chronic positive airways pressure respirator, Crigler-Najjar syndrome phototherapy equipment, ventilator for life support, or other certified equipment). Applies in Queensland (Energex, Ergon Energy and retailers) since 1 July 2015.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- National Energy Retail Rules, Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Detects Australian enterprise agreement and enterprise bargaining content under the Fair Work Act 2009 - agreement text and drafts (single-enterprise and greenfields agreements, nominal expiry, better off overall test), Fair Work Commission agreement codes (AE followed by six digits), and bargaining process artefacts (notice of employee representational rights, protected action ballots, logs of claims).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Fair Work Act 2009 (Cth)
- Frameworks
- ISO 27001
Confidential employer-side enterprise bargaining material produced before an agreement is made: bargaining position papers, wage offer costings, costed claims matrices (management response to a union or employee log of claims) and negotiation strategy briefs that record the approved mandate, fallback positions and trade-offs. Bargaining is conducted under Fair Work Act 2009 (Cth) Part 2-4 (s 172 making an enterprise agreement, s 173 notice of employee representational rights, s 228 good faith bargaining requirements, s 229 bargaining orders) and, for the Queensland public sector and local government, Industrial Relations Act 2016 (Qld) chapter 4 collective bargaining (s 169 notice of intention to bargain, s 173 parties must negotiate in good faith). Published enterprise agreements, Fair Work Commission approval decisions, union newsletters and news reports are decoys; au-enterprise-agreement-document covers agreement text.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Fair Work Act 2009 (Cth), Industrial Relations Act 2016 (Qld), Right to Information Act 2009 (Qld)
- Frameworks
- QGISCF
Detects HR, payroll and timesheet records showing that a named or numbered employee has taken or requested family and domestic violence (FDV) leave, and employee DFV support and workplace safety plans. Under Fair Work Act 2009 ss106A-106E every national-system employee is entitled to 10 days of paid FDV leave, and Fair Work Regulations 2009 reg 3.48 prevents FDV leave from being shown on pay slips because the record itself discloses that the employee is experiencing violence. Queensland public sector and state-system employees have DFV leave under the Industrial Relations Act 2016 (Qld) ss 52-54, and Queensland public service employees have additional support under Public Service Commission Directive 03/20 "Support for employees affected by domestic and family violence": confidentiality of disclosures, risk assessment and safety planning, changes to work location, hours, email addresses and telephone numbers, removal of public contact details, secure parking, flexible working arrangements, and support to transfer or relocate. Enterprise agreements and other directives and policies use the same terms.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Fair Work Act 2009 (Cth), Fair Work Regulations 2009 (Cth), Industrial Relations Act 2016 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Detects completed Notices of Child Abuse, Family Violence or Risk filed in parenting proceedings in the Federal Circuit and Family Court of Australia (Family Law Act 1975 ss67Z, 67ZBA, 69ZQ(1)(aa)), including the earlier "Notice of Child Abuse, Family Violence or Risk of Family Violence" and the Family Court of Western Australia Form 4 "Notice of Child Abuse and Family Violence (or Risk)". The notice records allegations of child abuse or neglect, family violence, substance misuse, mental health issues and abduction threats against named parties and children, and child abuse allegations are reported to the prescribed child welfare authority.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Family Law Act 1975 (Cth), Federal Circuit and Family Court of Australia (Family Law) Rules 2021, Privacy Act 1988 (Cth)
- Frameworks
- QGISCF
Detects financial statements including profit and loss, balance sheets, and income statements.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, NIST CSF, PCI-DSS
Identifies Australian fixed-line telephone numbers across domestic bracketed, unbracketed, and international formats for area codes 02, 03, 07, and 08. Uses lookaround boundaries and supports hyphen separators within digit groups.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects Freedom of Information Act exemption section references (sections 33-38 and 42-47) in Australian government documents. Requires FOI/freedom of information keyword context.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth), Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- DISP, ISO 27001, NIST CSF
Detects Australian electricity forward/broker curve exports - forward or broker curve phrasing tied to NEM regional reference identifiers (QLD1, NSW1, VIC1, SA1, TAS1), load shape terms (flat/peak/off-peak), or calendar/quarter strip notation (Cal27, Q1-27, CY2027, FY27) with $/MWh values. Internal curve marks reveal a participant's price expectations and valuation basis.
- Type
- regex
- Confidence
- low
- Jurisdictions
- au
- Regulations
- Corporations Act 2001 (Cth)
- Frameworks
- ISO 27001
Applications and employer case files for Fair Work Commission matters (Form F2 unfair dismissal application, Form F3 employer response, Form F8 general protections application involving dismissal; matter numbers such as U2024/1234) and Queensland Industrial Relations Commission (QIRC) applications and appeals, where the record names the applicant, respondent or employer and carries matter and dismissal/decision particulars. Published FWC/QIRC decisions are public and are treated as decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Fair Work Act 2009 (Cth), Industrial Relations Act 2016 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Executed or negotiated gas supply, gas sale and purchase, gas transportation and gas storage agreements between named parties, carrying the commercial terms that the Competition and Consumer (Gas Market Code) Regulations 2023 s 25(2) requires a covered supplier's agreement to specify - quantity and annual quantity, flexibility and load factor, supply period, delivery points, price or price structure including take-or-pay conditions - together with the industry terms that express them (Annual Contract Quantity / ACQ, Maximum Daily Quantity / MDQ, take-or-pay, swing). Published Gas Market Code text, model or template agreements, ACCC gas inquiry reports and law-firm commentary are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Competition and Consumer (Gas Market Code) Regulations 2023 (Cth), Competition and Consumer Act 2010 (Cth)
- Frameworks
- ISO 27001
Detects Healthcare Provider Identifier - Individual (HPI-I) patterns. The HPI-I is a 16-digit number starting with the prefix 800361. No checksum validation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Completed high-voltage switching sheets (switching programs) and Access / Test Permits for electrical apparatus, in the form used by Queensland electricity entities under the Queensland Electricity Entity Standard for Safe Access to High Voltage Electrical Apparatus (SAHVEA, Nov 2023). SAHVEA cl 7.3 requires a switching sheet to carry a unique reference number, the apparatus, step-by-step switching to isolate, prove de-energised and earth, the completion time of each step, isolation points and DNOBs, Operator Earth locations, and the issue, surrender and cancellation of permits. SAHVEA cl 9.2 requires an Access / Test Permit to carry the associated Switching Sheet number, Work Area, issue and surrender times, the Switching Co-ordinator, Nearby Exposed Live HV/LV and an Abnormalities Section. Populated sheets expose isolation points, equipment identifiers, network configuration and work schedules. SAHVEA itself, ENA DOC 003, blank forms and training material are decoys. "Sanction for test" and "vicinity authority" are not SAHVEA terms and are not used as anchors.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Electrical Safety Act 2002 (Qld), Electrical Safety Regulation 2013 (Qld), Queensland Electricity Entity Standard for Safe Access to High Voltage Electrical Apparatus (SAHVEA, Nov 2023) cl 7.3, 9.2, Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001
Detects Individual Healthcare Identifier (IHI) patterns. The IHI is a 16-digit number starting with the prefix 800360; the official format carries a Luhn check digit (not enforced here).
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Identifies Australian personal names using capitalised name structure with controlled evidence from the consolidated Australian forename and surname dictionaries. Supports the multicultural name coverage represented in Australian birth, immigration, and administrative sources.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects populated international student coe and enrolment variation record using record context and corroborating fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Education Services for Overseas Students Act 2000 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Detects populated international student accommodation and welfare record using record context and corroborating fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Education Services for Overseas Students Act 2000 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Detects populated Australian loan agreements and credit contracts: a loan agreement / credit contract / loan facility phrase combined with named borrower or lender fields, a stated loan amount or repayment, or a loan/facility reference number. Phrase-only mentions stay discovery-only.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- National Consumer Credit Protection Act 2009 (Cth), Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects the Australian Government OFFICIAL protective marking (PSPF / QGISCF) in both email forms ([SEC=OFFICIAL] subject markings, X-Protective-Marking headers) and visible document banners. Excludes UNOFFICIAL and OFFICIAL: Sensitive (handled by au-marking-sensitive). Regex logic ported from Microsoft's canonical PSPF SIT guidance; matched case-sensitively so the lowercase English word "official" does not trigger.
- Type
- regex
- Confidence
- high
- Detection quality
- Mixed
- Jurisdictions
- au
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- PSPF, QGISCF
Detects the Australian Government PROTECTED protective marking (PSPF / QGISCF) in both email and document forms, sweeping up its IMM/caveat variants (Personal-Privacy, Legal-Privilege, Legislative-Secrecy, CABINET, NATIONAL-CABINET). SECRET and TOP SECRET roll up here so they receive at-least-PROTECTED handling. Regex logic ported from Microsoft's canonical PSPF SIT guidance; matched case-sensitively.
- Type
- regex
- Confidence
- high
- Detection quality
- Mixed
- Jurisdictions
- au
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- PSPF, QGISCF
Detects the Australian Government SECRET and TOP SECRET security classifications in both email and document forms. Intended to surface content that should not be stored on the platform (these classifications roll up to the PROTECTED label in au-marking-protected for handling, while this SIT flags them for remediation). Matched case-sensitively.
- Type
- regex
- Confidence
- high
- Detection quality
- Mixed
- Jurisdictions
- au
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- PSPF
Detects the Australian Government SENSITIVE tier in both email and document forms: Commonwealth OFFICIAL: Sensitive (including its IMM/caveat variants such as Personal-Privacy, Legal-Privilege, Legislative-Secrecy) and the Queensland (QGISCF) standalone SENSITIVE marking. Regex logic ported from Microsoft's canonical PSPF SIT guidance; matched case-sensitively.
- Type
- regex
- Confidence
- high
- Detection quality
- Mixed
- Jurisdictions
- au
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- PSPF, QGISCF
Populated medical certificates and fitness-for-work clearances held by employers: practitioner certificates given as evidence for personal / sick leave (Fair Work Act 2009 s 107(3) lets an employer require evidence that would satisfy a reasonable person), certificates of fitness or capacity issued outside a workers' compensation claim, fitness-for-duty assessments, pre-employment medical clearances and return-to-work clearances. The records name the employee or patient, state a practitioner's opinion that the person is unfit, or fit for normal, restricted or modified duties over a stated period, and often carry a diagnosis, work restrictions and the practitioner's name and provider or registration number. Boundary: workers' compensation claim records, Form 132M work capacity certificates and Comcare certificates of capacity belong to au-qld-workers-compensation-claim; statutory WHS health monitoring reports (Schedule 14 chemicals, lead, asbestos, audiometry) belong to au-whs-health-monitoring-record. Both are excluded from this classifier's enforce tiers.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Fair Work Act 2009 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701, QGISCF
Identifies Australian Medicare card numbers (10-11 digits, first digit 2-6). Filters same-digit sequences. Requires corroborative health-scheme keywords for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Mixed
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Australian Medicare card numbers, which are issued to Australian citizens and permanent residents for access to subsidised healthcare under the Medicare system. The number consists of 10 digits: the first digit is between 2 and 6, followed by 8 additional digits and a single check digit. Numbers are commonly formatted as groups of 4-5-1 digits separated by spaces or hyphens.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Medicare Provider Number patterns. An 8-character code consisting of 6 digits, a location character, and a check character. Validated by location and check character sets.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Australian mining technical records - JORC Code resource and reserve estimates (Measured/Indicated/Inferred resources, Proved/Probable reserves, Competent Person statements), drill-and-blast design parameters (blast patterns, powder factor, maximum instantaneous charge, stemming), pit geotechnical stability assessments, and spelled-out mining tenement grants.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth), Mineral Resources Act 1989 (Qld), Explosives Act 1999 (Qld)
- Frameworks
- ISO 27001
Detects populated Australian mortgage documents (mortgage deeds, home loan contracts, registered mortgages, discharges): the mortgage phrase combined with named mortgagor/mortgagee fields, a security property or title reference, or a secured loan amount. Phrase-only mentions stay discovery-only.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- National Consumer Credit Protection Act 2009 (Cth), Land Title Act 1994 (Qld), Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Discovery-only compatibility coverage for Australian driver's licence number candidates across all states and territories. The stable au-motor-vehicle-permit slug is retained for catalogue, collection, workbook, and package compatibility. State and territory enforcement belongs to the eight au-*-driver-licence-number SITs. Microsoft Purview tenants can instead select the free built-in Australia Driver's License Number entity (1cbbc8f5-9216-4392-9eb5-5ac2298d1356); this compatibility pattern is not a custom clone of that built-in.
- Type
- regex
- Confidence
- low
- Detection quality
- Mixed
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Detects AEMO MSATS retail-market transaction content - aseXML transaction names (CATSChangeRequest, NMIDiscoveryRequest/Response, ServiceOrderRequest/Response, MeterDataNotification), CATS change-request codes (e.g. CR1000/CR1060, CR4050/1, CR5050/1), and role-coded NMI standing data (FRMP/LNSP/MDP with an NMI). These artefacts carry customer transfer, metering and consumption context regulated under the retail market procedures.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- National Energy Retail Rules / NER Ch 7 (metering), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Detects references to nationality/citizenship/immigration-status disclosure in Australian documents: nationality fields, national origin, citizenship status, visa status, and naturalization records. Not framed as an Art-9-style special category (Australia has no equivalent regime) — sensitivity here rests on immigration-status/visa risk under the Migration Act 1958 (Cth) and on the "national origin" limb of the Racial Discrimination Act 1975 (Cth), distinct from that Act's race/ethnicity limb covered by the sibling au-racial-ethnic-origin pattern. Topic-grade detector, low confidence by design.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- au
- Regulations
- Migration Act 1958 (Cth), Racial Discrimination Act 1975 (Cth), Privacy Act 1988 (Cth), NDB Scheme (Cth)
- Frameworks
- ISO 27001, NIST CSF, SOC 2
Detects NDIS Participant Number patterns. A 9-digit number starting with the prefix 43.
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
NDIS records for a named participant: access requests (Access Request Form, Supporting Evidence Form), NDIS plans and budgets (Core, Capacity Building, Capital supports), plan reassessments, service agreements, support coordination and plan management records.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- National Disability Insurance Scheme Act 2013 (Cth), Privacy Act 1988 (Cth)
- Frameworks
- QGISCF
Reportable incident notifications and investigation records for a named NDIS participant: death, serious injury, abuse or neglect, unlawful sexual or physical contact, sexual misconduct and unauthorised use of a restrictive practice (24-hour immediate notification and 5-business-day report).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- National Disability Insurance Scheme Act 2013 (Cth), NDIS (Incident Management and Reportable Incidents) Rules 2018 (Cth)
- Frameworks
- QGISCF
Detects AEMO NEM dispatch bid/offer submission artefacts - the MMS bidding table vocabulary (BIDDAYOFFER, BIDOFFERPERIOD, BIDOFFERFILETRK, MNSP day-offer tables), the Dispatch Bid/Offer Submissions JSON payload fields (energyBids, fcasBids, mnspBids, rebidExplanation), and the participant FTP bid filename convention (<PARTICIPANTID>_<x>BID<x>_<timestamp>.zip/.json). Pre-dispatch bids, price bands and rebid reasoning are commercially critical trading data for market participants.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- National Electricity Rules, Competition and Consumer Act 2010 (Cth), Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001
Detects AEMO Dispatchable Unit Identifiers (DUIDs) when labelled as such. DUIDs are short (max 8 character) unit codes - modern IDs are alphanumeric, legacy IDs may contain '#', '/' or '-' (e.g. BARRON-1, W/HOE#1, ER01, LOYYB1). IMPORTANT: DUIDs are fully PUBLIC identifiers (published in the AEMO NEM Registration and Exemption List and in five-minute NEMWEB dispatch data). This pattern is a discovery-only context marker and corroborative building block for sensitive-content patterns (bids, availability, curves) - it must never enforce on its own. A bare DUID token is indistinguishable from ordinary text, so the pattern requires the DUID label (or dispatchable-unit phrasing) immediately before the code.
- Type
- regex
- Confidence
- low
- Jurisdictions
- au
- Regulations
- National Electricity Rules Ch 2 (registration) and cl 3.8 (dispatch), Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001
Internal generating-unit outage and maintenance plans held by a NEM generator before (or in more detail than) the public PASA submission: planned outage schedules and overhaul programmes listing the unit or DUID, outage start and finish dates, MW deratings, unit states, work scope and return-to-service (RTS) dates or unit recall times. The unit-level PASA availability and unit-state codes AEMO publishes under NER cl 3.7.2(f)(5) (NEMweb MTPASA_DUIDAvailability / STPASA_DUIDAvailability) are public and treated as decoys; the plan detail behind them (scope, work orders, exact dates, reason narrative, drafts not yet submitted) is not published.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- National Electricity Rules, Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001
Internal NEM trading-desk rebid records: trading log / log book entries and the late-rebid contemporaneous record that a Generator must make under NER cl 3.8.22(ca). These entries carry the material conditions behind a rebid, the event, aware and decision times (AER Rebidding and Technical Parameters Guideline s 3.4 fields eventTime, awareTime, decisionTime), the P/A/F/E rebid category and the fuller narrative behind a published "SL" / "see log" rebid reason. Distinct from au-nem-bid-file, which detects AEMO MMS bid tables, Dispatch Bidding API JSON keys and bid filenames; this classifier covers the trader's reasoning record, which is never published.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- National Electricity Rules, AER Rebidding and Technical Parameters Guideline (October 2024), Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001
Completed system restart material for a named National Electricity Market generating system or network: local black system procedures (LBSPs) that generators, integrated resource providers and network service providers must prepare and submit to AEMO for approval under NER cl 4.8.12(d)-(g), and extracts of the AEMO system restart plan, which NER cl 4.8.12(b) makes confidential information. Such a record holds plant and unit data, units that can restart without external supply, dead-bus synchronisation and trip-to-house-load (TTHL) capability, minimum load and transformer energisation limits, step-by-step restart switching, and approver and contact blocks. The blank AEMO Generator LBSP template, the SRAS Guideline, the System Restart Standard and news about restart tests contain the same headings without values, so they stay at 65 discovery.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- National Electricity Rules, National Electricity Law, Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001
Working and draft National Greenhouse and Energy Reporting (NGER) material before it is lodged with, or published by, the Clean Energy Regulator: section 19 reports being prepared in EERS (the Emissions and Energy Reporting System), facility details under NGER Regulations reg 4.04A (facility name, address, facility identification number, industry sector), facility-level Scope 1 and Scope 2 emissions in t CO2-e, energy production and consumption in GJ / MWh, fuel activity data, method selections, NGER Act s 23 audit information (audit team leader, assurance findings), and Safeguard Mechanism working papers (responsible emitter, covered emissions, baseline emissions number, net position number, SMC / ACCU surrender planning, declared multi-year periods). The CER's own published data (corporate and electricity sector CSVs released by 28 February, the Safeguard baselines and emissions table released by 15 April) is public and is excluded from enforce tiers.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- National Greenhouse and Energy Reporting Act 2007 (Cth), National Greenhouse and Energy Reporting Regulations 2008 (Cth), National Greenhouse and Energy Reporting (Safeguard Mechanism) Rule 2015 (Cth), Clean Energy Regulator Act 2011 (Cth)
- Frameworks
- QGISCF, PSPF
Detects New South Wales driver licence numbers in the established eight-digit or four-digit-plus-two-letter shapes. Enforceable tiers require an explicit driver-licence-number label and NSW context; the strict tier additionally requires Transport for NSW, Service NSW, or a legacy NSW road authority.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au-nsw
- Regulations
- Privacy Act 1988 (Cth), Privacy and Personal Information Protection Act 1998 (NSW), Road Transport Act 2013 (NSW)
- Frameworks
- ISO 27001
Detects Northern Territory driver licence numbers in the established six-to-eight-digit shape. Enforceable tiers require an explicit driver-licence-number label and NT context; the strict tier additionally requires Motor Vehicle Registry authority evidence.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au-nt
- Regulations
- Information Act 2002 (NT), Motor Vehicles Act 1949 (NT), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Detects five implemented Australian standard number-plate shapes for NSW, Victoria, Queensland, South Australia, and Western Australia. It does not validate issuance and excludes personalised plate formats; registration and transport-agency evidence controls enforcement.
- Type
- regex
- Confidence
- low
- Detection quality
- Partial
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects references to patents, intellectual property registrations, and IP Australia filings.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, NIST CSF, PCI-DSS
Populated employee pay slips and payroll wage records: the Fair Work pay slip (employer name and ABN, employee name, pay period, date of payment, gross and net amounts, deductions, superannuation contributions, hourly rate or annual salary, loadings and allowances - Fair Work Regulations 2009 regs 3.45-3.46) and the Queensland time and wages record kept by state and local government and other state-system employers (Industrial Relations Act 2016 (Qld) ss 339-340).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Fair Work Act 2009 (Cth), Fair Work Regulations 2009 (Cth), Industrial Relations Act 2016 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701, QGISCF
Detects PBS Prescriber Number patterns. A 7-digit number whose check digit uses weights [0,5,8,4,2,1], mod 11 (checksum NOT enforced in this regex-only pattern; structural detection only).
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects a populated Australian residential street address linked to a labelled person. Bare address structure is available for discovery, the balanced tier requires person and residential context plus Australian geography, and the strict tier requires state and postcode corroboration. A parallel household-utility path treats a utility supply/service address linked to a labelled account holder as a person-linked residence. Absorbs the former au-top500-041-home-address and au-top500-054-home-utility-account-addresses classifiers.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Catalogue reference for the Microsoft Purview built-in Australia physical addresses named-entity SIT. Microsoft rates the built-in at medium confidence and includes it in All Physical Addresses. This YAML-only record supplies supplementary Australian address vocabulary for registry search and testing; it does not reproduce Microsoft's opaque named-entity engine and is not a custom XML clone.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- au
- Regulations
- NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects Nationally Coordinated Criminal History Check (National Police Check) certificate and application reference numbers issued through the ACIC National Police Checking Service. Matches a police check phrase near a reference / certificate / receipt value that identifies a specific check.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects Australian property title and plan references used across state and territory land-title systems, including Lot/DP, Lot/SP, Lot/PS, Lot/LP, Lot/CP, title references, and folio identifiers. Requires land-registry context for enforcing tiers.
- Type
- regex
- Confidence
- low
- Detection quality
- Partial
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Psychosocial hazard registers and risk assessments kept by a person conducting a business or undertaking under the Work Health and Safety Regulation 2011 (Qld) Part 3.2 Division 11 (s 55A meaning of psychosocial hazard, s 55B meaning of psychosocial risk, s 55C duty to manage psychosocial risks, s 55D determining control measures) and the Managing the risk of psychosocial hazards at work Code of Practice 2022 (in force 1 April 2023). Register rows record a hazard (job demands, low job control, poor support, aggression from customers, remote or isolated work), a risk rating, controls and an owner for a team or work area. Most rows are aggregate; the higher tier is reserved for rows that identify an affected worker or link a complaint, grievance or claim. The Code's own text and example register, blank registers and training material are decoys. Complements au-workplace-harassment-psychosocial-complaint, which covers individual complaints.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Work Health and Safety Regulation 2011 (Qld), Managing the risk of psychosocial hazards at work Code of Practice 2022 (Qld), Work Health and Safety Act 2011 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Queensland senior secondary applications for access arrangements and reasonable adjustments (AARA), including illness and misadventure, for a named student: diagnosis, medical practitioner report, functional impact and the arrangement sought for internal or external assessment.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Education (Queensland Curriculum and Assessment Authority) Act 2014 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Detects populated queensland learner unique identifier (lui) using record context and corroborating fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Education (Queensland Curriculum and Assessment Authority) Act 2014 (Qld), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Council dog and cat registration forms, registration notices, renewals and registry records that identify the owner. Dog registration is statutory under the Animal Management (Cats and Dogs) Act 2008. Under s 47 the registration form must state the owner's name, residential address, contact telephone number and email address, and the dog's age, breed, colour, sex, distinguishing marks, address, PPID number, desexing and regulated status. The council gives the owner a registration notice (s 49) and keeps it in the dog registry (ss 177-178). Cat registration, where required, is imposed by local law, which s 6 permits. The dog registry is open to public inspection, but owner information in the registration notice is excluded (s 179(2)), and s 39 restricts the release of identifying information. The owner block is therefore the sensitive part of the record. Declarations, attacks and destruction orders are covered by au-qld-regulated-dog-declaration-attack-record.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Animal Management (Cats and Dogs) Act 2008 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Populated workplace asbestos records under the Work Health and Safety Regulation 2011 (Qld) chapter 8: asbestos registers (s 425 - date identified, location, type and condition of asbestos or ACM), asbestos management plans (s 429, reviewed at least every 5 years under s 430), asbestos removal control plans (s 464), regulator notification of licensed removal (s 466), clearance inspections and clearance certificates (ss 473-474, including the less than 0.01 asbestos fibres/mL air-monitoring statement), air monitoring (s 482) and class A / class B removal licence details (ss 485, 487). The target is a record for a real site with filled location, material, friable status, condition, sample result or removalist fields. Worker asbestos health monitoring reports (ss 435-444) are covered by au-whs-health-monitoring-record and are not targeted here.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Work Health and Safety Regulation 2011 (Qld), Work Health and Safety Act 2011 (Qld)
- Frameworks
- QGISCF
Detects Queensland blue card (working with children check) applications, renewals and screening outcomes for a named applicant - blue card application or renewal records, positive or negative notices and exemption cards - when the phrase sits with populated applicant identifiers and application fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Working with Children Check Act 2000 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Detects QLD Bond Loan applications for rental assistance and financial hardship support.
- Type
- keyword_list
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Identifies Queensland building approvals, permits, certifications, development applications and decision notices. Topic phrases are retained for discovery; enforcement requires populated approval-record fields (applicant, property, certifier, decision date, application number), and high confidence adds a second field plus decision or authority context.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Building Act 1975 (Qld), Information Privacy Act 2009 (Qld), Planning Act 2016 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, NIST CSF, QGISCF
Complainant and investigation content in Queensland council building, plumbing and planning compliance files: complaint intake records, complainant details, site inspection and investigation notes, and officer recommendations that lead to a show cause or enforcement notice. The notices themselves are largely public. Building Act 1975 s 247 (show cause), s 248 (enforcement notices) and s 251 (register of notices given); Plumbing and Drainage Act 2018 ss 143-146 (enforcement and show cause notices) with Plumbing and Drainage Regulation 2019 s 115 (register of show cause and enforcement notices) and s 116 (register open to inspection free of charge); Planning Act 2016 s 167 (show cause), s 168 (enforcement notices) and s 170 (notifying about them). The private part is who complained, often a neighbour, and what officers recorded during the investigation. This classifier targets that content, not the notice or the public register entry.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Building Act 1975 (Qld), Plumbing and Drainage Act 2018 (Qld), Plumbing and Drainage Regulation 2019 (Qld), Planning Act 2016 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Notifications to the Crime and Corruption Commission of suspected corrupt conduct (Crime and Corruption Act 2001 s38), s40 direction assessments and internal corrupt-conduct assessment and investigation records that name the subject officer.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Crime and Corruption Act 2001 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Council records of requests for CCTV footage and of footage released: request forms from residents, insurers and businesses, police requests, and release registers or logs recording the camera, the footage period, the incident or Queensland Police Service (QPS) reference, and who received the footage. No Queensland statute deals specifically with council CCTV. Councils handle footage as personal information under the Information Privacy Act 2009 and their CCTV policy. A disclosure to a law enforcement agency relies on QPP 6.2(e) (disclosure reasonably necessary for enforcement-related activities), and QPP 6.5 requires the agency to make a written note of that disclosure. That note is the basis of the release register. Council CCTV policies, published camera location lists, legislation and news are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Information Privacy Act 2009 (Qld), Council CCTV policy (no specific statute)
- Frameworks
- QGISCF
Council cemetery and crematorium records about a deceased person and the people arranging the disposal of the remains: burial and interment applications and bookings, rights (grants) of burial or interment, ashes and niche placements, exhumation applications and approvals, and cremation records. Cremation records follow the Cremations Act 2003 (Qld): an application for a permission to cremate by a close relative, personal representative or their agent (s 6), accompanied by a cause of death certificate and a cremation risk certificate, and the crematorium's record of particulars and permissions kept for 15 years (s 14). A populated record names the deceased (name, date of death, age, cause or place of death), the applicant, next of kin, right holder or funeral director and their relationship to the deceased, and the plot, niche or right number and burial, cremation or exhumation date. Published burial search and grave locator listings, fee schedules, cemetery policies and the statute text are decoys. The statutory basis for burial and exhumation records is council local law and is not asserted here.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Cremations Act 2003 (Qld), Information Privacy Act 2009 (Qld), Public Records Act 2023 (Qld)
- Frameworks
- QGISCF
Unpublished contaminated land records under the Environmental Protection Act 1994 (Qld) chapter 7 part 8: site investigation reports and validation reports (s 381), site management plans (s 383), site suitability statements, auditor reports, and working papers about land on the environmental management register (EMR, s 371 - a notifiable activity has been carried out, or the land is contaminated) or the contaminated land register (CLR, s 372). Notifiable activities include Schedule 3 item 8 (operating a coal fired power station) and item 13 (manufacturing, repairing or disposing of electrical transformers). The target is a document for a real site with filled lot on plan / site / contaminant fields and sampling or laboratory content, such as soil and groundwater results in mg/kg or ug/L. Bare EMR/CLR search extracts are fee-based public records (s 542) and are deliberately held at discovery unless they carry investigation content.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Environmental Protection Act 1994 (Qld)
- Frameworks
- QGISCF
Queensland Corrective Services Victims Register applications (Form 49), referrals (Form 49a), nominee registrations and notifications linking a registered victim or eligible person to a named offender (parole, discharge, escape, transfer, death). Around 60% of registrations relate to domestic and family violence.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Corrective Services Act 2006 (Qld)
- Frameworks
- QGISCF
Queensland Corrective Services statutory orders and decisions about a named prisoner: safety orders (including temporary and consecutive), maximum security orders, separate confinement orders, breach of discipline, transfer orders, leave of absence, discharge orders and security classification decisions under the Corrective Services Act 2006.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Corrective Services Act 2006 (Qld), Corrective Services Regulation 2017 (Qld)
- Frameworks
- QGISCF
Council agenda reports, attachments and minutes for business closed to the public under Local Government Regulation 2012 s254J: CEO or staff appointment, discipline or dismissal; rating concessions; commercial negotiations; land acquisition; legal advice and other confidential matters.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Local Government Regulation 2012 (Qld), Local Government Act 2009 (Qld)
- Frameworks
- QGISCF
Council-issued infringement notices for local law and animal management offences, and the default certificates and referral records that send unpaid notices to the State Penalties Enforcement Registry (SPER). Under State Penalties Enforcement Act 1999 s 15, an infringement notice must state a unique number for the notice, its date, the alleged offender's full name and address, the offence particulars (place, time and date, and identifying particulars for any animal or vehicle), and the fine. s 22 and s 23 set out payment, court election and instalments within 28 days. When the alleged offender defaults, the administering authority may give SPER a default certificate (s 33), and SPER may then issue an enforcement order (s 38). Council compliance and remedial notices (Local Government Act 2009 s 138AA) often precede the infringement. Local law registers are public, but individual notices and SPER referral batches are not.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- State Penalties Enforcement Act 1999 (Qld), Local Government Act 2009 (Qld), Animal Management (Cats and Dogs) Act 2008 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Queensland local government records about overdue rates and charges and the sale of land to recover them under Local Government Regulation 2012 ch 4 pt 12: arrears ledgers and debt recovery referrals (s 132 overdue rates, s 133 interest on overdue rates), and notices of intention to sell land for overdue rates or charges (s 140), which must state the resolution date and terms, the land as shown in the land record, the overdue amount including the period unpaid, and the interest owing. Sale procedures follow in ss 141-146. These records tie a named owner, a rates assessment or property number and a land description to that owner's arrears. The auction notice that s 142 requires councils to publish is public and is a decoy.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Local Government Regulation 2012 (Qld), City of Brisbane Act 2010 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Individual applications, assessments and decisions for rates concessions made by Queensland local governments under Local Government Regulation 2012 ch 4 pt 10. Covers pensioner rebates (s 120(1)(a) land owned or occupied by a pensioner; s 123 rebate for land occupied by pensioners; sch 8 defines a pensioner as a holder of a pensioner concession card), hardship concessions (s 120(1)(d) payment will cause hardship to the land owner) and agreements to defer rates (ss 121(b), 125). A concession for a stated ratepayer can be granted only after that ratepayer applies (s 122(3)). These records link a named applicant and property to Centrelink or DVA concession status, income, household circumstances and the council's decision. Council concession policies, revenue statements and class resolutions are public and are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Local Government Regulation 2012 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Register of interests entries and lodgement forms for a Queensland local government's chief executive officer, senior executive employees, councillor advisors and persons related to them (spouse or dependent), kept under Local Government Regulation 2012 (Qld) ss 289-291 and schedule 5 (shareholdings and controlling interests, executive officer roles, trusts, self managed superannuation funds, land, liabilities, gifts, sponsored travel and other particulars). Unlike a councillor's register, which may be inspected by the public (s 293(1)) and is published as an extract (s 295), these registers are open only to councillors, the CEO and persons permitted by law (s 293(2)-(3)); access must be applied for in writing and logged (s 294), and disclosure outside those persons is an offence (s 297(2)). The public councillor register, its published extracts and councillor declarations in minutes are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Local Government Regulation 2012 (Qld), Local Government Act 2009 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Rates and water account records held by Queensland councils and water service providers that flag a ratepayer or water customer as affected by domestic and family violence and record the protective steps taken: a safe or preferred contact method, a suppressed or confidential postal or residential address, instructions not to disclose account details to a co-owner, joint account holder or former partner, account separation, redirected rate notices, and payment arrangements, interest waivers or holds on recovery or restriction action. Unlike energy (National Energy Retail Rules Part 3A) there is no verified Queensland statute that sets out these steps for councils or water providers; they come from council and utility hardship and DFV policies, with the Local Government Regulation 2012 s 120(1)(d) hardship concession and Information Privacy Act 2009 obligations in the background. Modelled on au-energy-family-violence-customer-record. Published council and utility DFV and hardship policies are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), Local Government Regulation 2012 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- QGISCF
Complaints, assessments, investigations and referrals about councillor conduct handled by the Office of the Independent Assessor (OIA), councils and the Councillor Conduct Tribunal: conduct breaches, misconduct, unsuitable meeting conduct, conflicts of interest and release of confidential information.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Local Government Act 2009 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Submitter names and contact details in submissions about Queensland development applications, submission summaries in assessment reports, and decision notices that list principal submitters. Under the Planning Act 2016 sch 2, a properly made submission must state the name and residential or business address of all submission-makers and one postal or electronic address for service. Section 63(2)(h) requires the decision notice to state the name, residential or business address and electronic address of each principal submitter. Planning Regulation 2017 sch 22 s 5(1)(d) requires the assessment manager to keep any properly made submission available for inspection and purchase. These documents are public by law. Many councils redact submitters' contact details before publishing online, but that is council practice, not a verified statutory requirement. This is a discovery-only redaction aid. It surfaces documents that carry submitter details so they can be reviewed before publication. It is not a blocking classifier.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Planning Act 2016 (Qld), Planning Regulation 2017 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Notices ending a tenancy interest because of domestic and family violence (RTA Form 20, R20 for rooming accommodation), bond refunds for people experiencing DFV (Form 4a) and the supporting Domestic and Family Violence Report, identifying the tenant, the rental premises and the evidence of violence.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Residential Tenancies and Rooming Accommodation Act 2008 (Qld), Domestic and Family Violence Protection Act 2012 (Qld)
- Frameworks
- QGISCF
Completed registrations and entries in a Queensland council or Local Disaster Management Group vulnerable persons register (VPR), also called a special needs register or a register of persons requiring special assistance in a disaster or evacuation. A populated entry ties a named person and home address to disability, mobility or medical dependency (oxygen, dialysis, life sustaining equipment), a carer or emergency contact, and evacuation or transport needs. The Disaster Management Act 2003 does not create or name these registers. Councils keep them under the state framework "People with vulnerabilities in disasters: A framework for an effective local response" (2016) and their own local disaster management arrangements. Information acquired while performing a function under the Act is covered by the s 139 confidentiality offence. The Local Disaster Management Plan is public (s 60) but the register is not.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Disaster Management Act 2003 (Qld), Information Privacy Act 2009 (Qld), Public Records Act 2023 (Qld)
- Frameworks
- QGISCF
Working records of a drinking water service provider's notifications to the drinking water regulator under Water Supply (Safety and Reliability) Act 2008 (Qld) s 102 (notice of noncompliance with water quality criteria) and s 102A (notice of prescribed incident): the immediate notification and the follow-up notice in the approved form covering the noncompliance or incident, the circumstances, the action taken or to be taken, and the measures to prevent recurrence. Includes internal boil water notice decision and incident logs that carry the scheme, incident reference, notification times, parameter exceedances (E. coli, total coliforms, turbidity NTU, chlorine mg/L) and corrective actions. Distinct from au-water-quality-data-reference, which covers routine measured water quality data: this classifier needs the incident or notification structure. Public boil water notices, media releases and published DWQMP annual or water quality reports are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Water Supply (Safety and Reliability) Act 2008 (Qld)
- Frameworks
- QGISCF
Detects completed Queensland driver licence application, renewal and replacement forms (Transport and Main Roads, e.g. F3000) containing populated applicant fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Transport Operations (Road Use Management) Act 1995 (Qld), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects Queensland driver licence numbers in the established eight-to-nine-digit shape. This identifier SIT is separate from au-qld-driver-licence-form, which detects application and renewal documents rather than populated licence numbers.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au-qld
- Regulations
- Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth), Transport Operations (Road Use Management) Act 1995 (Qld)
- Frameworks
- ISO 27001
Post-election elector participation data ("election and elector information") that the Electoral Commission of Queensland releases on request to registered political parties, independent members and, for council elections, councillors: for each elector who voted, their name and address, whether they voted in person, by post or in another way, and the polling booth location (Electoral Act 1992 s 133A; LG Fact Sheet 04). Also marked-roll extracts that record which electors voted. The data may be used only for an election-related purpose (s 133A(6), maximum 200 penalty units) and never includes silent electors (s 133A(5)). Booth-level results, turnout statistics, results by vote type and the fact sheet are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Electoral Act 1992 (Qld), Local Government Electoral Act 2011 (Qld), Commonwealth Electoral Act 1918 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Extracts and copies of the Queensland electoral roll or a council voters roll: the certified copies and electronic roll data that the Electoral Commission of Queensland (ECQ) must give candidates, registered political parties, members of the Legislative Assembly and local governments (Electoral Act 1992 s 61; Local Government Electoral Act 2011 s 21), and AEC Electoral Roll Access (ERA) data files. The roll holds each elector's surname, given names, address, sex, occupation, date of birth, identifying number and enrolment date (s 58(3); Electoral Regulation 2024 s 3). Only name and address are in the publicly available part (sch 1; Regulation s 5), so a copy that carries date of birth, sex, occupation, enrolment date or an elector ID is restricted information whose misuse is an offence (s 177; Commonwealth Electoral Act 1918 s 91B). Enrolment figures, public inspection guidance, party and candidate registers and fact sheets are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Electoral Act 1992 (Qld), Electoral Regulation 2024 (Qld), Local Government Electoral Act 2011 (Qld), Commonwealth Electoral Act 1918 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Completed notifications and internal records of a serious electrical incident or dangerous electrical event under the Electrical Safety Act 2002 (Qld). Serious electrical incident (s 11) covers a person killed by electricity or receiving a shock or injury treated by or under a doctor, or at high voltage. Dangerous electrical event (s 12) covers unsafe proximity to HV equipment, significant property damage caused by electricity, and unlicensed or unsafe electrical work. A business or undertaking must notify the regulator immediately (Electrical Safety Regulation 2013 s 265, with written notice within 48 hours if required and records kept 5 years). A distribution entity must give written notice in the approved form received within 24 hours (s 266). Section numbers are taken from the 27 Sep 2024 version of the Regulation; the current version could not be retrieved. Records name the injured or involved person, date, time and location, the equipment and voltage, the injury and treatment, and the notification to the Electrical Safety Office. The Act and Regulation, ESO safety alerts and prosecution summaries, toolbox talks and blank forms are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Electrical Safety Act 2002 (Qld), Electrical Safety Regulation 2013 (Qld)
- Frameworks
- QGISCF
Completed enduring powers of attorney (Form 2 short form, Form 3 long form) and advance health directives (Form 4) under the Powers of Attorney Act 1998: principal and attorney details, financial and personal/health powers, life-sustaining treatment directions and capacity statements.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Powers of Attorney Act 1998 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Completed electoral enrolment and update-of-enrolment forms, and the enrolment transaction records that ECQ and the AEC hold under the joint roll arrangement (Electoral Act 1992 (Qld) s 62). A claim for enrolment carries the elector's name, date of birth, residential, postal and previous addresses, and evidence of identity: an Australian driver's licence number, an Australian passport number, Medicare card details or a citizenship certificate number (Commonwealth Electoral Act 1918 ss 98, 98AA; AEC form ER022ESw_QLD Q2, Q3, Q6 and Q7). Queensland enrolment and provisional enrolment of 16 and 17 year olds run under Electoral Act 1992 ss 65 and 66. Date of birth, sex, occupation and enrolment date are restricted information that is never in the publicly available part of the roll (Electoral Regulation 2024 s 5), and Electoral Act s 33 makes the information confidential in the hands of anyone administering the Act. The "Enrol or update your enrolment" guidance, blank forms and published enrolment figures are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Electoral Act 1992 (Qld), Electoral Regulation 2024 (Qld), Commonwealth Electoral Act 1918 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Populated environmental incident records under the Environmental Protection Act 1994 (Qld): duty-to-notify reports of serious or material environmental harm (s 320B employee to employer and s 320D employer written notice to the administering authority, each within 24 hours; s 320DA owner, occupier or auditor), transitional environmental program (TEP) documents (ss 330-344E), environmental authority (EA) non-compliance and incident reports, and incidents at regulated structures such as ash dams and tailings or process-water dams (assessed by consequence category). The target is an internal incident notification, investigation or compliance report with a filled incident date, location, contaminant, release quantity or EA field. Lodged EA conditions, the EA public register and published monitoring results (s 540 public register) are public and are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Environmental Protection Act 1994 (Qld), Environmental Protection Regulation 2019 (Qld)
- Frameworks
- QGISCF
Council food business licence applications, food premises inspection reports and improvement notices under the Food Act 2006 (Qld). A person must hold a licence to carry on a licensable food business (s 49). The application is made to the local government (s 52) in the approved form, which must provide for the applicant's contact details (s 85). It must state the applicant's name and address, or for a corporation its directors, the premises, the business, and details of any conviction for a relevant offence (s 53). Council decides suitability, including convictions and previous refusal, suspension or cancellation (s 57). An authorised person may give an improvement notice stating the provision believed to be contravened, how it is contravened and the period to remedy it (s 209). Information gained in administering the Act about a person's affairs is confidential (s 272). The chief executive's register of mobile-premises food businesses (ss 264-266), council lists of licensed businesses and published conviction or "name and shame" registers are public and are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Food Act 2006 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Detects QLD Government tender documents including procurement evaluations, pricing schedules, and evaluation criteria.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects QLD Health clinical handover documents containing patient status, medications, and treatment plans.
- Type
- keyword_list
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Queensland public health medical records - patient files, clinical and health records, discharge summaries, progress notes and ieMR extracts - when the record phrase sits with populated patient identifiers (URN/MRN, name, DOB, Medicare) and clinical record fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), My Health Records Act 2012 (Cth), Hospital and Health Boards Act 2011 (Qld)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects completed Queensland patient consent records - informed, treatment, surgical and anaesthetic consent forms, advance health directives and enduring power of attorney (health) documents - when the consent phrase sits with populated patient identifiers and consent form fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Hospital and Health Boards Act 2011 (Qld), Powers of Attorney Act 1998 (Qld), Guardianship and Administration Act 2000 (Qld)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Identifies Queensland heavy-vehicle access permit applications and issued permit records for oversize, overmass, Class 1, B-double, and road-train movements. Queensland topic context is discovery-only; enforcement requires operator, vehicle, route, or access-condition fields, while high confidence also requires a labelled permit/application reference and NHVR authority context.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- DISP, ISO 27001, NIST CSF
Detects Queensland home education registration records for a named child - home education registration or provisional registration applications and reports, and exemptions from compulsory schooling - when the phrase sits with populated child/parent identifiers and registration fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), Education (General Provisions) Act 2006 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Detects populated Queensland social / public housing applications and housing register records: a housing application or housing register phrase combined with a named applicant or household member, household income, household size or current address. Phrase-only mentions stay discovery-only.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Housing Act 2003 (Qld), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Contact lists, call-out lists and activation rosters for a Queensland council's Local Disaster Management Group (LDMG) that hold members' private after-hours mobiles, home phone numbers, home addresses or personal email addresses. Every local government must establish a Local Disaster Management Group (Disaster Management Act 2003 s 29), whose chairperson appoints a local disaster coordinator (s 35). The council gives written notice of the group's members to the police commissioner and the district group each year (s 37). The local disaster management plan must be available for inspection and on the council website (s 60), so published LDMG membership that lists roles and office numbers is public and is a decoy. Information acquired in performing a function under the Act must not be disclosed (s 139). Vulnerable persons registers are covered by au-qld-disaster-vulnerable-persons-register.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Disaster Management Act 2003 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Public library member (borrower, patron) records held by Queensland councils, which may run library facilities as a local government function under the Libraries Act 1988 s 54: membership applications and registrations, member profiles and exports from the library management system, junior member records with parent or guardian consent, borrowing and loan histories, holds and reservations, and overdue notices. The Libraries Act has no member-privacy provision; confidentiality rests on the Information Privacy Act 2009 and council policy. Reading history can reveal political, religious, health and sexuality interests, and junior member records hold children's data. Library policies, conditions of membership, catalogue records and news are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Libraries Act 1988 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Queensland major hazard facility (MHF) safety case outlines and safety cases under the Work Health and Safety Regulation 2011 (Qld) chapter 9 (ss 551-561, Schedule 18: facility description, process flow drawings, general layout drawings locating major incident hazards and initiators, security arrangements), and manifests of hazardous chemicals under s 347 and Schedule 12 (UN number, proper shipping name, class and division, container and storage area identification, after-hours contacts). Populated versions give a hostile reader a map of what is stored where and how the site is protected.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Work Health and Safety Regulation 2011 (Qld)
- Frameworks
- QGISCF
Completed records under the Queensland Mandatory Notification of Data Breach (MNDB) scheme in chapter 3A of the Information Privacy Act 2009 (Qld), as inserted by the Information Privacy and Other Legislation Amendment Act 2023: the s 51 statement to the Information Commissioner, the s 53 notice to affected individuals, s 52 further information, and entries in the s 72 register of eligible data breaches. The scheme has applied to Queensland government agencies since 1 July 2025 and to local government since 1 July 2026. A populated record names the agency and gives the date of the breach, the type of eligible data breach (unauthorised access, unauthorised disclosure or loss, s 47), the kinds of personal information involved, the number of individuals affected or notified, and the containment and mitigation steps. OIC guidance, the Act, published MNDB statistics and blank templates are decoys. Overlaps with au-data-breach-report, which is framed around the Commonwealth Notifiable Data Breaches scheme (Privacy Act 1988 Part IIIC); Commonwealth NDB signals are excluded from this classifier's enforce tiers.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), Information Privacy and Other Legislation Amendment Act 2023 (Qld)
- Frameworks
- QGISCF
Detects QLD marine vessel registration documents and operator licence details.
- Type
- keyword_list
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- DISP, ISO 27001, NIST CSF
Detects Queensland mental health assessment and involuntary treatment records - psychiatric assessments and evaluations, mental state examinations, examination and treatment authorities, forensic orders, recommendations for assessment and Mental Health Review Tribunal matters - when the phrase sits with populated patient identifiers and assessment fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Mental Health Act 2016 (Qld), Hospital and Health Boards Act 2011 (Qld)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Elector-level records from ECQ's compulsory voting enforcement process: apparent failure to vote notices issued after a State or local government election (Electoral Act 1992 (Qld) s 134), elector responses giving a valid and sufficient reason for not voting or saying that they did vote and giving the details, payment records (s 135), infringement notices for failing to vote (s 186; LGEA 2011 ss 165, 166, 168), and referrals of unpaid notices to the State Penalties Enforcement Registry (SPER). ECQ's published process is apparent failure to vote notice, then infringement notice, then SPER referral. Excuses often disclose health conditions, hospital admissions, disability, bereavement, travel, religious duty (s 186(2)) or family circumstances. The "Do I have to vote?" page, penalty unit value statements, aggregate non-voter statistics and blank response forms are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Electoral Act 1992 (Qld), Local Government Electoral Act 2011 (Qld), State Penalties Enforcement Act 1999 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Detects Queensland notifiable condition reports - notifiable condition or disease notifications, communicable disease reports and public health notifications made under the Public Health Act 2005 (Qld) - when the phrase sits with populated case identifiers and notification fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Public Health Act 2005 (Qld)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
OneSchool Support records and individual curriculum and learning plans for a named Queensland state school student (Individual Curriculum Plan, Individual Learning Plan). Behaviour support and student safety plans are covered by au-education-student-safety-behaviour-plan.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Education (General Provisions) Act 2006 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Parole applications, Parole Board Queensland decisions and parole orders for a named prisoner: court ordered and board ordered parole, exceptional circumstances parole, conditions, show-cause notices and amendment, suspension or cancellation orders.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Corrective Services Act 2006 (Qld)
- Frameworks
- QGISCF
Records of a pool immersion incident involving a young child (under 5) in Queensland under the Building Act 1975: the hospital notice to the chief executive (health) under s 245G (name and date of birth of the young child, day of the examination, address of the child's parents, address where the incident happened), the onward notice to QBCC, the local government and the Family and Child Commissioner under s 245I, and the council's follow-up pool inspection under s 246ADA, together with council drowning and near-drowning incident files. Pool immersion information may be disclosed only as allowed by s 257A. Public pool safety certificate and regulated pools register entries, pool fencing guidance, the statute text and drowning statistics are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Building Act 1975 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Elector-level postal and declaration voting records held by ECQ and returning officers: postal vote applications (Electoral Act 1992 (Qld) s 119, which require the address to which ballot papers are to be sent), the record of posted voting papers (s 119(7)), declaration envelope records that are signed and witnessed (ss 117, 119(8)), declaration envelopes for uncertain identity (s 121), the register of special postal voters (s 68; grounds in s 114(2)), and late-vote registers. Silent electors are automatically special postal voters (s 114(2)(b)), so the special postal voter register and dispatch lists hold silent-elector addresses. Declaration envelopes are stored for at least a year (s 136). Local government elections have parallel provisions (LGEA 2011 ss 21A, 79, 81, 82). The ECQ postal voting web page, the declaration envelope count procedure, postal vote statistics and blank forms are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Electoral Act 1992 (Qld), Local Government Electoral Act 2011 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Tenancy enforcement records for named social housing tenants: Antisocial Behaviour Policy warnings and strikes, Acceptable Behaviour Agreements, Notice to remedy breach (Form 11), Notice to leave (Form 12) and termination and QCAT tenancy applications.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Residential Tenancies and Rooming Accommodation Act 2008 (Qld), Housing Act 2003 (Qld)
- Frameworks
- QGISCF
Public interest disclosures under the Public Interest Disclosure Act 2010 (Qld) and the records that identify the discloser: assessments, reprisal risk assessments, referrals to a proper authority and investigation files. Disclosure of a discloser's identity is an offence and exposes them to reprisal.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Public Interest Disclosure Act 2010 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Discipline records about an identified public sector employee under the Public Sector Act 2022 (Qld) and the Discipline Directive 05/23 (made under ss 100 and 222): show cause notices on disciplinary finding (allegation, particulars, the disciplinary ground under section 91 and the evidence, 14 days to respond), show cause notices on proposed disciplinary action (7 days), suspension notices, disciplinary findings and decision letters. Council and university discipline letters that use the same wording (show cause, allegation, particulars, disciplinary finding) are also caught. Overlaps global-top500-063-disciplinary-records (generic, being rebuilt separately); this classifier is the Qld-anchored, populated-record version.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Public Sector Act 2022 (Qld), Discipline Directive 05/23 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Recruitment and selection records under the Recruitment and Selection Directive 07/23 (Public Sector Act 2022 (Qld) ss 46 and 222): selection panel reports, comparative and merit assessments documenting why the proposed successful applicant is "best suited", candidate scoring and ranking sheets, referee checks and panel recommendations for a named candidate and position. Council and university selection reports with the same structure are also caught. Overlaps global-top500-074-interview-evaluation-notes (generic phrase classifier being rebuilt separately).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Public Sector Act 2022 (Qld), Recruitment and Selection Directive 07/23 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
QCAT applications and orders appointing or reviewing guardians and administrators for adults with impaired decision-making capacity (Form 10), interim orders and supporting health-professional reports.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Guardianship and Administration Act 2000 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Unredacted working copies of Queensland referable dam emergency action plans (EAPs) under the Water Supply (Safety and Reliability) Act 2008 s 352H, and failure impact assessments, that contain the warning and notification lists (named individuals with mobile numbers, in order of priority) or property-level population at risk (PAR) detail (street addresses with occupant or PAR counts). Approved EAPs are published by design on the s 352M register with individuals' names, addresses and contact details removed, so the published plan is not the target; the personal detail stripped from it is.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Water Supply (Safety and Reliability) Act 2008 (Qld)
- Frameworks
- QGISCF
Queensland council animal management enforcement records under the Animal Management (Cats and Dogs) Act 2008. Covers proposed declaration notices (s 90: breed, colour, sex, distinguishing marks, reasons, written representations within at least 14 days), regulated dog declarations (s 89 and s 94: declared dangerous or declared menacing dog), information notices (s 95), destruction orders (s 127A) and dog attack investigation or complaint records (attack offences ss 194-195). These records name the owner, the dog, the address and, for attacks, the victim and their injuries. The state regulated dog register may be inspected only by officers, owners and similar persons (s 173). The council dog registry is open to inspection, but owner information is excluded (s 179(2)), so a registry extract without owner details is not matched at enforce tiers. Restricted dog provisions survive only as transitional permits after the 2024 amendments (Act No. 17 of 2024), which introduced prohibited dogs (s 127).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Animal Management (Cats and Dogs) Act 2008 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Completed notifications and reports under the Queensland Reportable Conduct Scheme in the Child Safe Organisations Act 2024 (Qld), which commenced on 1 July 2026 and is regulated by the Queensland Family and Child Commission (QFCC). The head of an entity must give QFCC an initial notification within 3 business days of becoming aware of a reportable allegation or conviction, an interim report within 30 business days and a final report with the investigation findings. A populated record names the worker (name, date of birth, role, Blue Card or exemption notice number), the child, the head of entity or delegate, the type of reportable conduct (child sexual offence, sexual misconduct, ill-treatment, significant neglect, physical violence, or behaviour causing significant emotional or psychological harm), dates, and risk-management steps. The scheme page, the QFCC guideline, the Act and blank forms are decoys. Reportable conduct records from other states' schemes (NSW, Vic, ACT) that use the same labels can also reach 75; the Queensland-specific corroborative terms mostly lift only Queensland records to 85.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Child Safe Organisations Act 2024 (Qld)
- Frameworks
- QGISCF
Positive behaviour support plans, restrictive practice approvals and authorisations for a named adult with disability: containment, seclusion, chemical, mechanical and physical restraint and restricted access to objects; short-term approvals by the Office of the Public Guardian and QCAT approvals under the Disability Services Act 2006 Part 6.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Disability Services Act 2006 (Qld), NDIS (Restrictive Practices and Behaviour Support) Rules 2018 (Cth)
- Frameworks
- QGISCF
Case records for access applications under the Right to Information Act 2009 (Qld): the s 24 access application (including the combined Right to Information and Information Privacy Access Application form), s 37 consultation with a relevant third party, and the s 54 decision notice giving reasons, with refusal grounds under s 47(3) - exempt information (s 48, schedule 3) and contrary to public interest information (s 49, schedule 4) - plus internal review (s 80) and external review by the Information Commissioner (s 85). A populated record carries the applicant's name, the application reference, dates received/decided, the documents sought, page counts, third parties consulted, the decision maker and the outcome. Published disclosure logs (s 78A) are public and treated as decoys, as are the Act, OIC/RTI guidance and blank forms. Overlaps with au-foi-exemption-references, which matches Commonwealth FOI Act exemption section references (ss 33-47) and does not cover Queensland schedule 3/4 grounds. India's Right to Information Act 2005 applications are excluded.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Right to Information Act 2009 (Qld)
- Frameworks
- QGISCF
Detects Queensland school incident and student behaviour records for a named student - school/student incident reports, behaviour incident records, behaviour support plans and disciplinary absence (suspension/exclusion) records - when the phrase sits with populated student identifiers and incident fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), Education (General Provisions) Act 2006 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Principal decision notices and records to suspend, exclude or cancel the enrolment of a named student at a Queensland state school under the Education (General Provisions) Act 2006 (ss281-283 suspension, charge-related suspension, exclusion, s316 cancellation of enrolment), including the grounds, behaviour and student details.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Education (General Provisions) Act 2006 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Records that identify a silent elector: completed AEC silent elector registrations (form ER022ESw_QLD, used for Queensland enrolment under the joint roll arrangement), silent elector registers, roll entries flagged silent, silent enrolment confirmations and special postal voter register entries for silent electors. A silent elector is a person whose address the Electoral Commission of Queensland has kept off the public roll because showing it would put the personal safety of the person or their family at risk (Electoral Act 1992 s 58(5) and sch 1; Commonwealth Electoral Act 1918 s 104, backed by a statutory declaration). Silent electors are automatically special postal voters (s 114(2)(b)), and council voters rolls must omit their address (LGEA s 19(2)). Nomination form guidance, fact sheets, AEC guidance, blank forms, legislation and news are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Electoral Act 1992 (Qld), Local Government Electoral Act 2011 (Qld), Commonwealth Electoral Act 1918 (Cth), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- QGISCF
Applications for social housing and supporting records for a named household: Application for Social Housing, additional applicants, medical report (PH068), support statement (PH076), change of tenancy request (PH058), changes to household (PH127), transfer and mutual exchange applications, and Housing Service Centre assessments of housing need.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Housing Act 2003 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Detects special education and special needs learning plans for a named student - personalised learning plans, individual curriculum/education/support plans, Education Adjustment Program profiles and student support plans with disability, adjustment and goal details - when the plan phrase sits with populated student identifiers and plan fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), Education (General Provisions) Act 2006 (Qld), Disability Standards for Education 2005 (Cth)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Security plans and safety and security management systems for security sensitive ammonium nitrate (SSAN) and other explosives held under a prescribed authority in Queensland (Explosives Regulation 2017 (Qld) s 8A, ss 46A-46D, Schedule 3): identified security risks, access detection, chain of possession, authorised receivers, the list of persons allowed unsupervised access, magazine and store identifiers, and reviews after a change in the national counter terrorism alert level or a loss of explosives.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Explosives Act 1999 (Qld), Explosives Regulation 2017 (Qld)
- Frameworks
- QGISCF
Detects completed Queensland student enrolment forms and applications - student, school or prep enrolment forms, applications for enrolment and SEF-1 records with child and family details - when the phrase sits with populated student identifiers and enrolment fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), Education (General Provisions) Act 2006 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Trade waste and seepage water approvals issued by a Queensland sewerage service provider (council or water utility) under Water Supply (Safety and Reliability) Act 2008 (Qld) ch 2 pt 6 (s 180 approvals, s 181 conditions such as maximum daily quantity and limits for suspended solids and biochemical oxygen demand, ss 182-184 suspension and cancellation, s 185 amendment), and the compliance records that follow them: sampling results against discharge limits, grease arrestor and pre-treatment inspections, and breach or non-compliance notices. The records carry the approval holder's business, premises, approval number, process chemistry and non-compliance history. Published trade waste guidance, acceptance criteria tables, fact sheets and blank application forms are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Water Supply (Safety and Reliability) Act 2008 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Identifies Queensland vehicle registration application, transfer, renewal, and certificate forms. Queensland form topics are discovery-only; enforcement requires multiple registration-record fields, while high confidence also requires an official F3518/F3520 form number and a populated VIN, registration-number, or plate-number field.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Completed applications for financial assistance under the Victims of Crime Assistance Act 2009 (Qld) ss 51-52, made on the Victim Assist Queensland "Financial Assistance Application Form: Primary victim" (Form 1, Version 5, effective 14 September 2023) or recorded in Victim Assist case files: the primary victim's name and date of birth, the act of violence (what happened, key dates, offender name), police report details (reference number, station, investigating officer) or special primary victim report details (for example a domestic violence worker), injuries, recognition payment (special assistance) and recovery expense claims, and safe contact arrangements. Acts of violence include domestic and family violence, sexual offences and child abuse. The blank form, qld.gov.au application guidance and media coverage are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Victims of Crime Assistance Act 2009 (Qld), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- QGISCF
Water and sewerage customer account records held by Queensland councils and water service providers about financial hardship, payment plans and restriction of supply for non-payment. Water Supply (Safety and Reliability) Act 2008 s 169 lets a service provider reduce the domestic water supply of an owner or occupier who does not pay after notice "to the minimum level necessary for the health and sanitation purposes", but not shut it off completely. In South East Queensland the Customer Water and Wastewater Code (made under the South-East Queensland Water (Distribution and Retail Restructuring) Act 2009) covers financial hardship, including Centrepay, and when supply can be restricted for non-payment; Urban Utilities' Residential Customer Charter describes payment plans and a Financial Hardship Policy. Records combine an account holder, water account or customer number, property or service address, arrears and the hardship, payment plan or flow-restriction action. Published charters, hardship policies, the Code and drought restriction notices are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Water Supply (Safety and Reliability) Act 2008 (Qld), South-East Queensland Water (Distribution and Retail Restructuring) Act 2009 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Register entries and customer records kept by Queensland water service providers and councils for "special needs" customers and properties whose occupants need a continued, uninterrupted and unrestricted water supply for life support or other medical needs, most often home haemodialysis. The basis is customer-charter and code practice, not a statutory register: the Water Supply (Safety and Reliability) Act 2008 contains no special-needs or dialysis provision; the SEQ Customer Water and Wastewater Code covers "customers and tenants with special needs for an uninterrupted supply of water" (clause wording not retrieved); and the Urban Utilities Residential Customer Charter defines a special needs residential property as one where an occupant needs such supply as confirmed by a registered medical specialist, treating hospital or dialysis centre, and commits to at least four business days' notice of planned interruptions to those properties. Modelled on au-energy-life-support-register. Charters, glossaries and eligibility pages are decoys.
- Type
- regex
- Confidence
- low
- Jurisdictions
- au
- Regulations
- South-East Queensland Water (Distribution and Retail Restructuring) Act 2009 (Qld), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- QGISCF
Workers' compensation claim records for an identified worker under the Workers' Compensation and Rehabilitation Act 2003 (Qld): the application for compensation, work capacity certificates (WorkCover / WorkSafe Form 132M, and the Comcare certificate of capacity equivalent), rehabilitation and return to work plans and suitable duties plans (WCRA ss 220, 226, 228), and claim decisions. Claim records combine health information (injury, diagnosis, capacity, restrictions, treating practitioner) with a claim, and WCRA s 572A prohibits obtaining or using such documents for employment purposes such as pre-employment checks. The WorkCover claim number format is not public, so it is matched only by its label.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Workers' Compensation and Rehabilitation Act 2003 (Qld), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- QGISCF
Youth justice orders and detention records for a named young person under the Youth Justice Act 1992: detention and conditional release orders, restorative justice orders and agreements, and youth detention centre records (Brisbane Youth Detention Centre, Cleveland Youth Detention Centre, Wacol Youth Remand Facility).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Youth Justice Act 1992 (Qld)
- Frameworks
- QGISCF
QTAC Educational Access Scheme applications and personal statements for a named applicant: disadvantage categories (personal illness or disability, English language difficulty, home environment and responsibilities, school environment, financial hardship) with supporting evidence.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Detects South Australian driver licence and learner permit numbers in the established one-letter-plus-five-or-six- digit shape. Enforceable tiers require an explicit licence-number label and South Australian context; the strict tier additionally requires Service SA or Department for Infrastructure and Transport authority evidence.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au-sa
- Regulations
- Motor Vehicles Act 1959 (SA), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Identifies SOCI Act, critical infrastructure resilience and AESCSF compliance or maturity assessments that record an entity's own results. Assessment titles alone are discovery-only; enforcement requires AESCSF practice IDs, maturity indicator levels or security profiles, or populated compliance status rows. CIRMP records and reports are handled by au-soci-risk-management-program-record.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- AESCSF, QGISCF
Completed regulatory cyber incident reports made to the Australian Signals Directorate: mandatory cyber security incident reports under the Security of Critical Infrastructure Act 2018 (s 30BC critical incidents, 12 hours, written record within 84 hours of an oral report; s 30BD other incidents, 72 hours, written record within 48 hours), content entered in the ASD/ACSC "Report a cyber security incident" form (organisation, ABN, contact number, date and time the incident was identified, whether it is ongoing, incident type, Home Affairs consent), and ransomware payment reports under s 27 of the Cyber Security Act 2024. Distinct from global-security-incident-report and the OT cyber incident report classifiers, which cover internal incident and forensic reports; this one requires the regulatory reporting frame plus populated ASD form fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth), Cyber Security Act 2024 (Cth), Ransomware Payment Reporting Rules 2025 (Cyber Security Act 2024)
- Frameworks
- PSPF, QGISCF
Documents that are "relevant information" under s 5A of the Security of Critical Infrastructure Act 2018 (Cth): a critical infrastructure risk management program (CIRMP, s 30AC) and the annual CIRMP report (s 30AG: up-to-date statement for a financial year, board or governing body approval, hazards with a significant relevant impact; LIN 23/006 and LIN 26/075 terms), Register of Critical Infrastructure Assets submissions (s 6 interest and control information, s 7 operational information), and Systems of National Significance enhanced cyber security obligation documents (incident response plan s 30CD, cyber security exercise evaluation reports s 30CQ / 30CR, vulnerability assessment report s 30CZ, system information reporting notices s 30DB / 30DC). There is no statutory marking for this material, so the classifier does not anchor on "PROTECTED" or any other label.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth), Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023, Enhanced Critical Infrastructure Risk Management Program Rules 2026 (LIN 26/075)
- Frameworks
- PSPF, QGISCF
Specialist Homelessness Services (SHS) client records and SHS collection extracts for named or linkable clients: homelessness status, reasons for seeking assistance, services provided and the statistical linkage key (SLK-581) built from name, date of birth and sex.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Identifies Australian physical addresses using structural street-number + street-name regex combined with road-type, state/territory, and postcode corroborative evidence. Covers the implemented road-type endings: the standard abbreviated set plus the declared extended endings (Rise, View, Gardens, Loop, Trail, Track, Pass, Heights) — not the full GNAF classification list.
- Type
- regex
- Confidence
- low
- Detection quality
- Mixed
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects Australian Superannuation Fund Number (RSE) patterns. An R prefix followed by 7 digits, registered with APRA.
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects Tasmanian driver licence numbers in the established seven-digit or one-letter-plus-five-or-six-digit shapes. Enforceable tiers require an explicit licence-number label and Tasmanian context; the strict tier additionally requires Transport Services, Service Tasmania, or Department of State Growth authority evidence.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au-tas
- Regulations
- Personal Information Protection Act 2004 (Tas), Privacy Act 1988 (Cth), Vehicle and Traffic Act 1999 (Tas)
- Frameworks
- ISO 27001
Detects Australian tax invoices containing GST, ABN, and payment details as required by ATO regulations.
- Type
- keyword_list
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Identifies Australian Tax File Numbers (TFNs) — unique nine-digit identifiers issued by the Australian Taxation Office. Uses an inline mod-11 Checksum validator with AllDigitsSameFilter and TextMatchFilter to exclude known test values.
- Type
- regex
- Confidence
- high
- Detection quality
- Mixed
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Telecommunications provider account records that identify a customer or end-user as an "affected person" under the Telecommunications (Domestic, Family and Sexual Violence Consumer Protections) Industry Standard 2025 (F2025L00664). Covers the agreed communication method recorded under s 10, the privacy, safety and security protections put on the account under ss 11-12 (PIN or password, verification code to a safe number or email, a new account not linked to the perpetrator), holds on and urgent reversal of a service limiting action under s 13, non-disclosure instructions under ss 25 and 27, privacy breach notifications to the affected person and the ACMA under s 29, and the record of the type of evidence sought, provided and sighted under ss 14 and 30-31. Most of the Standard commenced on 1 January 2026 (1 April 2026 for small providers); some provisions commenced on 1 July 2025. This is the telco counterpart of au-energy-family-violence-customer-record, with telco account structure (account or customer number, service or mobile number, MSISDN).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Telecommunications (Domestic, Family and Sexual Violence Consumer Protections) Industry Standard 2025 (Cth), Telecommunications Act 1997 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Integrated Public Number Database (IPND) data exchanged between carriage service providers, Data Providers, Data Users and the IPND Manager (Telstra): fixed-width upload and download files (HDR header record with an IPND file type, 905-character customer records, TRL trailer record), IPND file names (IPNDUP upload, IPNDES/LA/DI/LD/RS/EW download) and IPND extracts or reject reports listing public numbers with their List Code. List Code UL (Unlisted Number) and SA (Suppressed Address) records are protected by Telecommunications Act 1997 Part 13 (s 276 disclosure offence; s 285 permitted IPND uses exclude unlisted numbers). "Silent number" is an informal synonym for an unlisted number, not IPND terminology, and is used only as weak corroboration.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Telecommunications Act 1997 (Cth), IPND Industry Code C555:2020, Privacy Act 1988 (Cth)
- Frameworks
- PSPF, ISO 27001
Records that carriers and carriage service providers must make of disclosures of protected information (Telecommunications Act 1997 (Cth) Part 13, s 276 primary offence) to law enforcement and enforcement agencies: the s 306 record (made within 5 days of the disclosure and kept for 3 years) and the s 306A record for prospective authorisations. A populated record gives the name of the person who disclosed the information, the date of disclosure, the grounds (for example s 280 authorised by law, s 313 assistance), warrant or authorisation details including authorisations under ss 178, 179 or 180 of the Telecommunications (Interception and Access) Act 1979, the authorising officer and date, the requesting agency and request date, the service disclosed and the s 187AA data-set items. The same fields appear in agency authorisation / request notices received by the provider. OAIC guidance, the Acts, ACMA and TIA Act annual report statistics and blank templates are decoys. Overlaps with lawful-interception-warrant, which covers interception and stored communications warrants (TIA Act secrecy) rather than Part 13 disclosure records; a record that cites the TIA Act next to a service number may also fire that classifier.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Telecommunications Act 1997 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth)
- Frameworks
- PSPF, QGISCF
Academic misconduct and academic integrity case records for a named student: allegations and findings of plagiarism, collusion, contract cheating, fabrication or recycling, notices of allegation, hearings, penalties and appeals (TEQSA Threshold Standard 5.2).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Tertiary Education Quality and Standards Agency Act 2011 (Cth), Privacy Act 1988 (Cth)
- Frameworks
- QGISCF
Academic progression records for a named student: unsatisfactory academic progress notices, show cause applications (often with personal, medical or family circumstances), notices of intention to exclude, exclusion outcomes and progression improvement plans.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Tertiary student disability access and adjustment plans for a named student: condition or diagnosis and the academic adjustments granted. Plan names vary by institution (UQ Student Access Plan, QUT Access Equity Plan, UniSC and Bond Learning Access Plan, CQU Accessibility Plan, UniSQ Learning Support Plan, JCU AccessAbility Services Access Plan).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Disability Standards for Education 2005 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Applications for special consideration, assessment extensions, deferred or supplementary examinations for a named student, usually with medical, bereavement or personal-circumstance evidence.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Completed ATO Tax file number declaration (NAT 3092) and Superannuation standard choice form (NAT 13080) held by an employer: the form title or number together with populated fields such as a checksum-valid TFN, the payee's name or date of birth, the employee identification number, ticked residency or tax-free threshold answers, and the chosen fund's ABN, unique superannuation identifier (USI) or member number.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Taxation Administration Act 1953 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701, QGISCF
Identifies personal names preceded by salutations (Mr, Mrs, Ms, Dr, Prof, etc.) in Australian documents. Uses structural regex for honorific + capitalised name components with corroborative evidence from the consolidated Australian forename and surname dictionaries.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), NDB Scheme (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to legal full name in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Identifies documents containing references to social security number in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- low
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to taxpayer identification number in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- low
- Detection quality
- Topic partial
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Identifies documents containing references to lawful intercept transcripts in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Identifies documents containing references to scada network diagrams in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Content of an aviation industry participant's Transport Security Program (TSP, Aviation Transport Security Act 2004 s 16; disclosing TSP content without the participant's consent is an offence under Aviation Transport Security Regulations 2005 reg 2.06) and of maritime security plans, ship security plans and offshore security plans (Maritime Transport and Offshore Facilities Security Regulations 2003 regs 3.12, 4.115 and 5A.105 require them to be protected against unauthorised access, amendment and disclosure). Enforcement needs populated plan structure: named port / company / ship / offshore security officers (PSO, CSO, SSO), 24-hour security contact numbers, restricted and cleared zone or screening point tables, and executed Declarations of Security. Australian law has no "Security Sensitive Information" marking; US TSA Sensitive Security Information (49 CFR 1520) material is an explicit exclusion.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Aviation Transport Security Act 2004 (Cth), Aviation Transport Security Regulations 2005 (Cth), Maritime Transport and Offshore Facilities Security Act 2003 (Cth), Maritime Transport and Offshore Facilities Security Regulations 2003 (Cth)
- Frameworks
- PSPF, QGISCF
Identifies candidate Australian passport numbers using a broad one- or two-letter prefix followed by seven digits. The regex does not validate an issued passport series; Australian travel-document and issuing-nation evidence are required for enforcement.
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Detects Unique Student Identifier (USI) patterns. A 10-character alphanumeric code (uppercase letters and digits) mandatory since January 2023 for higher education in Australia. The Purview design inventories the broad bare shape at 65, enforces a labelled value in education context at 75, and reserves 85 for labelled values with authoritative USI/VET record context.
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- au
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Detects populated vet competency assessment and rpl evidence using record context and corroborating fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- National Vocational Education and Training Regulator Act 2011 (Cth), Student Identifiers Act 2014 (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects Victorian driver licence and learner permit numbers in the established eight-to-ten-digit shape. Enforceable tiers require an explicit licence-number label and Victorian context; the strict tier additionally requires VicRoads authority evidence.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au-vic
- Regulations
- Privacy Act 1988 (Cth), Privacy and Data Protection Act 2014 (Vic), Road Safety Act 1986 (Vic)
- Frameworks
- ISO 27001
Detects Western Australian driver licence numbers in the established seven-digit shape. Enforceable tiers require an explicit driver-licence-number label and WA context; the strict tier additionally requires WA transport or Driver and Vehicle Services authority evidence.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au-wa
- Regulations
- Privacy Act 1988 (Cth), Road Traffic (Authorisation to Drive) Act 2008 (WA)
- Frameworks
- ISO 27001
Identifies drinking-water and effluent quality monitoring records: laboratory or field results with measured parameters and units, and sample/site records. Water quality wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Water Supply (Safety and Reliability) Act 2008 (Qld)
- Frameworks
- ISO 27001
Statutory worker health monitoring records under the Work Health and Safety Regulation 2011 (Qld) and the model WHS Regulations: health monitoring reports for hazardous chemicals listed in Schedule 14 (including crystalline silica, isocyanates, cadmium and arsenic; ss 368, 374-378), lead (ss 406-418, blood lead levels) and asbestos (ss 435-444), audiometric testing for noise (s 58), plus pre-employment medicals and fitness-for-work / periodic medical assessments. The Regulation requires these reports to name the worker and date of birth, the registered medical practitioner and registration number, test results, disease advice, remedial recommendations and counselling needs, and to be kept as confidential records (30 years for hazardous chemicals and lead, 40 years for asbestos) not disclosed without the worker's written consent. Workplace drug and alcohol testing is out of scope (see au-drug-alcohol-test-result).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Work Health and Safety Regulation 2011 (Qld), Work Health and Safety Act 2011 (Qld), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- QGISCF
Outcome records of worker screening and background checks about an identified person: the AusCheck Critical Infrastructure Background Check Outcome (CIBCO) used for SOCI critical workers under the CIRMP Rules (LIN 23/006 s 9; enhanced requirements LIN 26/075 s 9A), with findings such as Unfavourable Criminal History, CIRMP security-relevant offence, meets / does not meet statutory criteria, Adverse or Qualified Security Assessment; NDIS / Queensland disability worker screening clearance, exclusion, interim bar or negative notice (Disability Services Act 2006 (Qld)); national police check / criminal history check results; and security clearance outcomes at the PSPF Policy 12 levels (Baseline, NV1, NV2, PV). Screening reference, clearance and application numbers have no public format and are matched only by label. Bare reference numbers are covered by au-police-check-reference; clearance mentions without an outcome record by global-security-clearance-reference.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth), Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023 s 9, s 9A, AusCheck Act 2007 (Cth), Disability Services Act 2006 (Qld), Protective Security Policy Framework Policy 12, Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- PSPF, QGISCF
Row-level workforce diversity and equal employment opportunity (EEO) extracts: HRIS or payroll exports prepared for Workplace Gender Equality Agency (WGEA) reporting, Queensland public sector MOHRI workforce data and the workforce diversity census, equity and diversity audits under the Public Sector Act 2022 (Qld) ss 27-29, and internal diversity dashboards' source data. Each row ties an employee identifier to diversity attributes such as Aboriginal and / or Torres Strait Islander status, disability, culturally and linguistically diverse (CALD) or non-English speaking background, language spoken at home, country of birth, gender and, where collected, sexuality. Aggregate reports, published workforce statistics and survey questionnaires are out of scope.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au, au-qld
- Regulations
- Privacy Act 1988 (Cth), Workplace Gender Equality Act 2012 (Cth), Public Sector Act 2022 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701, QGISCF
Complaints, reports and case records about sexual harassment, sex-based harassment, workplace bullying and psychosocial hazards that name the people involved: complainant and respondent details, incident date, location and alleged conduct, interim measures, investigation and outcome. Anchored on the Sex Discrimination Act 1984 (Cth) s 47C positive duty, the Work Health and Safety Regulation 2011 (Qld) psychosocial risk provisions (Part 3.2 Division 11) and the Managing the risk of psychosocial hazards at work Code of Practice 2022 (Qld). Overlaps global-top500-064-employee-grievance-reports and global-top500-079-workplace-investigation-files (generic phrase classifiers); this one requires populated party and incident fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Sex Discrimination Act 1984 (Cth), Work Health and Safety Regulation 2011 (Qld), Managing the risk of psychosocial hazards at work Code of Practice 2022 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Detects Working With Children Check (WWCC) clearance numbers across Australian states. Covers the NSW structural format (WWC + 7 digits + check letter, e.g. WWC1234567E) and the labelled VIC / WA / generic forms where a WWCC or working-with-children phrase precedes a card or clearance number. The Queensland Blue Card is handled by a separate classifier.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Child Protection (Working with Children) Act 2012 (NSW), NDB Scheme (Cth), Privacy Act 1988 (Cth), Working with Children Act 2005 (Vic)
- Frameworks
- ISO 27001, ISO 27701
Detects Azure App Service deployment passwords in configuration files and publish profiles. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Partial
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Batch account shared access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Mixed
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Bot Framework secret key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Bot Service application secret patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Cognitive Search (AI Search) API key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Cognitive Services subscription key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Container Registry (ACR) access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Cosmos DB account access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Databricks personal access token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure DevOps application secret patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure DevOps personal access token (PAT) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- low
- Detection quality
- Mixed
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure DocumentDB (now Cosmos DB) authentication key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Microsoft Entra (formerly Azure AD) client access token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Microsoft Entra (formerly Azure AD) client secret patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Microsoft Entra (formerly Azure AD) user credential patterns including username/password combinations targeting Microsoft login endpoints. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Event Grid access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Functions master key and API key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure IaaS database and Azure SQL connection string patterns containing credentials. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure IoT Hub connection string patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure IoT Hub shared access key patterns outside of connection strings. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Mixed
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Logic App shared access signature (SAS) URL patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Machine Learning web service API key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Maps subscription key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure publish settings file password patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Partial
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Cache for Redis connection string password patterns extracted from connection strings. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Cache for Redis connection string patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Shared Access Signature (SAS) token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Partial
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Service Bus connection string patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Service Bus Shared Access Signature (SAS) token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Partial
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure shared access key and webhook token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure SignalR Service access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure SQL Database connection string patterns specifically targeting the .database.windows.net domain. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Storage account access key patterns in connection strings. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects generic Azure Storage account key patterns including keys assigned to variables or configuration properties. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Storage account key patterns outside of full connection strings. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- low
- Detection quality
- Mixed
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Storage Account Shared Access Signature (SAS) patterns for high-risk resources with write or delete permissions. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Partial
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Storage Account Shared Access Signature (SAS) patterns for standard resources. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Partial
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure subscription management certificate patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Partial
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects bail condition documents including bail undertakings, surety arrangements, and conditions imposed on accused persons under the Bail Act 1980 (Qld). These documents contain personal details of accused persons, reporting obligations, curfew details, exclusion zones, and no-contact conditions.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Bail Act 1980 (Qld), Police Powers and Responsibilities Act 2000 (Qld)
- Frameworks
- QGISCF
Detects government bank account details (BSB + account number) combined with payment authorisation credentials, approval tokens, or signing authorities that together enable the initiation of payments.
- Type
- regex
- Confidence
- medium
- Detection quality
- Error
- Jurisdictions
- au
- Regulations
- Financial Accountability Act 2009 (Qld)
- Frameworks
- QGISCF
Detects Belgium driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- be, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Rijksregisternummer patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, be
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Belgium passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- be, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Belgium Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- be, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Belgium Value Added Tax Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. VAT numbers have country-specific prefixes that aid detection accuracy.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- be, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Bulgaria driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- bg, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Bulgaria passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- bg, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Bulgaria Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- bg, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Единен граждански номер (ЕГН) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, bg
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Brazilian driver licence numbers (CNH - Carteira Nacional de Habilitação). The CNH register number is 11 digits. Structural detection alone is ambiguous with CPF length, so corroborative CNH keywords are required for reliable use.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- br
- Regulations
- LGPD, CTB (Brazil)
- Frameworks
- ISO 27001, ISO 27701
Detects CNPJ patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- br
- Regulations
- LGPD
- Frameworks
- ISO 27001, ISO 27701
Detects CPF patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- br
- Regulations
- LGPD
- Frameworks
- ISO 27001, ISO 27701
Detects Registro Geral patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- br
- Regulations
- LGPD
- Frameworks
- ISO 27001, ISO 27701
Detects Brazil Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- br
- Regulations
- LGPD
- Frameworks
- ISO 27001, ISO 27701
Detects Brazilian PIX keys in email, +55 mobile, or EVP UUID forms.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- br
- Regulations
- LGPD, BCB PIX regulations
- Frameworks
- ISO 27001, ISO 27701
Detects Canada Bank Account Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Financial account numbers require corroborative evidence for reliable detection due to their generic numeric format.
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- ca
- Regulations
- Law 25 (QC), PIPEDA
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects Canada Revenue Agency (CRA) Business Numbers (BN). The core BN is nine digits assigned to a business. Program accounts append a two-letter program identifier (RC, RM, RP, or RT) and a four-digit reference, for example 123456789RC0001 for a corporate income-tax account.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- ca
- Regulations
- PIPEDA, Law 25 (QC), Excise Tax Act (Canada)
- Frameworks
- ISO 27001, ISO 27701
Detects Canada driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ca
- Regulations
- Law 25 (QC), PIPEDA
- Frameworks
- ISO 27001, ISO 27701
Detects Canada Health Service Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the generic numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ca
- Regulations
- FIPPA, Law 25 (QC), PHIPA (Ontario), PIPEDA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Government of Canada protective markings under the Treasury Board Standard on Security Categorization (Appendix J of the Directive on Security Management): the Canada-distinctive "Protected" designations Protected A / Protected B / Protected C (information whose compromise could injure interests outside the national interest), and the classified levels Confidential / Secret / Top Secret (injury to the national interest). "Protected A/B/C" is unique to Canada and matched at high confidence in both title-case and ALL-CAPS renderings; the classified words are shared vocabulary with other nations and are matched only at lower, Canada-government-context-gated tiers. Rendering verified directly against the Treasury Board Standard on Security Categorization; matched case-sensitively.
- Type
- regex
- Confidence
- high
- Jurisdictions
- ca
- Regulations
- Directive on Security Management (Canada)
- Frameworks
- Policy on Government Security
Detects Ontario Health Insurance Plan (OHIP) numbers: 10 digits often grouped 4-3-3 with a two-letter version code.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- ca
- Regulations
- PIPEDA, PHIPA (Ontario)
- Frameworks
- ISO 27001, ISO 27701
Detects Canada passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ca
- Regulations
- Law 25 (QC), PIPEDA
- Frameworks
- ISO 27001, ISO 27701
Detects Canada Personal Health Identification Number (PHIN) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the generic numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ca
- Regulations
- FIPPA, Law 25 (QC), PHIA (Manitoba), PIPEDA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects North American Numbering Plan (NANP) telephone numbers in Canadian contexts: the domestic NPA-NXX-XXXX form (bracketed, hyphenated, dotted, spaced, or bare, with an optional leading trunk "1") and the international +1 NPA-NXX-XXXX form. Area-code (NPA) and exchange-code (NXX) groups are constrained to a leading digit of 2-9 with the N11 service-code shape (211/311/411/511/611/711/811/911) excluded from both groups, per NANPA's published format rules. This pattern is structurally identical to us-phone-number because NANP area codes are drawn from a single pool shared by the US, Canada, and Caribbean member territories — the digit sequence itself cannot distinguish a Canadian number from a US one. This is the sibling of us-phone-number; the two are differentiated by jurisdiction/regulation metadata and country-specific corroborative evidence keywords only, not by regex — see us-phone-number's description for the documented family convention.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- ca
- Regulations
- PIPEDA, Law 25 (QC), Unsolicited Telecommunications Rules (CRTC)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Canada Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- ca
- Regulations
- PIPEDA
- Frameworks
- ISO 27001, ISO 27701
Detects SIN patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Mixed
- Jurisdictions
- ca
- Regulations
- Law 25 (QC), PIPEDA
- Frameworks
- ISO 27001, ISO 27701
Detects financial submissions to the QLD Cabinet Budget Review Committee (CBRC) containing agency funding bids, savings proposals, capital expenditure requests, and fiscal strategy options.
- Type
- document_marker
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Criminal Code Act 1899 (Qld), Right to Information Act 2009 (Qld)
- Frameworks
- QGISCF
Detects legal annexures to Cabinet submissions containing privileged legal analysis supporting Cabinet decision-making. These documents carry dual protection: Cabinet confidentiality (Westminster convention) and legal professional privilege. Disclosure breaches both simultaneously with no remediation possible.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Crime and Corruption Act 2001 (Qld), Criminal Code Act 1899 (Qld), Evidence Act 1977 (Qld), Right to Information Act 2009 (Qld)
- Frameworks
- QGISCF
Detects draft monetary policy decisions and pre-announcement rate recommendations: a rate value (percentage, basis points or per cent) near a central bank / Reserve Bank reference and a recommendation line proposing a rate action. Published RBA statements, media commentary and forecasts are excluded.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Reserve Bank Act 1959 (Cth), Corporations Act 2001 (Cth)
- Frameworks
- QGISCF, PSPF
Detects Swiss passport numbers issued by fedpol (Federal Office of Police). Passports of the 2003, 2006 and 2010 series carry an eight-character number consisting of one uppercase letter followed by seven digits (e.g. E1234567); the 2010 series always begins with the letter X. The letters O and I are never used, to avoid confusion with the digits 0 and 1. The 2022 series (the only series issued since October 2022) has no published fixed structure — fedpol deliberately keeps the numbering rules non-public — so 2022-series numbers may not match this shape. Only the documented 2010-and-earlier format is covered.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- ch
- Regulations
- FADP (Switzerland), Identity Documents Act (Switzerland, SR 143.1)
- Frameworks
- ISO 27001, ISO 27701
Detects Switzerland Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- ch
- Regulations
- FADP (Switzerland)
- Frameworks
- ISO 27001, ISO 27701
Detects AHV-Nummer patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- ch
- Regulations
- FADP (Switzerland)
- Frameworks
- ISO 27001, ISO 27701
Detects documents containing child exploitation investigation case files including victim identification data, offender network intelligence, and investigative techniques used against CSAM distribution networks. QPS Task Force Argos is the primary Queensland unit. Disclosure re-victimises children and compromises active rescue operations.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Criminal Code Act 1899 (Qld), Criminal Code Act 1995 (Cth), Police Powers and Responsibilities Act 2000 (Qld)
- Frameworks
- QGISCF
Detects child safety investigation case files containing child identifiers, harm notifications, investigation outcomes, child protection orders, and out-of-home care placements under the Child Protection Act 1999 (Qld). These files contain highly sensitive information about vulnerable children including substantiated abuse details — unauthorised disclosure endangers child safety and compromises ongoing investigations.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Child Protection Act 1999 (Qld), Human Rights Act 2019 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Detects RUT patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- cl
- Regulations
- PDPL (Chile)
- Frameworks
- ISO 27001, ISO 27701
Detects defence strategy documents for class action proceedings against the State or State entities. These documents reveal the State's vulnerability assessment and defence approach for claims potentially affecting thousands of claimants. Note: trainable classifier recommended for production using class action document structural features.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Civil Proceedings Act 2011 (Qld)
- Frameworks
- QGISCF
Detects People's Republic of China passport numbers. The current ordinary (e-)passport uses an 'E' prefix followed by one letter (excluding I and O) and 7 digits, or 'E' plus 8 digits. Older series use a 'G' prefix plus 8 digits, and earlier passports used 'P', 'D' (diplomatic) or 'S' (service) prefixes plus 8 digits. The short, loosely structured format means corroborative keyword proximity is strongly recommended.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- cn
- Regulations
- PIPL (China), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects China Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- cn
- Regulations
- PIPL (China)
- Frameworks
- ISO 27001, ISO 27701
Detects Resident Id patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- cn
- Regulations
- PIPL (China)
- Frameworks
- ISO 27001, ISO 27701
Detects Mainland China Unified Social Credit Codes (统一社会信用代码) assigned to legal persons and other organisations. The code is 18 characters using a restricted alphabet (digits and selected letters excluding I, O, Z, S, V), with an embedded administrative division code in positions 3-8.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- cn
- Regulations
- PIPL (China), Cybersecurity Law (China)
- Frameworks
- ISO 27001, ISO 27701
Detects Cédula de Ciudadanía patterns. Detects this pattern using regex with corroborative keyword evidence.
- Type
- regex
- Confidence
- low
- Detection quality
- Mixed
- Jurisdictions
- co
- Regulations
- PDPL (Colombia)
- Frameworks
- ISO 27001, ISO 27701
Detects Colombia Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Mixed
- Jurisdictions
- co
- Regulations
- Habeas Data Law (Colombia)
- Frameworks
- ISO 27001, ISO 27701
Detects draft legal submissions to Commissions of Inquiry established under the Commissions of Inquiry Act 1950 (Qld). Disclosure prejudices the State's participation and may breach statutory confidentiality.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Commissions of Inquiry Act 1950 (Qld), Right to Information Act 2009 (Qld)
- Frameworks
- QGISCF
Detects community-based corrections orders including probation orders, parole conditions, and community service orders issued under the Corrective Services Act 2006 (Qld). These documents contain offender details, supervision conditions, approved addresses, and compliance assessments by Queensland Corrective Services.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Corrective Services Act 2006 (Qld), Penalties and Sentences Act 1992 (Qld)
- Frameworks
- QGISCF
Detects documents containing the identities of police informants (confidential human sources, confidential / registered informants, registered sources) embedded within criminal organisations. Informant identity is the single most sensitive category of law enforcement information globally. Disclosure has historically resulted in murders and creates immediate lethal risk. Absorbs the former confidential-informant-identities classifier.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Police Powers and Responsibilities Act 2000 (Qld), Police Service Administration Act 1990 (Qld), Right to Information Act 2009 (Qld)
- Frameworks
- QGISCF
Detects financial models for mergers, acquisitions, or divestments containing actual valuations, synergy estimates, deal structures, and price ranges. Disclosure constitutes insider information under securities law.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Corporations Act 2001 (Cth), Criminal Code Act 1899 (Qld)
- Frameworks
- QGISCF
Detects controlled operation authorisations under PPRA 2000 (Qld) Part 5. Controlled operations involve officers in criminal activity under legal authority. Disclosure reveals officers and operational scope.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Crime and Corruption Act 2001 (Qld), Police Powers and Responsibilities Act 2000 (Qld)
- Frameworks
- QGISCF
Detects published coronial findings and recommendations under the Coroners Act 2003 (Qld). Although coronial findings are public documents, they contain sensitive details about the circumstances and cause of death, manner of death, and identity of deceased persons. Government agencies handling these documents should classify them as SENSITIVE Legal due to the distressing nature of the content.
- Type
- keyword_proximity
- Confidence
- low
- Jurisdictions
- au
- Regulations
- Coroners Act 2003 (Qld)
- Frameworks
- QGISCF
Detects draft government submissions to coronial inquests before filing. These submissions address deaths in government settings (custody, hospitals, child safety) and reveal the State's candid position on systemic failures before formal filing.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Coroners Act 2003 (Qld)
- Frameworks
- QGISCF
Detects pre-publication coronial investigation files including evidence, witness statements, and draft findings. Published coronial findings are SENS_Law, not PROT_Law.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Coroners Act 2003 (Qld), Police Powers and Responsibilities Act 2000 (Qld)
- Frameworks
- QGISCF
Detects documents containing prison intelligence reports including gang assessments, inmate risk ratings, informant identities within correctional facilities, and security threat group (STG) analyses. Disclosure endangers correctional staff, informant inmates, and undermines facility security.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Corrective Services Act 2006 (Qld), Police Powers and Responsibilities Act 2000 (Qld)
- Frameworks
- QGISCF
A parameterised template for council customer references: rates assessment and property numbers, rate and water account numbers, development / building / plumbing application numbers, animal registration numbers and infringement notice numbers, when they appear in council correspondence, CRM exports and customer records alongside a named customer. Every council numbers these differently and none of the formats is published, so the public version anchors on the field labels (Assessment No, Property No, Rate Account, Application No, Animal Registration No, Infringement No and close variants) with a loose, placeholder-guarded, digit-bearing value. Each reference type is a separate regex so that a deployment can extend it with the council's real format through the existing identifier types council-property-number, utility-account-number, council-development-application-number, animal-registration-number and infringement-notice-number. The record-specific council classifiers (rates arrears, concessions, animal registration, infringement / SPER, water hardship) remain the higher-confidence detectors; this template catches the long tail of customer correspondence that carries a council reference. Published DA notices, council FAQ pages and blank forms are decoys.
- Type
- regex
- Confidence
- low
- Jurisdictions
- au, au-qld
- Regulations
- Local Government Act 2009 (Qld), Local Government Regulation 2012 (Qld), Animal Management (Cats and Dogs) Act 2008 (Qld), State Penalties Enforcement Act 1999 (Qld), Planning Act 2016 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- QGISCF
Detects documents containing terrorism threat assessments, persons of interest profiles, and counter-terrorism operational capabilities. Disclosure enables counter-surveillance by terrorist subjects and compromises national security monitoring. Includes JCTT (Joint Counter Terrorism Team) and QPS Security and Counter-Terrorism Group documents.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- QGISCF
Detects court filing references from Queensland courts (Magistrates Court, District Court, Supreme Court) containing proceeding numbers, party names, and registry details. Unpublished filings contain personal details of parties, allegations, and evidence that are not yet in the public domain.
- Type
- keyword_proximity
- Confidence
- low
- Jurisdictions
- au
- Regulations
- Criminal Code Act 1899 (Qld), Uniform Civil Procedure Rules 1999 (Qld)
- Frameworks
- QGISCF
Detects documents containing the true identities of undercover law enforcement officers deployed within criminal organisations. These records link assumed identities (legends) to real identities and are among the most life-critical records in law enforcement. Disclosure directly endangers the lives of deployed operatives and destroys years of infiltration work.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Police Powers and Responsibilities Act 2000 (Qld), Police Service Administration Act 1990 (Qld)
- Frameworks
- QGISCF
Detects documents containing intelligence shared between Australian and international law enforcement agencies under formal exchange agreements. Disclosure damages international trust relationships, violates originator control (ORCON) principles, and compromises joint operations.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Mutual Assistance Act 1987 (Cth)
- Frameworks
- QGISCF
Detects privileged legal opinions issued by the Queensland Crown Solicitor or Office of the Crown Solicitor. These documents constitute the highest level of legal professional privilege in Queensland Government and their disclosure permanently waives privilege under Evidence Act 1977 (Qld) s.14.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Evidence Act 1977 (Qld), Right to Information Act 2009 (Qld)
- Frameworks
- QGISCF
Detects Cyprus driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Mixed
- Jurisdictions
- cy, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Δελτίο Ταυτότητας patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, cy
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Cyprus passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- cy, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Cyprus Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- cy, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Cyprus Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- cy, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects cybercrime investigation technical evidence including digital forensics, malware analysis, cryptocurrency tracing, dark web investigations, and covert online personas. Disclosure enables cybercriminals to develop countermeasures.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1899 (Qld), Criminal Code Act 1995 (Cth)
- Frameworks
- QGISCF
Detects Czech driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- cz, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Czech Republic passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- cz, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Rodné číslo patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, cz
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Czech Republic Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- cz, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects German driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- de, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Personalausweis patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, de
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects German passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- de, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects German mobile telephone numbers per the Bundesnetzagentur's (BNetzA) Nummernplan für Mobile Dienste: the (0)15, (0)16, and (0)17 mobile sub-ranges, in both the domestic (leading trunk "0") and international (+49, leading 0 dropped) forms. BNetzA's own published length table shows the national significant number (the digits after the leading 0, including the "1" of "15/16/17") is 10 digits for most 016x/017x allocations and 11 digits for the 015x range and the 1609/176 exceptions — every quantifier below is bounded to this documented 10-11 digit span rather than left open-ended. The 10-11 bound is applied as a single envelope across all three ranges (the regex cannot pin 015x to exactly 11 and non-exception 016x/017x to exactly 10 without per-sub-range length alternation), so a 10-digit 015x or an 11-digit non-exception 016x/017x rendering is accepted — a deliberate, documented over-acceptance kept small by the envelope itself. Beyond the DIN 5008:2020 space-grouped form, two widespread legacy DIN 5008 renderings of the mobile prefix are covered: the slash form "0171/3920045" and the parenthesised form "(0171) 3920045" — both deprecated by the current DIN 5008 (which prescribes plain space grouping) but still common in signatures and letterheads — plus the "+49 (0)171 ..." letterhead form (nonstandard per ITU-T E.123, but ubiquitous). Geographic (Ortsnetz) landline numbers are intentionally out of scope (so the landline renderings "030/12345678" and "(030) 12345678" are likewise not matched): BNetzA states area codes run 2-5 digits and new allocations are capped at 11 significant digits (10 for the Berlin/Hamburg/Frankfurt/Munich two-digit-code exception), but does not publish a verified minimum length for the existing stock of legacy numbers, so a low-end bound would be invented rather than sourced — mirroring in-phone-number's decision to scope out India's similarly under-specified STD/landline numbers.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- de
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Germany Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- de, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Steuer Id patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, de
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Germany Value Added Tax Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. VAT numbers have country-specific prefixes that aid detection accuracy.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- de, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Denmark driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- dk, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Denmark passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- dk, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects CPR-nummer patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, dk
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Denmark Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- dk, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects domestic violence order applications and conditions under the Domestic and Family Violence Protection Act 2012 (Qld). These documents contain details of aggrieved persons, respondent details, allegations of domestic violence, ouster conditions, and protection order terms. Disclosure could endanger the aggrieved person.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Domestic and Family Violence Protection Act 2012 (Qld), Police Powers and Responsibilities Act 2000 (Qld)
- Frameworks
- QGISCF
Detects donor conception records including donor identity information, recipient details, offspring matching, and assisted reproductive technology treatment records under the Status of Children Act 1978 (Qld). These records contain the most sensitive reproductive information — donor identities, recipient medical details, and biological parentage links. Unauthorised disclosure can permanently alter family relationships and breach legal confidentiality protections.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Assisted Reproductive Technology Act 2024 (Qld), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth), Status of Children Act 1978 (Qld)
- Frameworks
- QGISCF
Detects documents containing drug trafficking investigation intelligence including targets, supply chain mapping, precursor chemical tracking, clandestine laboratory intelligence, and cross-border interdiction plans. QPS Drug and Serious Crime Group is the primary unit. Disclosure enables traffickers to destroy evidence, alter supply routes, and eliminate informants.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Drugs Misuse Act 1986 (Qld)
- Frameworks
- QGISCF
Detects Cédula de Identidad patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ec
- Regulations
- LOPDP (EC)
- Frameworks
- ISO 27001, ISO 27701
Detects Estonia driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ee, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Estonia passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ee, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Isikukood patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- eu, ee
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Estonia Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- ee, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects DNI patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, es
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Spain driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- es, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects NIE patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, es
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Spain passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- es, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Spanish national telephone numbers per Spain's closed 9-digit numbering plan (Plan Nacional de Numeración Telefónica, administered under CNMC oversight): mobile numbers (segment N=6 in full, plus N=7 partially opened for mobile use in the 71/72/73/74 sub-ranges by the SETSI Resolución de 12 de marzo de 2010, BOE-A-2010-5251; the first 7-prefixed mobile numbers entered service from late 2010/2011 once the then-regulator CMT assigned the new ranges to operators) and geographic numbers (leading 8 or 9, with the second digit constrained to never be 0 — a constraint that incidentally excludes the 900/901/902/905 toll-free and premium-rate service ranges, whose second digit is 0). Spain has no domestic trunk prefix, so the +34 international form carries the same 9 significant digits as the domestic form, just with the +34 prefix in place of nothing.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- es
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Spain Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- es, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Número de la Seguridad Social patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, es
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Spain Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- es, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects EU declarations of conformity for high-risk AI systems under Article 47 and Annex V of the EU AI Act (Regulation (EU) 2024/1689). By drawing up the declaration the provider assumes responsibility for compliance; pre-signature drafts and the surrounding conformity-assessment correspondence reveal the provider's compliance posture, notified-body findings, and certificate details before market placement.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- eu
- Regulations
- Regulation (EU) 2024/1689 (AI Act)
- Frameworks
- ISO/IEC 42001, ISO 27001
Detects deployer-side fundamental rights impact assessments (FRIA) under Article 27 of the EU AI Act (Regulation (EU) 2024/1689). A FRIA is performed before deploying certain high-risk AI systems by public bodies, private providers of public services, and deployers of credit-scoring and life/health-insurance pricing systems (Annex III points 5(b) and (c)). Completed FRIAs contain candid assessments of risks of harm to specific categories of natural persons and are sensitive before notification and remediation.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- eu
- Regulations
- Regulation (EU) 2024/1689 (AI Act)
- Frameworks
- ISO/IEC 42001, ISO 27001
Detects general-purpose AI (GPAI) model provider documentation under Article 53 of the EU AI Act (Regulation (EU) 2024/1689): Annex XI technical documentation for the AI Office, Annex XII information packs for downstream providers, the Article 53(1)(d) public summary of training content, and Article 55 systemic-risk evaluation material (adversarial testing / red-teaming reports). Pre-publication drafts reveal model internals, training-data provenance, compute and energy figures, and systemic-risk findings.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- eu
- Regulations
- Regulation (EU) 2024/1689 (AI Act)
- Frameworks
- ISO/IEC 42001, ISO 27001
Detects Article 11 / Annex IV technical documentation for high-risk AI systems under the EU AI Act (Regulation (EU) 2024/1689). This documentation must demonstrate compliance of the high-risk AI system before placing on the market and contains commercially sensitive material — system architecture, design specifications, training-data datasheets, risk management findings, and known limitations — whose uncontrolled disclosure exposes trade secrets and the provider's compliance posture.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- eu
- Regulations
- Regulation (EU) 2024/1689 (AI Act)
- Frameworks
- ISO/IEC 42001, ISO 27001
Detects European debit and credit card numbers for Visa, Mastercard, and American Express networks. The pattern matches 13- to 16-digit card numbers based on the leading digits assigned to each network by the ISO/IEC 7812 standard. This is commonly used for PCI-DSS compliance scanning across EU-regulated financial data.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects DORA Article 6 ICT risk management framework documentation and the digital operational resilience strategy of financial entities — board-approved framework documents, risk tolerance statements, and internal audit reviews of the framework. These documents describe the entity's defensive architecture, control gaps, and risk appetite; disclosure hands attackers a map of weaknesses.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- eu
- Regulations
- Regulation (EU) 2022/2554 (DORA)
- Frameworks
- ISO 27001
Detects DORA Article 19 major ICT-related incident reports — the initial notification, intermediate report, and final report submitted to the competent authority under Delegated Regulation (EU) 2025/301 and Implementing Regulation (EU) 2025/302 — and voluntary notifications of significant cyber threats. These reports detail live vulnerabilities, affected services, and root causes; premature disclosure aids attackers and can move markets.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- eu
- Regulations
- Regulation (EU) 2022/2554 (DORA), Delegated Regulation (EU) 2025/301, Implementing Regulation (EU) 2025/302
- Frameworks
- ISO 27001
Detects extracts and working copies of the DORA Article 28(3) register of information on contractual arrangements with ICT third-party service providers, including the ESAs' Implementing Regulation (EU) 2024/2956 template content (contractual arrangement reference numbers, provider LEIs, ICT service supply chain, critical or important function flags). The register maps a financial entity's entire ICT outsourcing estate and its concentration risk; disclosure exposes supplier dependencies and attack surface.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- eu
- Regulations
- Regulation (EU) 2022/2554 (DORA), Implementing Regulation (EU) 2024/2956
- Frameworks
- ISO 27001
Detects EU driver's license number patterns across all EU member states. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Mixed
- Jurisdictions
- eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects International Bank Account Numbers (IBANs) used across European and global banking systems. IBANs consist of a two-letter country code, two check digits, and up to 30 alphanumeric characters representing the domestic bank account number. This pattern matches IBANs with or without space or hyphen delimiters between digit groups.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- eu
- Regulations
- GDPR, PSD2
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects European Union Classified Information (EUCI) protective markings as defined in Article 2(2) of Council Decision 2013/488/EU: the four bilingual French/English classification levels rendered together as a single marking — RESTREINT UE/EU RESTRICTED, CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET and TRÈS SECRET UE/EU TOP SECRET (the slash carries no surrounding spaces and TRÈS carries a grave accent, per the primary source). Named historically for RESTREINT but scopes the full EUCI ladder. The single-language French components (RESTREINT UE, CONFIDENTIEL UE, SECRET UE, TRÈS SECRET UE) are matched at a lower tier. Marking syntax verified directly against the Council Decision text; matched case-sensitively.
- Type
- regex
- Confidence
- high
- Jurisdictions
- eu
- Regulations
- Council Decision 2013/488/EU
- Frameworks
- EUCI
Detects references to EU National Identification Number using keyword matching. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects NIS2 Article 21 cybersecurity risk-management measures documentation from essential and important entities — gap assessments, board approval papers, and the policies implementing the Article 21(2)(a)-(j) measures (incident handling, business continuity, supply chain security, cyber hygiene, cryptography, access control, multi-factor authentication). These documents catalogue an entity's security posture and unremediated gaps.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- eu
- Regulations
- Directive (EU) 2022/2555 (NIS2)
- Frameworks
- ISO 27001
Detects NIS2 Article 23 significant-incident notifications from essential and important entities — the 24-hour early warning, 72-hour incident notification, intermediate report, final report, and progress report submitted to the CSIRT or competent authority. These filings contain live compromise details, indicators of compromise, and impact assessments; disclosure aids attackers and breaches supervisory confidentiality.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- eu
- Regulations
- Directive (EU) 2022/2555 (NIS2)
- Frameworks
- ISO 27001
Detects EU passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation. This is a broad, multi-country SIT that aggregates passport number detection across EU member states.
- Type
- regex
- Confidence
- medium
- Detection quality
- Mixed
- Jurisdictions
- eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects references to EU Social Security Number (SSN) or Equivalent ID using keyword matching. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects EU Tax Identification Number (TIN) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. EU TIN formats vary by member state; this keyword list provides tax-related terminology for supplementary matching across EU jurisdictions.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects EU VAT identification numbers for all 27 member states in a single consolidated pattern, built branch-by-branch from the per-country structures published in the European Commission VIES FAQ (Q11). Covers the Greek quirk (Greece prefixes with EL, not GR) and Northern Ireland's XI prefix, which remains checkable in VIES for goods traders under the Windsor Framework — XI is included with the UK 9-digit, 12-digit and GD/HA government/health-authority forms; plain GB numbers are NOT included because Great Britain left the VIES scheme after Brexit. This pattern is a superset alongside the existing per-country detectors (at/be/de/fr/hu/it-vat-number), which stay untouched for deployed-GUID stability — the same document may fire both, following the global-iban / eu-iban precedent.
- Type
- regex
- Confidence
- high
- Jurisdictions
- eu
- Regulations
- GDPR, VAT Directive 2006/112/EC
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Finland driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- fi, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Finland European Health Insurance Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the generic numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- fi, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Henkilötunnus (HETU) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, fi
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Finland passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- fi, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Finland Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- fi, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects forensic evidence and chain-of-custody records for active criminal or security investigations, including exhibit registers, DNA/fingerprint/ballistics results, custody handovers, and formal chain-of-custody documentation.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Evidence Act 1977 (Qld), Police Powers and Responsibilities Act 2000 (Qld)
- Frameworks
- QGISCF
Detects France driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- fr, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects France Health Insurance Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the generic numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- fr, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Carte Nationale d'Identité patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, fr
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects NIR Insee patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, fr
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects France passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- fr, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects French national telephone numbers per ARCEP's numbering plan: 10-digit numbers in the "0X XX XX XX XX" form covering geographic (01-05), mobile/personal (06-07), and polyvalent (09) leading digits, plus the +33 international form (10-digit domestic number with the leading 0 dropped, per ARCEP convention), including the widespread "+33 (0)6 39 98 45 67" letterhead rendering (a common-but-nonstandard practice — ITU-T E.123 advises against the parenthesised trunk digit in international notation, but it is ubiquitous on French letterheads and email signatures, so it is matched for detection purposes). The 09 polyvalent range is in scope because it is predominantly personal PII in practice: 09 is the standard residential VoIP home-line range, auto-issued with consumer internet boxes to millions of French households; only the small 0937-0939 sub-range carries ARCEP's newer "technical platform" category (app-to-driver ephemeral numbers and similar). Numbers beginning 08 (value-added services) remain intentionally out of scope — organizational/service numbers rather than personal PII, mirroring how uk-phone-number scopes out non-geographic service ranges.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- fr
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects France Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- fr, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects France Tax Identification Number (numéro SPI.) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- fr, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects France Value Added Tax Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. VAT numbers have country-specific prefixes that aid detection accuracy.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- fr, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects medical records related to gender transition including hormone therapy prescriptions, surgical records, gender identity assessments, change of sex descriptor applications, and recognised sex certificates under Queensland law. These records reveal deeply personal information about gender identity that is subject to anti-discrimination protections — disclosure can cause severe harm including discrimination, harassment, and violence.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Anti-Discrimination Act 1991 (Qld), Births Deaths Marriages Act 2003 (Qld), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- QGISCF
Detects documents containing genetic or genomic test results linked to identifiable patients, including pathogenic variant findings, hereditary risk assessments, and pharmacogenomic reports. Genetic data reveals predisposition to diseases, carrier status, and family lineage — disclosure enables genetic discrimination in insurance, employment, and relationships.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Anti-Discrimination Act 1991 (Qld), Health Records Act 2001 (Vic), Privacy Act 1988 (Cth)
- Frameworks
- QGISCF
Detects Greenland Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- gl
- Regulations
- Data Protection Act (Greenland)
- Frameworks
- ISO 27001, ISO 27701
Detects mobile advertising identifiers - Apple's IDFA and Google's Advertising ID (GAID, also called AAID) - when they appear labelled with an advertising-ID keyword. These IDs are UUIDs in the canonical 8-4-4-4-12 hexadecimal form. Although resettable, advertising IDs are persistent cross-app device identifiers treated as personal data under GDPR and CCPA/CPRA, and their disclosure enables cross-context tracking and re-identification.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- GDPR, CCPA/CPRA
- Frameworks
- ISO 27001, ISO 27701
Detects Australian Health Practitioner Regulation Agency (AHPRA) registration numbers used to identify registered health practitioners across 16 professions.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects references to AI training data, model datasets, and data provenance documentation in Australian contexts.
- Type
- keyword_list
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, NIST CSF, PCI-DSS
Detects documents containing credential-related terminology. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad, function-based bundled detector that aggregates multiple credential SITs. This keyword-based version flags documents that may contain credentials for further review.
- Type
- regex
- Confidence
- low
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Catalogue reference for the Microsoft Purview built-in All Full Names named-entity SIT. This YAML-only record supplies supplementary name-field vocabulary for registry search and testing; it does not reproduce Microsoft's opaque name-recognition resources.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- global
- Regulations
- CCPA/CPRA, GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects All Medical Terms And Conditions patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- global
- Regulations
- GDPR, HIPAA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Catalogue reference for the Microsoft Purview built-in All Physical Addresses bundled named-entity SIT, which contains country and region physical-address SITs including Australia physical addresses. This YAML-only record supplies supplementary address vocabulary for registry search and testing; it does not reproduce Microsoft's opaque named-entity resources and is not a custom XML clone.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- global
- Regulations
- CCPA/CPRA, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Anthropic (Claude) API keys. Standard keys use the sk-ant-api03- prefix followed by a long base64url body ending in AA; admin keys use sk-ant-admin01-. A leaked key grants billed access to the Anthropic API and any connected data.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects ASP.NET Machine Key patterns in configuration files. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Partial
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Atlassian API tokens (ATATT3 prefix), used for Jira, Confluence and other Atlassian Cloud REST APIs. A leaked token grants the associated user's access to projects, issues, wiki content and attachments.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects Auth0 client secrets. Auth0 issues an unprefixed 64-character base64url-style client secret, indistinguishable from other long random strings, so this pattern requires an adjacent Auth0 label plus an assignment separator to structurally qualify a match. A leaked client secret lets an attacker mint tokens as the application and impersonate it against every API it is authorized for.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects AWS Access Key patterns.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects AWS Secret Key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- low
- Detection quality
- Partial
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Service Bus Connection String patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF
Detects Azure Storage Connection String patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Azure Storage Key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects JWT-shaped values presented with the Bearer authentication scheme. A bare scheme/value pair is discovery-only; an Authorization header enforces at medium confidence and a complete HTTP request or response context reaches high.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Binance API keys, which are 64-character case-sensitive alphanumeric strings with no distinctive prefix. Because a bare 64-char alphanumeric token is generic (it collides with any random token of that length), this pattern is context-gated: it requires a nearby Binance label and an assignment (= or :) before the value. A leaked key grants API access to the account (trading and, if enabled, withdrawal).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects biometric data about an identified person - biometric templates, identifiers and records, fingerprint scans or templates, facial recognition, iris/retina scans, voiceprints and palm prints - when the biometric phrase sits with a populated person identifier and biometric enrolment/capture fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), NDB Scheme (Cth), Information Privacy Act 2009 (Qld), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects encoded biometric template artifacts rather than the word "fingerprint". Matches the ISO/IEC 19794 family modality magic markers (FMR\0 finger minutiae, FIR\0 finger image, FAC\0 face, IIR\0 iris — also the ANSI/INCITS 378 FMR header) and base64 blobs explicitly labelled as a biometric / fingerprint / iris / face template. Real biometric exfiltration moves as encoded templates, not plaintext.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global, eu
- Regulations
- GDPR, CCPA/CPRA
- Frameworks
- ISO 27001, NIST CSF, SOC 2
Detects a BIP-39 mnemonic (crypto wallet recovery / seed phrase): a run of 11-24 space-separated lowercase words. Because the full 2048-word BIP-39 list cannot be embedded in a single regex, detection fires either when the word run is explicitly labelled as a seed/mnemonic/recovery phrase, or when the run contains one of a set of distinctive BIP-39 anchor words. A leaked seed phrase grants full, irreversible control of the wallet's funds.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects date-of-birth references across common date formats (numeric slash/dot/hyphen, written month, ISO) when birth-record labels or personal-record context are present. Covers Australian and global document styles; business dates (invoice, due, expiry) and template samples are suppressed.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Detects Bitcoin payment address candidates in both Bech32 (bc1…) and legacy Base58 (1…/3…) shapes. Checksums are not validated (Purview custom SITs lack Bech32/Base58Check functions), so matches are structural candidates and require Bitcoin/transfer context at enforce tiers.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects Blood Test Terms patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- global
- Regulations
- GDPR, HIPAA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects populated board papers and board resolutions: a board paper / board memorandum / board resolution phrase combined with populated paper metadata (paper number, agenda item, meeting date), a named author or sponsor, or a formal 'That the Board...' recommendation. Phrase-only mentions stay discovery-only.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Corporations Act 2001 (Cth), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- DISP, ISO 27001, NIST CSF
Detects Braintree (PayPal) OAuth access tokens, which use a distinctive literal dollar-delimited structure: access_token$<environment>$<merchant-id>$<token>. A leaked token allows payment processing and transaction-history access on the connected merchant's behalf.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Brand Medication Names patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- global
- Regulations
- GDPR, HIPAA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects budget proposals, financial forecasts, and expenditure planning documents.
- Type
- keyword_list
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- DISP, ISO 27001, NIST CSF
Identifies substantive Australian federal and state Cabinet submissions, memoranda, approval papers, and Cabinet briefs, briefing notes and briefing books. Topic phrases are retained for discovery; enforcement requires purpose, recommendation, financial, consultation, implementation, risk, regulatory, key-issues, talking-points or decision-sought sections, and high confidence also requires a formal Cabinet marking, minute, decision, or submission identifier. Absorbed global-top500-492-cabinet-briefing-books (2026-09-24).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1899 (Qld), Right to Information Act 2009 (Qld)
- Frameworks
- QGISCF
A job applicant's own documents as held by recruiters, recruitment platforms and HR: a resume / CV, a cover letter with a selection criteria response, or a completed application form. Detected from CV section headings (employment history, work experience, education, referees, key skills, career objective), a populated candidate contact block (name with phone or email), employment date ranges and populated referee details. The panel's side of recruitment (interview notes, selection reports) and recommendation letters are covered by separate classifiers.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global, au
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects a labelled card verification value: a CVV / CVV2 / CVC / CVC2 / CID / CSC keyword (or the spelled-out "card verification value/code" / "card security code") immediately followed by a 3 or 4 digit value. The CVV is sensitive authentication data that PCI DSS 4.0 Requirement 3.3.1 prohibits storing after authorization.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Criminal Code Act 1995 (Cth), Criminal Code Act 1899 (Qld), GDPR
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2, PCI-DSS
Detects Cardano Shelley-era payment addresses: bech32-encoded with the mainnet human-readable prefix "addr1" (CIP-19 / CIP-5). The bech32 body varies with address type — enterprise (payment only) ~53 body chars, base (payment + stake) ~98 body chars, pointer in between — so the total ranges roughly 58-103 characters. The distinctive "addr1" prefix plus a long bech32 body is strong structure, gated at 85. Legacy Byron base58 (Ae2.../DdzFF...) and reward "stake1" addresses are not implemented (see report). Prefix/lengths verified against the CIP-19 test vectors.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
- Frameworks
- ISO 27001, ISO 27701, SOC 2, FATF Recommendations
Detects personal data about an identified child - children's data, records and information, minors' personal information, and parental or guardian consent records - when the phrase sits with a populated child/parent identifier and consent or account fields.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), NDB Scheme (Cth), Information Privacy Act 2009 (Qld), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects CircleCI personal access tokens (CCIPAT_ prefix). These tokens authenticate to the CircleCI API and can read/modify pipelines, contexts and project settings; a leak enables CI/CD compromise.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Computer Fraud and Abuse Act, Computer Misuse Act 1990
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects documents containing client secret and API key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad bundled detector. This keyword-based version flags documents that may contain client secrets or API keys for further review.
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Cloudflare API tokens - 40-character tokens that authenticate to the Cloudflare API. Because the raw token has no distinctive prefix, this pattern gates on nearby Cloudflare context to keep false positives low.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Computer Fraud and Abuse Act, Computer Misuse Act 1990
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects Cohere API keys. Cohere issues an opaque 40-character alphanumeric token with no distinctive vendor prefix, so this pattern requires an adjacent Cohere label (cohere / CO_API_KEY / COHERE_API_KEY) to structurally qualify a match.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects Coinbase Developer Platform (CDP) API key names, which use the distinctive resource-path form organizations/{org-uuid}/apiKeys/{key-uuid}. This key name is paired with an EC/ECDSA (or Ed25519) signing secret and is used to mint ES256 JWTs for the Coinbase API. A leaked CDP key can grant programmatic access to accounts, trading and funds. The associated EC PRIVATE KEY PEM secret is detected separately by global-ec-private.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects commercial lease agreements containing premises details, rental terms, and tenant obligations.
- Type
- keyword_list
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects populated internal-control deficiency findings (control deficiency, significant deficiency, material weakness, ICFR weakness) that carry a finding reference, rating, accountable owner or remediation due date. Definitions and accounting guidance stay discovery-only.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Corporations Act 2001 (Cth), SOX, Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, NIST CSF, PCI-DSS
Detects credential combolist / infostealer-log lines: email:password pairs and host-or-url:user:pass triples, the format in which stolen credentials are aggregated and traded after info-stealer infections. These dumps fuel credential stuffing and account-takeover attacks. A lone email/password candidate is discovery-only; service-bound triples and multi-row dump structure support enforcement.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects Datadog API keys, which are 32 hexadecimal characters with no fixed prefix. Because a bare 32-hex string is generic, this pattern requires a nearby Datadog label to confirm the match. A leaked key grants metric, log and event ingestion access.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects DigitalOcean personal access tokens (dop_v1_ prefix). These tokens authenticate to the DigitalOcean API and can manage droplets, databases, DNS and billing; a leak enables full account control.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Computer Fraud and Abuse Act, Computer Misuse Act 1990
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects direct debit requests, BECS authorizations, and recurring payment arrangements under Australian banking standards.
- Type
- keyword_list
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Identifies disaster recovery and IT continuity plans that contain populated recovery detail: numeric recovery objectives, system hosts/addresses, numbered recovery steps or recovery commands. Plan titles alone are discovery-only.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- CIS Controls, DISP, ISO 27001, NIST CSF, SOC 2
Detects Discord bot tokens: three dot-separated base64url segments where the first segment is the bot's numeric snowflake ID base64-encoded (always starting M, N, or O because it encodes an ASCII digit), the second is a 6-character timestamp, and the third is an HMAC of 27 to 38 characters. A leaked bot token grants full control of the bot account, including reading every channel the bot can see and sending messages as the bot.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects Diseases patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- global
- Regulations
- GDPR, HIPAA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects references to Defence Industry Security Program (DISP) membership and defence industry security markers in Australian documents.
- Type
- keyword_list
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Defence Act 1903 (Cth), Defence Trade Controls Act 2012 (Cth)
- Frameworks
- QGISCF
Detects Docker Hub personal access tokens (dckr_pat_ prefix). These tokens authenticate to Docker Hub and can pull/push images; a leak enables image tampering and supply-chain compromise.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Computer Fraud and Abuse Act, Computer Misuse Act 1990
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects Dogecoin mainnet addresses: Base58Check encoded, 34 characters long. Pay-to-Public-Key-Hash (P2PKH) addresses use version byte 0x1E and start with "D"; Pay-to-Script-Hash (P2SH) addresses use version byte 0x16 (22) and start with "A" (leading "9" is also possible for that version byte). A single leading letter is weak structure, so detection is context-gated. Prefix/version/length verified against libdogecoin and Dogecoin address-type docs.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
- Frameworks
- ISO 27001, ISO 27701, SOC 2, FATF Recommendations
Detects Department of Veterans' Affairs (DVA) file numbers used to identify Australian veterans and eligible dependants for health and support services.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Detects SEC1 elliptic-curve private-key armor. The BEGIN marker is discovery-only, a SEC1-like Base64 body supports medium confidence, and a complete container with curve or signing context reaches high confidence.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Elasticsearch URI with Credentials patterns.
- Type
- regex
- Confidence
- high
- Detection quality
- Partial
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Identifies electronic mail addresses in local-part@domain.tld form using a pragmatic RFC 5322 / WHATWG HTML Living Standard subset: bounded local-part (64 characters, per RFC 5321) and domain-label quantifiers, not the full RFC 5322 address-list grammar (no quoted-string local parts, comments, or domain literals). Unlike the WHATWG "valid e-mail address" definition, a dotted domain ending in an alphabetic (or xn-- punycode) top-level label is required, so dotless intranet values such as user@localhost are deliberately excluded. Retina image asset names (logo@2x.png) are rejected in the primary. Absorbs the former global-email-address classifier.
- Type
- regex
- Confidence
- high
- Detection quality
- Mixed
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), CCPA/CPRA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects sensitive employment case records about an identified worker: workplace investigations, disciplinary action and show cause notices, grievance and harassment complaints, workers compensation and return to work plans, termination and redundancy notices.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Fair Work Act 2009 (Cth), Public Sector Act 2022 (Qld), Work Health and Safety Act 2011 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects Ethereum Address patterns.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2, FATF Recommendations
Detects GCP Api Key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects GCP service-account JSON key files, distinguishing bare type=service_account record markers (discovery only) from complete keys whose object also carries an escaped PEM private_key and a .iam.gserviceaccount.com client_email (enforcing), with project_id/private_key_id as additional high-confidence evidence.
- Type
- regex
- Confidence
- low
- Detection quality
- Partial
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects general password patterns in documents and configuration files. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad, function-based detector. This keyword-based version flags documents that may contain passwords for further review.
- Type
- regex
- Confidence
- low
- Detection quality
- Mixed
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects general symmetric encryption key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad, function-based detector. This keyword-based version flags documents that may contain symmetric keys for further review.
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects database connection URLs with embedded user:password@host credentials, restricted to database schemes (mongodb/mongodb+srv, postgres/postgresql, mysql, redis/rediss, mssql/sqlserver, oracle, jdbc). Placeholder passwords and localhost/example hosts are rejected; non-database credential URLs (AMQP, LDAP, FTP) belong to a separate service-URL credential classifier.
- Type
- regex
- Confidence
- low
- Detection quality
- Partial
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Generic Medication Names patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- global
- Regulations
- GDPR, HIPAA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects GitHub Fine-Grained PAT patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Github Pat patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects GitLab deploy tokens (gldt- prefix). Deploy tokens grant read/write access to a project's repository, container registry and package registry; a leak enables artifact theft or tampering.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Computer Fraud and Abuse Act, Computer Misuse Act 1990
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects GitLab personal access tokens (glpat- prefix). A leaked PAT grants repository, CI/CD pipeline and package-registry access scoped to the issuing user.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Computer Fraud and Abuse Act, Computer Misuse Act 1990
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects GitLab pipeline trigger tokens (glptt- prefix). These tokens let external systems start CI/CD pipelines via the trigger API; a leak allows unauthorized pipeline execution.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Computer Fraud and Abuse Act, Computer Misuse Act 1990
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects GitLab runner authentication tokens (glrt- prefix). These tokens authenticate a CI/CD runner to a GitLab instance; a leak lets an attacker impersonate a runner and capture job payloads.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Computer Fraud and Abuse Act, Computer Misuse Act 1990
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects geographic coordinates as a decimal-degree latitude/longitude pair (e.g. -33.8688, 151.2093), as a degrees-minutes-seconds (DMS) value with a hemisphere letter (e.g. 40° 26' 46" N), or as a Military Grid Reference System (MGRS) reference (e.g. 4QFJ 12345 67890). The slug predates the DMS and MGRS scope, which was absorbed from the former global-gps-coordinates-dms classifier.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Grafana Cloud API tokens (glc_ prefix) and Grafana service account tokens (glsa_ prefix). A leaked token grants access to dashboards, data sources and, for Grafana Cloud, metrics/logs ingestion endpoints.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects Groq (GroqCloud) API keys, which use a distinctive gsk_ prefix followed by a long alphanumeric body. A leaked key grants unauthorized, billed access to Groq's hosted inference API and any prompts or data routed through it.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects populated guarantee and indemnity instruments (personal/corporate/continuing guarantees, deeds of guarantee, guarantor agreements) that name the guarantor or borrower, state a guaranteed amount or limit, or carry an ABN/ACN. Phrase-only mentions stay discovery-only.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- National Consumer Credit Protection Act 2009 (Cth), Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects HashiCorp Vault service tokens (hvs. prefix) and batch tokens (hvb. prefix). These tokens authenticate to a Vault server and can read secrets, keys and credentials. A bare prefixed candidate is discovery-only; binding fields and Vault auth-response metadata provide balanced and high-confidence enforcement.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Computer Fraud and Abuse Act, Computer Misuse Act 1990
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects Heroku platform API keys in the prefixed HRKU- form. These keys authenticate to the Heroku Platform API and can deploy apps, read config vars and manage add-ons; a leak enables full account compromise.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Computer Fraud and Abuse Act, Computer Misuse Act 1990
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects HL7 Health Message patterns. Detects HL7v2 message headers and ADT event types
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- HIPAA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Tabular HRIS, payroll or reporting exports of staff personal details that do not carry TFNs: a CSV, spreadsheet or pipe/tab-delimited header row of HR column labels (employee / staff ID, name, date of birth, home address, position / classification, commencement or termination date, employment status) followed by populated staff rows. Detected from the extract's own structure, so it fires wherever the file lands (code repositories, reporting databases, file shares, test data folders), not only in HR-branded systems.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global, au
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Fair Work Regulations 2009 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, QGISCF
Detects HTTP Authorization header patterns containing Bearer tokens, Basic credentials, and other authentication schemes. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Hugging Face user access tokens (hf_ prefix), used to authenticate to the Hugging Face Hub API. A leaked token grants access to private models, datasets and Spaces, and can incur inference billing.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects International Bank Account Numbers (IBANs) across the full ISO 13616 / SWIFT IBAN Registry country set, extending coverage beyond the EU-focused eu-iban pattern to non-EU IBAN countries verified against the SWIFT IBAN registry — at minimum United Kingdom (GB, 22 chars), Switzerland (CH, 21), Norway (NO, 15), Saudi Arabia (SA, 24), United Arab Emirates (AE, 23), and Turkey (TR, 26). The structural regex widens eu-iban's BBAN length range (12-36 alphanumeric characters) down to 8-32 specifically to also catch shorter formats such as Norway's 15-character IBAN (11-character BBAN), which falls below eu-iban's minimum and would not match it. This pattern intentionally co-fires with eu-iban for EU country codes, since neither pattern restricts the 2-letter prefix to a specific country allow-list — see false_positives.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- GDPR, CCPA/CPRA
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects ICCID patterns.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects ICD-10 Cm patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- HIPAA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects ICD-10 Pcs patterns.
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- HIPAA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects International Classification of Diseases (ICD-9-CM) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the generic numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- low
- Detection quality
- Mixed
- Jurisdictions
- global
- Regulations
- GDPR, HIPAA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
IEC 61850 System Configuration Language (SCL) files for a configured substation or IED: SCD, ICD, CID, SSD and IID exports from substation configurator tools. Detects the SCL XML namespace and the populated Communication section (ConnectedAP with IP addressing, GOOSE and Sampled Values multicast MAC addresses in the 01-0C-CD range, APPIDs) plus IED, logical device and control-block structure. A populated SCD/CID gives the station bus network plan, IED names and GOOSE trip-signal addressing for a live substation.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth), Directive (EU) 2022/2555 (NIS2)
- Frameworks
- IEC 62443, IEC 61850, NIST CSF, AESCSF
Detects IMEI patterns.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Identifies organisation-specific incident response plans with named role assignments, severity definitions or contact details. Plan titles alone are discovery-only.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- CIS Controls, DISP, ISO 27001, NIST CSF, SOC 2
Detects person-linked Aboriginal and Torres Strait Islander data - Indigenous status and origin fields and Indigenous data, health data or identifiers attached to an identified person record - as well as discovery-grade Indigenous data governance references.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), NDB Scheme (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Detects a labelled health-insurance member, subscriber, policy or group identifier: a member/subscriber/policy/group ID label followed by a 6-15 character alphanumeric value that contains at least one digit. Insurance identifiers are protected health information under HIPAA and are frequently exposed in breach disclosures.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- HIPAA
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects internal audit reports containing control assessments and organisational vulnerability findings.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth), Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- DISP, ISO 27001, NIST CSF
Detects IPv4 patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects IPv6 patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Identifies IT runbooks, operational/security playbooks, SOPs and work instructions that contain executable operational detail: numbered steps, shell/admin commands, or internal hosts and addresses. Titles alone are discovery-only.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, DISP, ISO 27001, NIST CSF, SOC 2
Detects JSON Web Token candidates with three Base64url segments. A generic encoded-JSON candidate is discovery-only; a standard encoded algorithm header plus encoded JSON payload enforces at medium confidence, and HTTP or session transport binding raises the result to high confidence.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Kraken REST API credentials: the public API key (56 base64 characters) and the private key / API secret (86-88 base64 characters, base64 of 64 bytes). Because base64 strings have no distinctive prefix, this pattern is context-gated: it requires a nearby Kraken label and an assignment (= or :) before the value. A leaked private key allows signing authenticated requests to the account.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects embedded credentials inside a Kubernetes kubeconfig file - base64 client certificate / key data blocks and inline bearer tokens. A leaked kubeconfig grants cluster access at the scope of the embedded identity.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Computer Fraud and Abuse Act, Computer Misuse Act 1990
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects Kubernetes Internal Service URL patterns.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Lab Test Terms patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- global
- Regulations
- GDPR, HIPAA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects LangSmith API keys (personal access tokens and service keys), which use a distinctive lsv2_pt_ or lsv2_sk_ prefix followed by a hyphenated hex body. A leaked key grants unauthorized access to LangSmith trace data -- which can include full LLM prompts and completions -- and billed access to the LangSmith/LangChain platform.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects ISO 17442 Legal Entity Identifiers (LEIs) — the 20-character uppercase alphanumeric codes issued under the Global LEI System (GLEIF) that uniquely identify legal entities in financial transactions. Structure: characters 1-4 are the LEI-issuer (LOU) prefix, characters 5-6 are reserved and set to "00", characters 7-18 are the entity-specific part, and characters 19-20 are numeric check digits (ISO 7064 MOD 97-10). Requiring the literal "00" at positions 5-6 and two digits at positions 19-20 makes the format far more distinctive than a generic 20-character alphanumeric run. Known recall cost: pre-2013 CICI-era legacy LEIs — interim identifiers issued before the "00" reservation, grandfathered into the GLEIF system and still live and checksum-valid — do not carry "00" at positions 5-6 and are NOT matched. This class includes major counterparties such as Microsoft (INR2EJN1ERAN0W5ZP974), Deutsche Bank (7LTWFZYICNSX8D621K86) and Apple (HWUPKR0MPOU8FGXBT394), so documents dealing with such entities' LEIs will be missed. This is a deliberate precision-over-recall trade-off: dropping the "00" anchor would widen the pattern to any 20-character uppercase alphanumeric run ending in two digits.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- MiFID II, EMIR, Dodd-Frank Act
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Litecoin addresses in two forms. Native SegWit bech32 addresses use the human-readable part "ltc1" (distinctive, 85-gated). Legacy base58 addresses are P2PKH with version byte 0x30 (leading "L") and P2SH with version byte 0x32 (leading "M"), 26-35 characters (most 34) — a single-letter prefix that is weaker (75-gated). Prefixes/version bytes/lengths verified against the Litecoin address-prefix docs and documented example addresses.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
- Frameworks
- ISO 27001, ISO 27701, SOC 2, FATF Recommendations
Detects LOINC laboratory observation codes in nnnnn-n form.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global, us
- Regulations
- HIPAA, CLIA
- Frameworks
- ISO 27001, ISO 27701
Detects Mac Address patterns.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects Mailchimp API keys, formatted as 32 hex characters followed by -us and a 1-2 digit datacenter code. A leaked key grants access to audience lists, campaigns and subscriber PII.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects Mailgun private API keys (key- prefix followed by 32 hex characters). A leaked key allows sending email and accessing logs and account data via the Mailgun API.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects populated management action plans and corrective action plans that respond to audit findings: the action-plan phrase combined with a finding reference, a named action owner, a due date or an action status. Phrase-only mentions stay discovery-only.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- DISP, ISO 27001, NIST CSF
Detects Lifestyles That Relate To Medical Conditions patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- global
- Regulations
- GDPR, HIPAA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Medical Specialties patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- global
- Regulations
- GDPR, HIPAA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Microsoft Bing Maps API key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Identifies substantive Australian ministerial, Director-General, secretary, and executive briefing documents. Topic phrases are retained for discovery; enforcement requires issue, recommendation, option, risk, financial, stakeholder, communications, decision, or implementation content, and high confidence also requires a formal brief reference or decision/approval signal.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth), Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- DISP, ISO 27001, NIST CSF
Detects Monero (XMR) public addresses, encoded in Monero-specific base58 (same 58-character alphabet as standard base58, excluding 0 O I l). Standard addresses (mainnet network byte 18) and subaddresses (network byte 42) are 95 characters and begin with "4" or "8"; integrated addresses (network byte 19, standard address + encrypted 64-bit payment ID) are 106 characters and begin with "4". The fixed 95/106-char length is highly distinctive, gated at 85. Prefixes/lengths verified against the Monero standard-address and integrated-address docs.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
- Frameworks
- ISO 27001, ISO 27701, SOC 2, FATF Recommendations
Detects Mongodb patterns.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Mysql patterns.
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects National Metering Identifier (NMI) patterns used in the Australian energy market. A 10 or 11 digit number identifying electricity and gas connection points. Also covers the gas Meter Installation Registration Number (MIRN), which is allocated in the NMI number space: AEMO reserves the 5 XXX XXX XXX range for the gas industry (NSW/ACT 52, Vic 53, Qld 54, SA 55, WA 56, Tas 57) and MIRNs travel in the same aseXML NMI element with a checksum attribute. Context-dependent: requires energy/meter keywords.
- Type
- regex
- Confidence
- low
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects references to nationality/citizenship/immigration-status disclosure: nationality fields, national origin, citizenship status, visa status, and naturalization records. Unlike the three sibling Art-9 patterns in this wave (sexual-orientation, religious-beliefs, racial-ethnic-origin), nationality is NOT a GDPR Article 9 special category — it is processed under GDPR's ordinary Article 6 lawful-basis regime. It is grouped with the Art-9 set here because it shares the same detection problem (an attribute value with no fixed format) and was bundled with them in the C3 deprecation/gap analysis, and because national origin carries real discrimination risk. Topic-grade detector, low confidence by design.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF, SOC 2
Detects US National Drug Codes (NDC) identifying drug products, including common dashed labeler formats (4-4-2, 5-3-2, 5-4-2) and HIPAA 11-digit zero-padded forms. Structural NDC candidates used in pharmacy, claims, and clinical product coding.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- us, global
- Regulations
- HIPAA, FD&C Act, CCPA/CPRA
- Frameworks
- ISO 27001, ISO 27701
Detects Netlify authentication tokens: the current nf-prefixed family announced by Netlify in November 2023 (nfp_ personal access tokens, nfc_ CLI tokens, nfo_ OAuth tokens, nfu_ app.netlify.com tokens, nfb_ build tokens) and, when labelled with Netlify context, the legacy unprefixed 43-45 character token form that remains valid. A leaked token grants control of the account's sites, deploys and environment variables.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Identifies substantive internal network-infrastructure design and topology documents. Topic phrases are retained for discovery; enforcement requires segmentation, trust-boundary, routing, VLAN, DMZ, data-flow, or firewall-design content, and high confidence also requires a populated address, VLAN, port, device, or rule detail.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth)
- Frameworks
- CIS Controls, DISP, ISO 27001, NIST CSF, SOC 2
Detects references to neural / neurotechnology data: brain-computer interface signals, EEG/EMG recordings, evoked potentials, neural decoding output and neurofeedback data. Colorado HB24-1058 and California SB 1223 both classify neural data as sensitive personal information. Topic-grade vocabulary detector, not a fixed-format detector.
- Type
- regex
- Confidence
- low
- Jurisdictions
- global, us
- Regulations
- CCPA/CPRA, GDPR
- Frameworks
- ISO 27001, NIST CSF, SOC 2
Detects New Relic user API keys (NRAK- prefix followed by 27 characters). A leaked key grants access to the New Relic GraphQL (NerdGraph) API and account telemetry.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects Notion integration tokens in both live formats: the current ntn_ prefix (issued to all new integrations since 25 September 2024) and, when labelled with Notion context, the legacy secret_ prefix (existing tokens remain valid indefinitely). A leaked integration token grants API access to every page and database the integration has been connected to.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects bounded npm access-token values (npm_ prefix, fixed 36-character body) and credential-bearing .npmrc authToken assignments; documentation and placeholder examples remain excluded. These tokens authenticate to the npm registry and can publish, unpublish or grant access to packages; a leak enables supply-chain attacks via malicious publishes.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Computer Fraud and Abuse Act, Computer Misuse Act 1990
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects NuGet.org API keys (oy2 prefix), used to push packages to the NuGet gallery. A leaked key lets an attacker publish or unlist packages under the owner's account.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects Okta API-token candidates, which begin with 00 and are followed by 40 base64url characters. Okta or SSWS context is required for enforcement because the 42-character shape can represent unrelated identifiers; the bare value shape surfaces only as discovery inventory. A leaked token grants Okta admin API access.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects Openai Key patterns.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects OpenSSH private-key armor. The fixed BEGIN line alone is discovery-only; the encoded openssh-key-v1 container magic supports medium confidence and normally wrapped near-header body lines support high confidence.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Oracle Connection String patterns.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Identifies substantive operational-technology, SCADA, ICS, and industrial-control security assessments. Topic phrases are retained for discovery; enforcement requires findings, affected assets, evidence, remediation, attack paths, firmware, segmentation, credential, or remote-access weaknesses, and high confidence additionally requires a concrete technical indicator and severe exploit consequence.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF
Identifies populated Australian question-time briefs (QTB), Senate Estimates briefs, parliamentary question responses and parliamentary correspondence briefs: the brief type together with populated brief header fields (Minister, portfolio, issue, division, contact officer, cleared by, date, question or brief number).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Right to Information Act 2009 (Qld)
- Frameworks
- PSPF, QGISCF, ISO 27001
Detects the Machine-Readable Zone (MRZ) of an ICAO 9303 travel document, the OCR-B text printed at the bottom of passport data pages and scanned at border control. This pattern focuses on the TD3 passport format (two lines of 44 characters): line 1 begins 'P' + document subtype + 3-letter issuing state + the holder's names, and line 2 packs the document number, check digits, nationality, date of birth, sex and expiry. MRZ leakage via scans, photocopies and OCR exports is one of the highest-value passport data exposure vectors because it concentrates every identity field in a single fixed-width block.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- GDPR, CCPA/CPRA
- Frameworks
- ISO 27001, ISO 27701
Detects Australian PayID payment addresses used on the New Payments Platform (NPP). A PayID is an email address, mobile phone number (+61 / 04xx format), ABN or organisation identifier registered as a real-time payment alias, detected when it appears near an explicit PayID label in a payment context.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies payment card Primary Account Numbers (PANs) for Visa, Mastercard (including 2-series BINs), American Express, Discover, JCB, Diners Club and UnionPay, in contiguous and space/hyphen-separated forms. Uses Func_credit_card Luhn validator with AllDigitsSameFilter.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- CCPA/CPRA, GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects ISO/IEC 7813 magnetic-stripe Track 1 (format code B) data for payment cards: a start sentinel %B, the primary account number, the cardholder name, expiry date, service code and discretionary data. Storing full track data after authorization is prohibited by PCI DSS 4.0 Requirement 3.3.1.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Criminal Code Act 1995 (Cth), Criminal Code Act 1899 (Qld), GDPR
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2, PCI-DSS
Detects ISO/IEC 7813 magnetic-stripe Track 2 data for payment cards: a start sentinel ;, the primary account number, a field separator =, expiry (YYMM), service code and discretionary data, end sentinel ?. Also detects the common no-sentinel database form PAN=YYMM... Storing full track data after authorization is prohibited by PCI DSS 4.0 Requirement 3.3.1.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Criminal Code Act 1995 (Cth), Criminal Code Act 1899 (Qld), GDPR
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2, PCI-DSS
Detects payment advices, remittance notices, and electronic funds transfer confirmations.
- Type
- keyword_list
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects Perplexity API keys, which use a distinctive pplx- prefix followed by a 48-character alphanumeric body. A leaked key grants unauthorized, billed access to Perplexity's search and chat completion API and any prompts or data routed through it.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects the ASCII-armored header of an OpenPGP (PGP/GnuPG) private key block, as defined in RFC 4880 / RFC 9580. A leaked PGP private key allows an attacker to decrypt the holder's encrypted mail and files and to forge signatures in their name. The registry already covers RSA, EC, OpenSSH and PKCS#8 private keys; this adds the OpenPGP armor format. Header-only hits are discovery-only; armored packet data near the header provides the enforcement tiers.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- CCPA/CPRA
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects international telephone numbers in ITU-T E.164 form: a leading "+" (the international prefix symbol defined by ITU-T E.123, the companion notation recommendation) followed by a country code and national significant number totalling no more than 15 digits, per E.164's own numbering-space limit (country code 1-3 digits, subscriber number up to 12 digits, 15 digits maximum overall). This pattern covers only the "+"-prefixed international representation — it is the global counterpart to the country-specific domestic-format patterns (us-phone-number, ca-phone-number, uk-phone-number, in-phone-number, and the EU national patterns), which additionally match each country's bare domestic formatting conventions. Real-world renderings commonly use spaces or hyphens between digit groups even though E.123 formally prescribes spaces only; both are accepted here. The "+CC (0)..." letterhead rendering (e.g. "+44 (0)20 7946 0958") is deliberately NOT matched by this pattern: it is not an E.164 representation (E.123 explicitly advises against the parenthesised trunk digit in international notation), and the country-specific patterns whose plans actually use a trunk 0 (uk/de/fr/nl) each cover it themselves — keeping this global pattern strictly E.164-shaped.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- GDPR, CCPA/CPRA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Pinecone API keys in both current live formats: pcsk_ (the dominant format issued by the Pinecone console, CLI, and SDK key-creation flows) and pckey_ (the Enterprise-plan Admin API variant, format pckey_<public-label>_<unique-key>). A leaked key grants unauthorized access to a Pinecone vector database, including any embeddings or vectorised source data it stores.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects unencrypted PKCS#8 private-key armor. The generic BEGIN PRIVATE KEY marker is discovery-only; a DER algorithm prelude supports medium confidence, and near-header wrapped body data or an exact compact-key prelude reaches high.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Plaid API credentials: Item access tokens (access-sandbox-/access-production- followed by an RFC 4122 UUID) and, when labelled with Plaid context, the 30-character hex API secret. A leaked access token exposes a user's linked bank account data; a leaked secret compromises the whole Plaid integration.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Machine-format PLC program and project exports: Rockwell Studio 5000 / RSLogix 5000 L5X (RSLogix5000Content XML) and L5K (IE_VER text) files, Siemens TIA Portal Openness block XML (Document / Engineering version / SW.Blocks), and Schneider Control Expert / Unity Pro XEF exchange files (FEFExchangeFile). A populated export carries the controller model, network addresses, I/O modules, tags and control logic of a production control system.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth), Directive (EU) 2022/2555 (NIS2)
- Frameworks
- IEC 62443, NIST CSF, AESCSF, ISO 27001
Detects references to political opinions and party affiliation: party membership, voter registration by party, political donations and campaign contributions. GDPR Article 9 lists political opinions as a special category of personal data with no fixed format — it is detectable only by topic vocabulary. Topic-grade detector, low confidence by design.
- Type
- regex
- Confidence
- low
- Jurisdictions
- global, eu
- Regulations
- GDPR, Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, NIST CSF, SOC 2
Detects Postgresql patterns.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects populated security agreements and PPSR registrations: a security agreement / PPSR / personal property securities phrase combined with a named grantor or secured party, a PPSR registration or financing statement number, or described collateral. Phrase-only mentions stay discovery-only.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Personal Property Securities Act 2009 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to internal project or initiative codenames in the "Project <CODENAME>" / "Operation <CODENAME>" labelling style. The public form of this pattern carries fictional example codenames only - it is a customisation skeleton: deployments substitute their organisation's live codename list via the declared customisation, which is what gives the pattern real detection value.
- Type
- regex
- Confidence
- low
- Jurisdictions
- global
- Regulations
- Corporations Act 2001 (Cth)
- Frameworks
- ISO 27001
Detects the header line of a PuTTY private key file (.ppk), as produced by PuTTYgen. The header begins with 'PuTTY-User-Key-File-' followed by the format version (2 or 3) and the SSH key algorithm. A leaked .ppk grants SSH access to whatever hosts trust the corresponding public key. Header-only candidates are discovery-only; ordered PPK metadata and the first public-blob line support enforcement.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- CCPA/CPRA
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects PyPI (Python Package Index) upload tokens. The fixed marker pypi-AgEIcHlwaS5vcmc is the base64 encoding of "pypi.org", making these tokens near-unmistakable. A leaked token lets an attacker publish malicious package releases.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects racial or ethnic origin information in person-linked demographic, workforce, intake, census, application, and case records. The detector recognises explicit racial/ethnic-origin phrases and structured race or ethnicity fields, then raises confidence only when the same span contains a data-subject record and a populated attribution. Racial or ethnic origin is protected under GDPR Article 9 and Australian anti-discrimination and privacy law. Topic-grade detector, low confidence by design.
- Type
- regex
- Confidence
- low
- Jurisdictions
- global, au, eu
- Regulations
- GDPR, Privacy Act 1988 (Cth), Racial Discrimination Act 1975 (Cth)
- Frameworks
- ISO 27001, NIST CSF, SOC 2
Detects red team assessment reports and red team findings records revealing proven attack paths and security blind spots. A red-team / purple-team / adversary-simulation / threat-emulation title is discovery-only; enforcement requires attack-technique, ATT&CK technique ID, offensive-tool, or populated finding-record evidence, and high confidence requires a populated finding record (finding ID, severity, affected host) plus independent attack-path/TTP evidence.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS
Detects Redis patterns.
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects religious or philosophical belief information in person-linked membership, patient, workforce, census, pastoral-care, and accommodation records. The detector recognises explicit belief, affiliation, observance, denomination, and structured religion-field terminology, then raises confidence only for person records and populated belief or accommodation statements. Religious or philosophical beliefs are protected under GDPR Article 9 and Australian anti-discrimination and privacy law. Topic-grade detector, low confidence by design.
- Type
- regex
- Confidence
- low
- Jurisdictions
- global, au, eu
- Regulations
- GDPR, Privacy Act 1988 (Cth), Fair Work Act 2009 (Cth)
- Frameworks
- ISO 27001, NIST CSF, SOC 2
Detects Replicate API tokens, which use a distinctive r8_ prefix followed by a fixed-length body of alphanumerics, underscores, and hyphens. A leaked token grants unauthorized, billed access to Replicate's hosted model inference API and any prompts, images, or data routed through it.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects references to reproductive and sexual-health data: pregnancy, abortion, contraception, fertility treatment, gender-affirming care and STI/HIV status. Washington's My Health My Data Act (and a wave of post-Dobbs state consumer-health-data laws) treat this as protected consumer health data. Topic-grade vocabulary detector.
- Type
- regex
- Confidence
- low
- Jurisdictions
- global, us
- Regulations
- HIPAA, GDPR
- Frameworks
- ISO 27001, NIST CSF, SOC 2
Detects populated residential tenancy agreements (including Queensland Form 18a general tenancy agreements): the tenancy-agreement phrase combined with named tenant/lessor fields, a numbered premises address, a stated rent or bond amount, or a bond number. Phrase-only mentions stay discovery-only.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Residential Tenancies and Rooming Accommodation Act 2008 (Qld), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Identifies populated risk registers, risk matrices and enterprise risk reports: risk IDs, rated likelihood/consequence/residual values and named risk owners. Titles alone are discovery-only.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Financial Accountability Act 2009 (Qld)
- Frameworks
- DISP, ISO 27001, NIST CSF
Detects PKCS#1 RSA private-key armor. A BEGIN line is discovery-only, the first DER-like Base64 line supports medium confidence, and several normally wrapped body lines near the header support high confidence.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects RubyGems.org API keys (rubygems_ prefix), used to push gems. A leaked key lets an attacker publish or yank gems under the owner's account.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Identifies substantive SCADA and industrial-control-system documentation, including SCADA/ICS/OT network diagrams and topologies. Topic phrases are retained for discovery; enforcement requires point, tag, I/O, alarm, HMI, RTU, protocol-map, polling, or control-logic configuration content, or OT network-diagram structure (IP schema / addressing tables, PLC/RTU lists, Purdue levels, zones and conduits, control zones, trust boundaries, field networks), and high confidence also requires a populated asset, node, address, subnet, VLAN, register, or outstation detail.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF
SCADA and telemetry point lists and register maps for a live system: Modbus register maps (rows pairing an address with a holding register, input register, coil or discrete input type, plus function codes), DNP3 Device Profile XML data-point lists (binaryInputPoints / analogInputPoints with populated index and name), and OPC UA NodeId lists (ns=n;i= / s= / g= / b= identifiers). Enforcement requires repetition of the row or point structure so tutorials and specifications that show one or two examples do not fire.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth), Directive (EU) 2022/2555 (NIS2)
- Frameworks
- IEC 62443, NIST CSF, AESCSF
Detects populated security audit and assurance reports (SOC 2 Type I/II, ISO/IEC 27001 audits, SSAE 18, IRAP and security control assessments) that carry finding/exception references, severity ratings, technical evidence (hosts, IPs, CVEs) or audit scope details. Phrase-only mentions stay discovery-only.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, NIST CSF, PCI-DSS
Detects references to Australian Government security clearances and personnel vetting status.
- Type
- keyword_list
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- 2006 MOU National Security, Criminal Code Act 1995 (Cth)
- Frameworks
- PSPF, QGISCF
Detects populated cyber security incident reports: incident report / post-incident review titles together with incident record fields (incident ID, severity, detection time, affected hosts, source IPs) or technical artefacts (IPv4 addresses, CVE identifiers).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- CIS Controls, DISP, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects SendGrid (Twilio SendGrid) API keys, formatted as SG. then a 22-character key id, a dot, and a 43-character secret. A leaked key allows sending email and reading account data through the SendGrid API.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects Sentry auth tokens: organization tokens (sntrys_), user auth tokens (sntryu_), the user-app and internal-integration prefixes from Sentry's own token-type source (sntrya_, sntryi_), and, when labelled with Sentry context in an assignment, the legacy unprefixed 64-hex tokens issued before prefixing. A leaked token grants API access to error and performance data -- which routinely embeds further secrets, PII, and source context -- and to release/CI operations. Sentry DSNs are explicitly NOT matched: Sentry documents DSNs as safe to keep public.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects high-value session cookies by name-plus-value: framework and SSO session cookies (ESTSAUTH / ESTSAUTHPERSISTENT, JSESSIONID, PHPSESSID, connect.sid, _session_id, sessionid) assigned a long token value. A captured session cookie lets an attacker resume an authenticated session and bypass MFA entirely. Bare assignments are discovery-only; HTTP cookie framing and response attributes provide the enforcement tiers.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects sexual-orientation information in person-linked workforce, patient, survey, member, relationship, intake, and case records. The detector recognises the explicit sexual orientation phrase, orientation-specific identification statements, coming-out statements, and same-sex partner or spouse references, then raises confidence only for person records and populated attributions. It deliberately excludes transgender status, gender identity, and pronouns because those are distinct attributes. Sexual orientation is protected under GDPR Article 9 and Australian anti-discrimination and privacy law. Topic-grade detector, low confidence by design.
- Type
- regex
- Confidence
- low
- Jurisdictions
- global, au, eu
- Regulations
- GDPR, Privacy Act 1988 (Cth), Sex Discrimination Act 1984 (Cth)
- Frameworks
- ISO 27001, NIST CSF, SOC 2
Operational inventories and records for two regulated insulating substances in electrical plant: sulphur hexafluoride (SF6) in gas-insulated switchgear and circuit breakers (stock held in equipment, top-up, leakage and recovery quantities in kg, as reported under Australian NGER Regulations reg 4.16 and Measurement Determination Part 4.5), and polychlorinated biphenyls (PCBs) in transformers and capacitors (oil test results in mg/kg classed as scheduled PCB material at or above 50 mg/kg, non-scheduled, or PCB-free at or below 2 mg/kg under the ANZECC PCB Management Plan; notifiable quantities above 10 kg). Records carry asset or serial numbers, substation / site locations and measured quantities. The PCB Management Plan, IChEMS advice, NGER Determination text and vendor guidance are decoys.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global, au
- Regulations
- National Greenhouse and Energy Reporting Regulations 2008 (Cth), National Greenhouse and Energy Reporting (Measurement) Determination 2008 (Cth) Part 4.5, ANZECC Polychlorinated Biphenyls Management Plan (Revised Edition April 2003), Environmental Protection Act 1994 (Qld)
- Frameworks
- QGISCF, ISO 14001
Detects the Shopify access-token family: Admin API access tokens (shpat_), custom app access tokens (shpca_), legacy private app passwords (shppa_) and app shared secrets (shpss_), each followed by a 32-character hex body. A leaked token grants API access to a Shopify store, including customers, orders and payment-adjacent data.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
SIM / USIM personalisation and key files exchanged between SIM vendors, mobile network operators and HSS/AuC provisioning: a header row naming subscriber key columns (Ki, OPc, ADM1, KIC1/KID1/KIK1, EKI) next to ICCID or IMSI, followed by populated rows that pair an ICCID (ITU-T E.118, MII 89, e.g. Australian issuer prefixes 8961 and 8967210 on the ACMA register) and an IMSI (3GPP TS 23.003, MCC + MNC + MSIN, at most 15 digits; Australia MCC 505) with 128-bit key values (32 hex characters, per 3GPP TS 35.206 K and OPc). The file layout is vendor-proprietary; the pySim card-key CSV and pysim-perso column sets are used only as shapes. Excludes the published 3GPP TS 35.208 test-set values, "Test Set" / "35.208" text, test networks (MCC 001) and pySim / Open5GS tutorial or documentation text.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- GDPR, Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF
Plant-specific process safety engineering records: HAZOP (hazard and operability) study worksheets with node / guide word / deviation / causes / consequences / safeguards / recommendations columns, and safety instrumented system (SIS) cause and effect matrices and safety requirements with trip tags, voting (1oo2, 2oo3) and SIL ratings. Populated worksheets and matrices tie instrument tags and trip logic to a real facility, which is why enforcement needs populated tags and structure, not the methodology vocabulary that appears in standards, training and textbooks.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth), Work Health and Safety Regulation 2011 (Qld)
- Frameworks
- IEC 61511, IEC 61882, ISA-5.1
Detects Slack Token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Snowflake OAuth access and refresh tokens, which carry the recognizable ver:1-hint: / ver:2-hint: prefix used by Snowflake authentication. These tokens (and programmatic access tokens used in their place) grant query and data access to a Snowflake account.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects Solana public wallet/account addresses: the base58 encoding of a 32-byte ed25519 public key, 32-44 characters long, with NO distinctive prefix. Because a prefix-less base58 run of this length collides heavily with random tokens, other base58 identifiers and prose, detection is context-gated: the single tier is AND-gated by cryptocurrency/wallet domain context and a template/sample noise exclusion. Length/charset bounds verified against the Solana account model (32-byte address displayed as a base58 string) and the base58 alphabet (excludes 0 O I l).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
- Frameworks
- ISO 27001, ISO 27701, SOC 2, FATF Recommendations
Detects Sarbanes-Oxley (SOX) and COSO internal control framework compliance documents.
- Type
- keyword_list
- Confidence
- medium
- Jurisdictions
- us
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects SQL Server patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Topic partial
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects Square credential formats: application secrets (sq0csp-, with sandbox- prefixed sandbox variants), legacy personal access tokens (sq0atp-), and current OAuth/personal access tokens (EAAA + 60-character body, context-gated on a nearby Square label because the EAAA base64 shape also occurs in non-Square tokens and encoded blobs). A leaked token or secret enables payment processing and transaction data access in the associated Square account.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects populated internal strategic plans, product/technology roadmaps and business cases: the plan/roadmap/business-case phrase combined with document-control fields, dated roadmap milestones or financial targets. Public strategy statements and phrase-only mentions stay discovery-only.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, NIST CSF, PCI-DSS
Detects Stripe Key patterns.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects subscription agreements, recurring billing terms, and SaaS licence documentation.
- Type
- keyword_list
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects Supabase credentials: personal access tokens (sbp_), the new opaque secret API keys (sb_secret_) introduced in 2025 to replace the legacy service_role JWT, and, when labelled with Supabase context in an assignment, the legacy anon/service_role JWT keys that remain valid until late 2026. A leaked secret key or service_role JWT grants full admin access to the project's production Postgres database, bypassing Row Level Security; a leaked personal access token grants account-wide Management API control.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects Surgical Procedures patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- global
- Regulations
- GDPR, HIPAA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Swift Bic patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- PSD2
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects technical design documents, system architecture specifications, and API documentation.
- Type
- keyword_list
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth)
- Frameworks
- CIS Controls, DISP, ISO 27001, NIST CSF, SOC 2
Detects Telegram Bot API tokens: the numeric bot ID, a colon, and a 35-character [A-Za-z0-9_-] secret. A leaked bot token grants full control of the bot -- reading its message traffic, sending messages to every chat it belongs to, and hijacking any workflow automation built on it.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects HashiCorp Terraform Cloud / Terraform Enterprise API tokens (atlasv1 format). These tokens authenticate to the Terraform Cloud API and can read/write workspace state and variables; a leak can expose all infrastructure secrets.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Computer Fraud and Abuse Act, Computer Misuse Act 1990
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Identifies personal records that link a person to previous legal names or aliases (former, maiden, birth or assumed names, deed-poll name changes, also-known-as entries) with populated identity fields.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27701
Identifies documents containing references to place of birth in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to citizenship status in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to biometric identifiers in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to handwritten signatures in Australian contexts. This remains a concept detector over manual/wet/ink/specimen signature wording — it does not inspect handwriting pixels or capture a signature image. Bare "signed by" attribution (common in electronic/typed signature text) is corroborating evidence only, not a primary indicator.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to marital status in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to gender or sex marker in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to disability status in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to genetic data in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies records about a deceased person that carry cultural-sensitivity handling requirements (for example Aboriginal and Torres Strait Islander name and image restrictions): a deceased-person record with populated person fields and explicit cultural-protocol evidence.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to national identity number in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to voter registration number in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to birth certificate number in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR, Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to death certificate number in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR, Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to marriage certificate number in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR, Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to military service number in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to immigration file number in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to visa grant number in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to residence permit number in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to refugee or asylum case number in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to police identity number in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to prisoner identification number in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to firearm license number in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to professional license number in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to social benefits claimant number in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701, IEC 62443
Identifies documents containing references to home address in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to mailing address in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to personal phone number in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations. Phrase-level concept detector: it matches contact-number wording, not telephone digits. Enforcing tiers require a personal/home qualifier (personal phone number, home phone, personal mobile, call-back number, phone contact). Bare mobile/cell/telephone/contact/SMS/direct-dial labels without that qualifier are discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to personal email address in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations. Phrase-level concept detector: it matches email-label wording, not populated mailbox addresses; generic email/contact/correspondence labels without a personal or private qualifier are discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to work email address in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to emergency contact details in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to real-time geolocation in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to historical location trails in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to travel itinerary details in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to vehicle registration details in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to device imei numbers in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations. Detection is phrase-level concept matching anchored on explicit IMEI, TAC, and equipment-identity vocabulary; it does not parse or Luhn-validate 15-digit IMEI values.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- CIS Controls, DISP, ISO 27001, NIST CSF, SOC 2
Identifies documents containing references to sim card identifiers in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to mac addresses linked to users in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- CIS Controls, DISP, ISO 27001, NIST CSF, SOC 2
Identifies documents containing references to home utility account addresses in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to household composition details in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to building access badge location logs in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to hotel booking details in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to frequent traveler numbers in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to border crossing history in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to commuting pattern data in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects individual employment contracts, contracts of employment and letters of offer for a named or numbered employee, with commencement, remuneration or classification terms.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Fair Work Act 2009 (Cth), Fair Work Regulations 2009 (Cth), Industrial Relations Act 2016 (Qld), Public Sector Act 2022 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects performance reviews, appraisals, performance and development agreements and performance improvement plans for an identified employee, with a rating, review period or review date.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Fair Work Act 2009 (Cth), Public Sector Act 2022 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects disciplinary records about an identified employee: written, formal or final warnings, disciplinary findings and outcomes, and show cause notices (including Queensland public sector notices under Public Sector Act 2022 s 91 and Discipline Directive 05/23) with allegations, particulars, the disciplinary ground or response dates.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Fair Work Act 2009 (Cth), Public Sector Act 2022 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects employee grievance and workplace complaint records (including bullying and harassment complaints) naming a complainant, respondent or employee, with lodgement or incident dates, a reference number or a finding.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Fair Work Act 2009 (Cth), Public Sector Act 2022 (Qld), Work Health and Safety Act 2011 (Qld), Sex Discrimination Act 1984 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies records that reveal a whistleblower's identity - public interest / protected disclosure intake and case records, whistleblower reports and discloser identity registers - when the disclosure phrase sits with populated discloser identifiers and disclosure case fields.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Public Interest Disclosure Act 2010 (Qld), Public Interest Disclosure Act 2013 (Cth), Corporations Act 2001 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to background check results in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects right-to-work and visa entitlement verification records for an identified employee or candidate: Visa Entitlement Verification Online (VEVO) check results and printouts, work entitlement checks and US Form I-9 records, carrying the holder plus visa fields such as the visa subclass, the 13-digit visa grant number, transaction reference number (TRN) or visa evidence number, grant / expiry / must-not-arrive-after dates, period of stay, and Migration Regulations 1994 Schedule 8 visa conditions (for example 8101, 8104, 8105, 8107, 8547, 8607, 8608).
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global, au
- Regulations
- Migration Act 1958 (Cth), Migration Regulations 1994 (Cth), Fair Work Act 2009 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects records of an identified employee's trade union membership or delegate status: payroll deduction authorities, membership numbers, join dates and dues. Union membership is sensitive information under the Privacy Act 1988 (Cth).
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Fair Work Act 2009 (Cth), Industrial Relations Act 2016 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects salary reviews, pay increases and compensation adjustment histories for an identified employee, with current/new salary amounts, percentage increases, classification/step or effective dates.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Fair Work Act 2009 (Cth), Fair Work Regulations 2009 (Cth), Industrial Relations Act 2016 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects bonus and incentive allocations (STI/LTI awards, bonus pool allocations, performance bonuses) for an identified employee or participant, with award amounts, percentage of base, scorecard results or payment dates.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Fair Work Act 2009 (Cth), Fair Work Regulations 2009 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to equity grant details in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects manager and supervisor notes, feedback and observations about an identified employee or direct report, with meeting dates, capability ratings, concerns raised or agreed actions.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Fair Work Act 2009 (Cth), Public Sector Act 2022 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects psychometric, personality, aptitude and cognitive-ability assessment results for an identified candidate or employee: a named candidate/applicant with scores, percentiles, sten values, trait ratings or a suitability recommendation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), Anti-Discrimination Act 1991 (Qld), Public Sector Act 2022 (Qld), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects interview evaluations, panel notes, candidate assessments and selection reports (including Queensland public sector selection reports under Recruitment and Selection Directive 07/23) for an identified candidate or applicant, with scores, recommendations or interview dates.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Public Sector Act 2022 (Qld), Fair Work Act 2009 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects succession plans, succession registers and talent reviews that name incumbents, successors or employees, with readiness, flight-risk or potential ratings or target critical roles.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Fair Work Act 2009 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects reduction-in-force and redundancy selection lists, voluntary separation offers and employees-requiring-placement records that name employees, with separation dates, redundancy or severance amounts, years of service or placement status.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Fair Work Act 2009 (Cth), Fair Work Regulations 2009 (Cth), Industrial Relations Act 2016 (Qld), Public Sector Act 2022 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects timesheets, time and attendance records and Queensland time and wages records for an identified employee, with shift start/finish times, ordinary or overtime hours, or pay period dates.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Fair Work Act 2009 (Cth), Fair Work Regulations 2009 (Cth), Industrial Relations Act 2016 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects leave applications, leave requests and absence records for an identified employee (annual, sick/personal, carer's, compassionate, parental, long service leave, leave without pay), with leave type, dates, hours/days taken or balances.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic partial
- Jurisdictions
- global
- Regulations
- Fair Work Act 2009 (Cth), Fair Work Regulations 2009 (Cth), Industrial Relations Act 2016 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to workplace investigation files in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects exit interview, exit survey and separation interview records for an identified departing employee, with reasons for leaving, last day or resignation date, rehire eligibility or satisfaction scores.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Fair Work Act 2009 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects employee payroll bank account details: a payroll/salary account or direct-deposit phrase combined with a BSB, a bank account number or a named employee/payee field. Phrase-only mentions (policies, scam warnings) stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Fair Work Act 2009 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects completed employee tax withholding declarations and elections: ATO Tax file number declaration (NAT 3092) and withholding declaration (NAT 3093), US Form W-4 and UK starter checklist, with the payee identified and a TFN/SSN, residency or tax-free threshold answer, filing status or payer ABN.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Taxation Administration Act 1953 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects completed employer payroll tax and withholding filings: Queensland (state) payroll tax returns and annual reconciliations, PAYG withholding annual reports, Single Touch Payroll pay events/finalisation summaries and US Form 941/940 returns, with populated wage/withholding totals and an employer identifier or reporting period.
- Type
- regex
- Confidence
- low
- Detection quality
- Topic false positive
- Jurisdictions
- au, global
- Regulations
- Taxation Administration Act 1953 (Cth), Payroll Tax Act 1971 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Detects completed employee tax and superannuation forms: PAYG payment summaries and employee income statements, superannuation standard choice form (NAT 13080), US Form W-2 and UK P60/P45, with the payee identified and TFN/SSN, gross payments or tax withheld amounts, USI/member number, payer ABN or financial year.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Taxation Administration Act 1953 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects completed contractor tax forms and reports: ATO taxable payments annual report (TPAR) rows, PAYG withholding voluntary agreements, statements by a supplier (no-ABN withholding), US Form 1099-NEC/W-9 and contractor payment statements, with a named payee plus payment amounts or ABN.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- au, global
- Regulations
- Taxation Administration Act 1953 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Detects payroll deduction records for an identified employee: deduction authorisations, salary sacrifice agreements, union fee, child support, health fund, workplace giving and novated lease deductions, with the deduction amount.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- au, global
- Regulations
- Fair Work Act 2009 (Cth), Fair Work Regulations 2009 (Cth), Industrial Relations Act 2016 (Qld), Taxation Administration Act 1953 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Detects wage garnishee notices and earnings attachment orders served on an employer for an identified employee: ATO garnishee notices (TAA 1953 Sch 1 s 260-5), Services Australia child support and debt garnishee notices, court attachment of earnings / income withholding orders, with the amount owing or amount to deduct.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- au, global
- Regulations
- Taxation Administration Act 1953 (Cth), Child Support (Registration and Collection) Act 1988 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Detects superannuation / retirement contribution records for an identified employee or member: SG and salary sacrifice contribution reports, SuperStream contribution files, employer pension contribution schedules and 401(k) contribution records, with contribution amounts.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- au, global
- Regulations
- Superannuation Guarantee (Administration) Act 1992 (Cth), Fair Work Regulations 2009 (Cth), Industrial Relations Act 2016 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Detects pension, annuity and retirement income stream account identifiers: a labelled pension/annuity/policy/member number with a populated value, optionally with the account holder name or date of birth.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Superannuation Industry (Supervision) Act 1993 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects dependant-related tax credit and family benefit claims for an identified person: Family Tax Benefit claims, dependant (invalid and carer) tax offset claims, US child tax credit / Schedule 8812, with dependant names or dates of birth, number of children or claimed amounts.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- au, global
- Regulations
- A New Tax System (Family Assistance) Act 1999 (Cth), Taxation Administration Act 1953 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Detects employee childcare benefit claims processed through payroll: childcare salary packaging and reimbursement claims, employer-sponsored childcare applications and dependent care FSA reimbursements, with the child or provider details and claimed amounts.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- au, global
- Regulations
- Fringe Benefits Tax Assessment Act 1986 (Cth), A New Tax System (Family Assistance) Act 1999 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Detects employee expense reimbursement claims: expense claim forms, travel claims and acquittals, mileage and per diem claims and corporate card acquittals for an identified claimant, with itemised or total amounts.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Fringe Benefits Tax Assessment Act 1986 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects payroll journal postings: pay-run journals, wages journals, payroll accruals and payroll GL exports with populated ledger lines (wages expense, PAYG withholding payable, superannuation payable, net wages payable, payroll clearing) and a journal reference or posting/period date. Aggregate ledger data, capped at 75.
- Type
- regex
- Confidence
- low
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Taxation Administration Act 1953 (Cth), Superannuation Guarantee (Administration) Act 1992 (Cth), Fair Work Regulations 2009 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects correspondence from a tax authority to an identified taxpayer: ATO notices of (amended) assessment, audit and review letters, QRO notices, IRS CP notices and HMRC letters, with taxpayer identifiers and amounts payable, penalties or response dates.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- au, global
- Regulations
- Taxation Administration Act 1953 (Cth), Taxation Administration Act 2001 (Qld), Privacy (Tax File Number) Rule 2015 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Detects payroll exception and variance reports that list identified employees: pay run exception reports, payroll variance/error reports and pre-pay-run validation reports with the exception reason or pay amounts.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Fair Work Act 2009 (Cth), Fair Work Regulations 2009 (Cth), Industrial Relations Act 2016 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Australian superannuation identifiers with populated values: USI (unique superannuation identifier), fund member/account numbers, fund or SMSF ABN and SMSF electronic service address (ESA), optionally with the member or employee name.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- au
- Regulations
- Superannuation Guarantee (Administration) Act 1992 (Cth), Superannuation Industry (Supervision) Act 1993 (Cth), Taxation Administration Act 1953 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Detects salary and wage overpayment recovery records for an identified employee: overpayment notifications, recovery letters and repayment agreements, with the overpaid amount, repayment instalments or overpayment period.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- au, global
- Regulations
- Fair Work Act 2009 (Cth), Industrial Relations Act 2016 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Detects off-cycle and ad hoc payroll payment requests and approvals for an identified employee: off-cycle pay requests, manual/special pay runs, final pay and termination pay calculations, with payment amounts or payment date.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- au, global
- Regulations
- Fair Work Act 2009 (Cth), Fair Work Regulations 2009 (Cth), Industrial Relations Act 2016 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Detects compensation arrears and back-pay records for an identified employee: salary/wage arrears calculations, back-pay schedules, underpayment remediation calculations and retrospective pay increases, with arrears amounts or arrears periods.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- au, global
- Regulations
- Fair Work Act 2009 (Cth), Fair Work Regulations 2009 (Cth), Industrial Relations Act 2016 (Qld), Superannuation Guarantee (Administration) Act 1992 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Detects exported payroll system access and audit logs: timestamped log lines showing a user logging in, viewing, changing or exporting payroll records, with a populated user field. Operational security data, capped at 75.
- Type
- regex
- Confidence
- low
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISM, PSPF
Detects references to consumer bank account numbers in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GLBA
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to bank routing numbers in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to IBAN and international bank account number topics in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation. Topic-level phrase detection only; it does not parse or mod-97-validate IBAN values.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to SWIFT or BIC codes in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation. Phrase-level payment-rail concept detection anchored on explicit SWIFT/BIC vocabulary; it does not parse 8- or 11-character BIC values.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to payment card primary account numbers in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to card verification values in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation. Phrase-level concept detection anchored on explicit card-verification vocabulary; it does not parse 3- or 4-digit CVV values.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to card expiration dates in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation. Phrase-level concept detection anchored on card-specific expiry vocabulary; it does not parse MM/YY or month-year values.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to cardholder names linked to accounts in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to mobile payment account ids in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to merchant acquiring credentials in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- GDPR, Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS
Detects references to direct debit mandate data in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to ach company and originator ids in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to remittance instructions in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS
Detects references to card dispute case records in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to wire transfer instructions in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS
Detects references to escrow account details in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to treasury cash position reports in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to cash flow forecast assumptions in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to payment fraud investigation files in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS
Detects references to credit bureau reports in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects references to credit scores in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects references to loan application files in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to mortgage underwriting packets in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to collateral valuation reports in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to debt collection records in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects references to bankruptcy case records in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to insurance policy records in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects references to insurance claim records in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to underwriting decision rationales in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects references to know-your-customer profiles in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects references to anti-money-laundering alerts in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects references to suspicious activity reports in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects references to sanctions screening matches in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to beneficial ownership declarations in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects references to guarantor identity and financial data in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to loan covenant compliance records in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to reinsurance contract terms in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects references to premium payment histories in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects references to claim settlement negotiation notes in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Identifies documents containing references to vendor master records in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects supplier/vendor bank detail change requests - the payment-redirection pattern behind business email compromise: a bank-detail change phrase combined with a BSB, a bank account number, a named supplier/payee or a vendor number/ABN. Phrase-only mentions (scam warnings, AP procedures) stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to purchase order records in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to bid and tender proposals in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to contracted pricing schedules in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to supplier invoice records in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to tax exemption certificates in international contexts. These are tax-compliance certificates that may contain entity or individual identifiers; the category is not blanket personally identifiable information.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to third-party risk assessments in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to supplier due diligence reports in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to customs declaration data in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to bills of lading in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to shipping manifest details in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to inventory valuation reports in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to bill-of-materials cost data in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to service-level penalty records in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic partial
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to rebate agreement terms in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to channel partner margin agreements in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to procurement fraud investigation files in international contexts. These are investigative and procurement-sensitive records that may contain personal allegations; the category is not blanket personally identifiable information.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth)
- Frameworks
- ISO 27001
Identifies documents containing references to sole-source justification memos in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to supplier performance scorecards in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to board meeting minutes in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to committee meeting minutes in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies legal advice memoranda, legal opinions and privileged lawyer-client communications (legal professional privilege / client legal privilege, solicitor-client or attorney-client privilege, privilege logs). These are privileged or confidential legal advice records; the category is not personally identifiable information, and a match does not prove that privilege attaches. Absorbed global-top500-164-attorney-client-privileged-communications (2026-09-24).
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies substantive responses and submissions addressing regulatory, supervisory, prudential, or compliance examinations and findings. Topic phrases are retained for discovery; enforcement requires response, finding, root-cause, remediation, ownership, due-date, evidence, dispute, or control-gap content, and high confidence also requires a formal examination/finding reference or response due date.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001
Identifies antitrust / competition-law legal analyses prepared as memos or advice: competition-law topic phrases inside a populated legal document header, with competition-specific analysis evidence at the high tier. These are commercially and legally sensitive analyses; the category is not personally identifiable information.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Competition and Consumer Act 2010 (Cth)
- Frameworks
- ISO 27001
Identifies documents containing references to ethics hotline case records in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to policy violation findings in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to internal audit workpapers in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to sox control deficiency records in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to internal control exception logs in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to policy exception approvals in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to breach notification draft communications in international contexts. Sensitive pre-release breach communications may contain personal-impact data — incident scope, affected individuals and groups, regulator engagement, and unverified legal conclusions; the matched phrases are not themselves personally identifiable information.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to license and royalty agreements in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to non-disclosure agreement repositories in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to corporate records under seal in international contexts. This content represents formal corporate records and under-seal documentation (sealed records, company and common seals, statutory registers); it is not inherently personally identifiable information.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to m&a target lists in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to letters of intent in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to data room due diligence documents in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to valuation models in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to synergy realization plans in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to post-merger integration plans in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, NIST CSF, PCI-DSS
Identifies documents containing references to divestiture strategy documents in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to restructuring plans in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to strategic roadmap documents in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to market entry strategy papers in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies competitive intelligence reports: competitor analysis / comparison documents with populated competitor fields (competitor, product, pricing, market share, win rate, key accounts). This is commercial information, not personally identifiable information.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Competition and Consumer Act 2010 (Cth), Corporations Act 2001 (Cth)
- Frameworks
- ISO 27001
Identifies documents containing references to pricing strategy models in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects customer profitability analyses: a customer profitability / cost-to-serve / customer lifetime value phrase combined with populated per-customer data - rows keyed by a customer identifier, labelled margin/profit/revenue values or labelled customer identifiers. Phrase-only mentions stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to product sunset plans in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to nonpublic investor presentations in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to earnings guidance drafts in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to capital allocation strategy documents in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to fundraising term sheets in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies board and adviser plans for defending against shareholder activists or hostile bids (activist defence, proxy fight, poison pill, takeover defence, white knight) prepared as populated board papers or memos. Commercial and legal information, not personally identifiable information.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Corporations Act 2001 (Cth)
- Frameworks
- ISO 27001
Identifies documents containing references to scenario planning models in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to proprietary algorithm designs in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to chemical formulas in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to manufacturing process tolerances in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to prototype engineering designs in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to patent draft claims in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to patentability assessments in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to trademark strategy analyses in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies inventories and registers of trade-secret assets — register, inventory-entry, and asset-record structures as well as the topic label — in security and access control contexts. Detects potential exposure of sensitive security information in Australian systems.
- Type
- regex
- Confidence
- low
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- CIS Controls, DISP, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects populated research laboratory notebook entries: a lab/research/electronic lab notebook or experiment-log phrase combined with a labelled experiment/entry/batch identifier or a named researcher/witness. Phrase-only mentions stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Patents Act 1990 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701
Detects unpublished research datasets: an unpublished / pre-publication / raw research data phrase combined with populated data rows keyed by a participant or sample identifier, or study metadata (study ID, HREC reference, protocol number, data custodian). Phrase-only mentions stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing circuit schematic or layout content in Australian contexts. Enforcement denotes actual schematic or layout artifacts (reference designators with pin/net/node/footprint relations, netlists, sheet numbers, EDA design files) — circuit-design topic language alone, i.e. the discipline of circuit design, is discovery-only. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to firmware internals in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to cryptographic implementation details in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to proprietary training datasets in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies pricing-engine implementation logic in Australian contexts: executable pricing rules, formulas, thresholds, and named pricing variables used to calculate prices or discounts. Topic-only pricing references (dynamic pricing, pricing model) remain discovery-level context and do not enforce.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to recommendation model logic in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies private bidding-model parameters rather than online-advertising vocabulary generally: named parameter assignments (bid floors, pacing multipliers, objective weights, budget caps) enforce, while auction and programmatic-advertising topic terms remain discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to source process know-how manuals in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies actionable design-process rules and constraints in Australian contexts: DR-numbered design rules carrying shall/must/prohibited/limit language. General design-guidance, engineering-standard, and intellectual-property topic references remain discovery-level context and do not enforce.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to unreleased product architecture in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to product requirement specifications in Australian contexts. Higher confidence identifies populated product requirement specifications (requirement identifiers with shall/acceptance/priority/owner/release fields, or user-story structures); generic quality, compliance, and specification vocabulary remains discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to unreleased feature specifications in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to defect backlog with customer impact in Australian contexts. Higher confidence identifies backlog records that connect product defects to concrete customer impact (BUG/DEFECT/ISSUE identifiers with affected customers/accounts, customer impact, workaround, severity, or release-target detail); defect and customer-impact vocabulary alone remains discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to pre-release test result datasets in Australian contexts. Higher confidence identifies datasets of executed tests for not-yet-released builds (result rows with pass/fail outcomes tied to a candidate, RC, or unreleased build identifier); general QA and testing vocabulary remains discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to reliability and failure analysis in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to safety certification evidence in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to quality nonconformance reports in Australian contexts. Higher confidence identifies nonconformance records (NCR/NC/DEV identifiers with affected-item, observed-condition, disposition, owner, or closure detail) or the explicit nonconformance-report label; standalone corrective/preventive-action and quality-audit vocabulary remains discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to product recall decision files in Australian contexts. Higher confidence identifies internal files used to decide or authorise a recall (decision, recommendation, risk-benefit, affected-lot, approval, or unresolved-action evidence); public recall notices and generic recall vocabulary remain discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Telecommunications (Interception and Access) Act 1979 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to supplier quality audit findings in Australian contexts. Higher confidence identifies populated supplier quality audit findings (finding/observation/NC identifiers with supplier context and severity, clause, evidence, or corrective-action detail) rather than audit administration; supplier-audit vocabulary alone remains discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies populated serial/batch/lot traceability records in Australian contexts: a labelled non-placeholder identifier together with a manufacturing, movement, parent-child, or custody relationship. Covers single-item and batch records; bare serial-number field mentions remain discovery-level context only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to calibration records in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to design verification plans in Australian contexts. Higher confidence identifies plans for future design verification activities (planned verification items with test IDs, methods, requirement traces, acceptance criteria, owners, or schedules); design-review and compliance-testing vocabulary alone remains discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to design validation reports in Australian contexts. Higher confidence denotes reports of performed design validation (executed tests with observed results, pass/fail outcomes, deviations, conclusions, or approval), not plans or protocols; validation/review/protocol vocabulary alone remains discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to field failure investigation reports in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to root-cause corrective action plans in Australian contexts. Higher confidence identifies populated plans linking an analysed root cause to assigned corrective work (owner, due date, containment, or effectiveness verification); standalone RCA/CAPA topic terms remain discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to warranty claim analytics in Australian contexts. Higher confidence identifies analysis of warranty populations (aggregate rates, counts, costs, or trends broken down by period, cohort, model, region, or failure category), not individual claim records; warranty/claim vocabulary alone remains discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies records of management review of a quality management system in Australian contexts — management-review notes carrying review structure such as attendees, agenda/inputs, decisions, action items and owners, quality objectives, or recorded conclusions. ISO 9001/QMS topic language without that structure is discovery-only. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to manufacturing deviation records in Australian contexts. Higher confidence identifies records of actual manufacturing departures from requirement (deviation/OOS/NCR identifiers with affected batch or lot and expected-versus-actual, disposition, or approval detail); deviation and batch-record vocabulary alone remains discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to product hazard analyses in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to release approval records in Australian contexts. Higher confidence identifies actual approval or authorisation records for a release (release/batch/ build/version identifier with a decision and approver/date detail) or the explicit release-approval label; product-release and generic sign-off vocabulary alone remains discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies private source code repositories patterns in security and access control contexts. Detects potential exposure of sensitive security information in Australian systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- CIS Controls, DISP, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Identifies private code forks patterns in security and access control contexts. Detects potential exposure of sensitive security information in Australian systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- CIS Controls, DISP, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Identifies system architecture diagrams patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF
Identifies api interface specifications patterns in security and access control contexts. Detects potential exposure of sensitive security information in Australian systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- CIS Controls, DISP, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Identifies CI/CD pipeline configuration files (GitHub Actions workflows, GitLab CI, Azure Pipelines, Jenkinsfiles, Bitbucket/CodeBuild/CircleCI configs) containing pipeline syntax, secret references or internal build/registry hosts. Pipeline topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- ISO 27001, NIST CSF, CIS Controls
Identifies Kubernetes/Helm/Compose deployment manifests with populated resource definitions: apiVersion/kind, container image and pod spec keys, namespaces or internal hosts. Manifest wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- ISO 27001, NIST CSF, CIS Controls
Identifies infrastructure-as-code files (Terraform, CloudFormation, ARM/Bicep, Ansible) with populated resource, provider, task or network definitions. IaC wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- ISO 27001, NIST CSF, CIS Controls
Identifies dependency / software composition analysis (SCA) vulnerability reports - npm/pip audit, Snyk, Dependabot, OWASP Dependency-Check, Trivy/Grype - with package coordinates, advisory IDs and installed/fixed versions. General vulnerability assessment reports are covered by global-vulnerability-assessment-report.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- ISO 27001, NIST CSF, CIS Controls
Identifies static application security testing (SAST) findings and exports - Semgrep, CodeQL, Checkmarx, Fortify, Veracode, SonarQube, Coverity, Bandit - with source file/line locations, rule or CWE IDs and severities.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- ISO 27001, NIST CSF, CIS Controls
Identifies dynamic application security testing (DAST) findings and scanner reports - OWASP ZAP, Burp Suite, Acunetix/Invicti, AppScan, WebInspect - with tested endpoints, parameters/payloads and alert IDs. Penetration test reports are covered by global-top500-252-penetration-testing-reports.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- ISO 27001, NIST CSF, CIS Controls
Identifies populated threat model documents (STRIDE, PASTA, attack trees) that enumerate threats against a named system: threat IDs, STRIDE category rows and trust-boundary / data-flow elements. "STRIDE" is only recognised in threat-model context, not as the English word "stride".
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Identifies penetration testing reports patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF
Identifies bug bounty and vulnerability disclosure programme (VDP) submissions - HackerOne, Bugcrowd, Intigriti, YesWeHack reports and researcher submissions - with report IDs, reproduction steps, affected endpoints and triage/bounty fields. General vulnerability reports are covered by global-vulnerability-assessment-report.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Identifies incident postmortems and post-incident reviews with populated incident detail: timestamped timeline entries, incident/problem references, impact metrics or affected hosts. Generic "timeline", "root cause" and "lessons learned" wording no longer matches.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Identifies operational, maintenance and on-call runbooks, operations manuals and troubleshooting guides containing numbered steps, shell/admin commands or internal hosts. Titles alone are discovery-only. Substantially overlaps global-it-runbook-playbook (same structures); candidate for merge.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Identifies environment and application configuration files (.env, appsettings.json, application.properties/yml, web.config) with populated configuration: environment variable assignments, connection/host values or config sections. Secret values themselves are handled by the credential classifiers.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- ISO 27001, NIST CSF, CIS Controls
Identifies feature flag configurations patterns in security and access control contexts. Detects potential exposure of sensitive security information in Australian systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- CIS Controls, DISP, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Identifies telemetry schemas patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF
Identifies maps or inventories that trace personal-data movement between systems — populated source-to-destination flow edges naming personal-data categories. PII-processing topic language (privacy notices, data-processing prose) without flow/lineage structure is discovery-only. This is privacy architecture / data-lineage content, not credential material.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- NDB Scheme (Cth), GDPR
- Frameworks
- CIS Controls, DISP, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Identifies plaintext passwords patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
- Type
- regex
- Confidence
- low
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR, Criminal Code Act 1995 (Cth), NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth)
Identifies password hash databases patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
- Type
- regex
- Confidence
- low
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR, Criminal Code Act 1995 (Cth), NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth)
Detects password reset tokens and recovery URLs in documents, emails, and logs. Reset tokens are high-risk credentials — a leaked token enables account takeover without knowing the current password. No Microsoft built-in SIT exists for this pattern.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- CCPA/CPRA, HIPAA
- Frameworks
- ISO 27001, NIST CSF, SOC 2, PCI-DSS
Identifies multi-factor authentication seeds patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR, Criminal Code Act 1995 (Cth), NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth)
Identifies one-time recovery codes patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR, Criminal Code Act 1995 (Cth), NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth)
Identifies oauth client secrets patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR, Criminal Code Act 1995 (Cth), NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth)
Identifies session cookies patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR, Criminal Code Act 1995 (Cth), NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth)
Identifies hsm key management metadata patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF
Identifies key-recovery and escrow references, while reserving enforcement for records that contain a structured recovery value. A phrase alone is discovery-only; system identity and custody/escrow fields distinguish a high-confidence recovery-material record.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Identifies references to secrets-vault exports and backups. Product or operation phrases are discovery-only; structured export-record fields support medium confidence and a populated secret entry plus export-manifest metadata supports high.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies database connection strings with credentials patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR, Criminal Code Act 1995 (Cth), NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth)
Identifies kerberos ticket-granting artifacts patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR, Criminal Code Act 1995 (Cth), NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth)
Identifies SIEM event data and exports - Splunk, Microsoft Sentinel, QRadar, Elastic Security alerts, notable events and security event logs - containing event IDs, security log fields, CEF/LEEF/syslog records or host addresses. These records typically contain personal information (usernames, IPs).
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), GDPR, Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, NIST CSF, CIS Controls
Identifies endpoint detection telemetry patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF
Identifies intrusion detection alerts patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF
Identifies firewall rule configurations patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF
Identifies sensitive network topology diagrams patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF
Identifies patch and vulnerability exception records (deferrals, waivers, exemptions) that name affected assets, deferred patches/CVEs, expiry dates or approvers. Generic risk register, asset owner and remediation plan wording no longer matches.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- Essential Eight, ISO 27001, NIST CSF
Detects populated indicator-of-compromise lists and packages: IOC wording together with concrete indicator values such as file hashes, C2 domains or IPs, defanged URLs, mutexes or registry keys. The IOC phrase alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, NIST CSF, CIS Controls
Detects threat-intelligence subscription records - licence and account details, feed API keys, TAXII endpoints and collection IDs for commercial or community CTI feeds. Subscription wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Detects malware sample repository indexes and manifests: malware-sample wording with per-sample hashes, family names, file types, storage paths or archive passwords. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Detects sandbox detonation reports: sandbox or dynamic-analysis report wording with populated behaviour fields (verdict, task ID, spawned processes, dropped files, registry keys, network requests) and host artefacts. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Detects phishing simulation result exports: simulation-result wording with per-user outcome rows (email plus clicked/submitted/reported) and numeric campaign metrics. Discussions of phishing simulations are discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, NIST CSF
Detects purple-team and adversary-emulation exercise plans that name ATT&CK techniques, targets, test windows, C2 infrastructure and expected detections. Exercise wording alone is discovery-only; tabletop exercises are out of scope.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Detects SOC analyst case notes: SOC case or analyst-notes wording with populated case fields (IDs, severity, affected host/user, disposition) and technical artefacts. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Detects incident timelines: timeline or chronology wording with timestamped entries and host, user or evidence-source artefacts. Timeline wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Detects forensic disk-image acquisition records: image or acquisition-log wording with evidence/exhibit numbers, examiner, device serials, image file names and verification hashes. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, NIST CSF
Detects volatile memory capture records and analysis output: memory-capture wording with capture metadata, memory image file names, Volatility plugin output and addresses. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, NIST CSF
Detects insider-threat investigation files: insider-risk or employee investigation wording with populated subject details (employee, position, case number, allegation) and user-activity evidence. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Fair Work Act 2009 (Cth), GDPR
- Frameworks
- ISO 27001, NIST CSF
Detects backup catalogs and job reports: backup catalog/index wording with populated job, client, media and retention fields plus barcodes, paths, sizes or hosts. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Detects business continuity plans and business impact analyses with populated recovery objectives (RTO/RPO/MTPD values), crisis contacts and alternate sites. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Detects failover and high-availability architecture details: failover/DR/HA architecture wording with populated node, VIP, site and listener fields plus internal IPs or hostnames. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Identifies capacity planning models patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF
Detects IT asset inventory records: asset register/inventory wording with populated asset tags, serial numbers, hostnames, MAC/IP addresses and owners. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, NIST CSF, CIS Controls
Detects CMDB relationship mappings: CMDB or dependency-map wording with relationship edges (ServiceNow relationship types or A -> B edges) and populated CI fields. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Identifies privileged account inventories patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF
Detects endpoint-management policy profiles: Intune/MDM/GPO profile wording with machine policy artefacts (OMA-URI, payload keys, policy registry paths, Graph types) and populated profile fields. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, NIST CSF, CIS Controls
Detects remote administration tool settings: RDP connection files, TeamViewer/AnyDesk configuration, sshd directives and populated gateway/jump-host/access-password fields. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth), Criminal Code Act 1995 (Cth)
- Frameworks
- ISO 27001, NIST CSF, CIS Controls
Detects DNS zone files: $ORIGIN/$TTL/SOA directives with resource record lines, especially internal zones with private addresses and internal hostnames. A directive alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Detects domain registrar credentials: registrar account or transfer-code wording with populated login, password, PIN, API key or EPP/auth code values for managed domains. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Detects SLA breach analysis reports: SLA breach or service-credit wording with measured metrics against targets and populated contract, incident and credit fields. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Competition and Consumer Act 2010 (Cth)
- Frameworks
- ISO 27001, SOC 2
Detects major outage root-cause analyses: RCA or post-incident review wording with populated outage fields and technical artefacts (incident/change numbers, hosts, timestamps). Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Identifies support ticket conversation transcripts in security and access control contexts. Enforcement requires timestamped requester/agent message turns; ticket, help-desk, and service-desk references without conversational structure remain discovery inventory.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), GDPR
- Frameworks
- CIS Controls, DISP, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects change management records: change request/CAB wording with populated change fields (owner, CI, planned window, risk, approval) and change artefacts. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Detects scheduled maintenance plans: maintenance-window wording with dated time windows and populated affected-system, downtime and change fields. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Detects configuration baseline snapshots: baseline/snapshot wording with actual device or OS configuration lines and populated snapshot metadata. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, NIST CSF, CIS Controls
Identifies service dependency maps patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF
Identifies treatment plan details references in healthcare and patient records. Protected health information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies patient medication histories - medication history, drug or prescription history, current medication lists, dispensing records and medication reconciliation - when the phrase sits with populated patient identifiers and medication lines (drug, dose and frequency). Protected health information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), NDB Scheme (Cth), My Health Records Act 2012 (Cth), Information Privacy Act 2009 (Qld), GDPR, HIPAA
- Frameworks
- ISO 27001, ISO 27701
Identifies patient pathology and laboratory result records - blood test and clinical chemistry results, laboratory reports, and histopathology, cytology or biopsy reports - by combining a pathology/laboratory report phrase with populated record structure (labelled patient identifiers, specimen fields, result lines with units and a reference range or H/L flag, and a reporting pathologist). Protected health information under applicable data protection regulations. The slug predates the merge of the former pathology reports classifier and is kept for stability.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies diagnostic imaging data references in healthcare and patient records. Protected health information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies clinician consultation notes references in healthcare and patient records. Protected health information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies substance use treatment records references in healthcare and patient records. Protected health information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies hiv status data references in healthcare and patient records. Protected health information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies individual immunisation / vaccination records - immunisation history statements, vaccination records and certificates, register extracts and vaccine administration entries - when the phrase sits with populated patient identifiers and vaccine administration fields. Health information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic partial
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), NDB Scheme (Cth), My Health Records Act 2012 (Cth), Information Privacy Act 2009 (Qld), GDPR, HIPAA
- Frameworks
- ISO 27001, ISO 27701
Identifies genomic testing results references in healthcare and patient records. Protected health information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies patient prior-authorisation / pre-approval records - authorisation requests, coverage determinations and utilisation or medical-necessity reviews for a named patient - when the phrase sits with populated patient identifiers and authorisation fields. Health and insurance information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), NDB Scheme (Cth), Information Privacy Act 2009 (Qld), GDPR, HIPAA
- Frameworks
- ISO 27001, ISO 27701
Identifies hospital billing records references in healthcare and patient records. Protected health information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Identifies healthcare provider identifier records - practitioner lists, credentialing files and directory extracts that carry labelled provider identifiers (Medicare provider number, prescriber number, HPI-I/HPI-O, Ahpra registration number, NPI, licence number) alongside practitioner and practice details. Format validation of each identifier is left to the dedicated identifier classifiers.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Healthcare Identifiers Act 2010 (Cth), Privacy Act 1988 (Cth), HIPAA, GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies clinical trial participant data references in healthcare and patient records. Protected health information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies adverse event reports references in healthcare and patient records. Protected health information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies informed consent forms references in healthcare and patient records. Protected health information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies individual student enrolment records - student enrolment/enrollment records and forms, enrolment verification or confirmation, student registration, admission and course registration records - when the phrase sits with populated student identifiers and enrolment fields. Education records under applicable privacy law (FERPA in the US).
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), NDB Scheme (Cth), GDPR, FERPA, Higher Education Support Act 2003 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies individual student grade and assessment records - grade records and books, assessment records and results, examination results, report cards, statements of results and mark sheets - when the phrase sits with populated student identifiers and grade/mark fields. Education records under applicable privacy law (FERPA in the US).
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic partial
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), NDB Scheme (Cth), GDPR, FERPA
- Frameworks
- ISO 27001, ISO 27701
Identifies individual academic transcripts - official, academic or student transcripts, academic records, statements of academic record, records of results and course histories - when the phrase sits with populated student identifiers and transcript fields. Education records under applicable privacy law (FERPA in the US).
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic partial
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), NDB Scheme (Cth), GDPR, FERPA
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to student disciplinary records in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to student counseling records in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies individual student financial aid applications - financial aid applications and award packages, student aid or loan applications, FAFSA, scholarship and bursary applications, fee waiver requests and hardship grant applications - when the phrase sits with populated applicant identifiers and household-finance fields. Financial and education records under applicable privacy law.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), NDB Scheme (Cth), GDPR, FERPA, Higher Education Support Act 2003 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to scholarship evaluation files in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to exam answer scripts in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies admissions review notes about individual applicants - admissions reviews, decisions, committee notes and files, applicant evaluations, ratings and rankings, reader notes, offers of admission and acceptance/rejection letters - when the phrase sits with populated applicant identifiers and evaluation fields.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), NDB Scheme (Cth), GDPR, FERPA
- Frameworks
- ISO 27001, ISO 27701
Identifies recommendation and reference letters about a named person - letters of recommendation or reference, referee reports and academic, character, professional or supervisor references - when the phrase sits with a named candidate and letter structure.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), NDB Scheme (Cth), GDPR, FERPA
- Frameworks
- ISO 27001, ISO 27701
Identifies academic misconduct / plagiarism investigation files about an identified student or researcher: investigation vocabulary together with populated student and case fields (name, student ID, unit, assessment, similarity score, allegation, outcome).
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), Tertiary Education Quality and Standards Agency Act 2011 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to campus incident reports in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to alumni donor records in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to research participant consent files in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies submissions to, and decisions of, a human research ethics review body - IRB/HREC applications, submissions and approvals, ethics applications, protocol amendments and adverse event reports - when the phrase sits with populated protocol/investigator identifiers and submission fields. Committee descriptions alone remain discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), NDB Scheme (Cth), Information Privacy Act 2009 (Qld), GDPR, HIPAA
- Frameworks
- ISO 27001, ISO 27701
Identifies pre-publication thesis manuscripts, drafts and thesis datasets - unpublished theses, thesis data/manuscripts/drafts/chapters, dissertation drafts and embargoed thesis research - when the phrase sits with populated candidate/thesis fields and draft or dataset fields.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), GDPR, Patents Act 1990 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies grant peer-review comments and assessment records containing substantive reviewer observations, scores, or funding outcomes. Grant-review and application phrases are retained for discovery at 65; populated assessment fields raise confidence to 75, while formal proposal or reviewer references plus an explicit funding outcome raise confidence to 85.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies internal laboratory protocol records - laboratory protocols, lab notebooks, experiment logs, reagent preparation records and lab records - when the phrase sits with populated protocol/experiment record fields and experimental quantities. Research know-how rather than personal information.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Patents Act 1990 (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Identifies documents containing references to export-controlled university research in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations. Enforcement is aimed at controlled university research and its technical data; ordinary import/export licensing language is discovery-only unless independent university-research or controlled-technical-data evidence is present.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to customer profile master data in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to customer account credentials in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects customer purchase histories: a purchase / transaction / order history phrase combined with populated order data - rows keyed by a customer or order identifier, labelled order numbers, dates or totals, or labelled customer/member identifiers. Phrase-only mentions stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects browsing behaviour logs and clickstream exports: a browsing history / clickstream / web analytics log phrase combined with populated log structure - URLs carrying a user or session identifier, web access log lines, or labelled visitor/session/device identifiers. Phrase-only mentions (privacy notices, cookie banners) stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects loyalty programme balance records: a loyalty programme / points balance / frequent flyer phrase combined with populated member data - rows keyed by a member identifier, labelled points balances, status credits or tiers, or labelled membership numbers. Phrase-only mentions (programme terms, marketing) stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects call centre audio recordings and transcripts: a call recording / call transcript phrase combined with populated call structure - audio file names, call metadata (call ID, interaction ID, ANI/CLI, agent), timestamped transcript turns or labelled customer fields. Phrase-only mentions (recording notices, policies) stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth), Invasion of Privacy Act 1971 (Qld), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing captured customer messaging conversations in international contexts. Direct chat-transcript, customer-chat, live-chat, and chat-log anchors are retained; support-ticket wording is gated behind independent conversation-record context rather than treated as a transcript on its own, and generic customer-interaction, online-support, and customer-message phrasing no longer anchors detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to customer complaint case files in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects churn propensity score outputs: a churn propensity / churn score / attrition risk phrase combined with populated scoring data - rows keyed by a customer identifier with a score, labelled churn scores or risk bands, or labelled customer/subscriber identifiers. Phrase-only mentions stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects fraud propensity score outputs: a fraud score / fraud risk score phrase combined with populated scoring data - rows keyed by a transaction or account identifier, labelled fraud scores, decisions or reason codes, or labelled account/transaction identifiers. Phrase-only mentions stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects customer segmentation outputs: a customer segmentation / segment or cluster assignment phrase combined with populated assignment data - rows keyed by a customer identifier, labelled segment/cluster/persona values or labelled customer identifiers. Phrase-only mentions (marketing plans, strategy decks) stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects marketing suppression / do-not-contact lists: a suppression list / do-not-contact / opt-out list phrase combined with populated contact data - email addresses, Australian phone numbers or labelled opt-out/suppression dates and reasons. Phrase-only mentions (Spam Act guidance, unsubscribe policies) stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Spam Act 2003 (Cth), Do Not Call Register Act 2006 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects consent and preference records: a consent record / consent register / marketing or privacy consent phrase combined with populated consent data - rows keyed by a customer identifier, labelled consent status/date/version values or labelled customer identifiers. Phrase-only mentions (privacy notices, cookie banners) stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Spam Act 2003 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects contract usage analytics: a contract usage / licence utilisation / consumption report phrase combined with populated usage data - rows keyed by a customer or contract identifier, labelled licensed seats, active users, utilisation or overage values, or labelled customer/contract identifiers. Phrase-only mentions stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to invoice and payment history in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects refund and chargeback histories: a refund/chargeback/dispute history phrase combined with populated dispute data - rows keyed by an order or customer identifier, labelled chargeback amounts, reason codes, ARNs or dispute IDs, masked card numbers or labelled customer identifiers. Phrase-only mentions (refund policies) stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Competition and Consumer Act 2010 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects geofencing event histories: a geofence event / location history log phrase combined with populated location data - precise coordinate pairs, labelled geofence/zone values or labelled device/advertising identifiers. Phrase-only mentions (developer guides, app permissions) stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects advertising attribution datasets: an ad / marketing / multi-touch attribution or conversion-tracking data phrase combined with populated identifiers - SHA-256 hashed emails or device IDs, click identifiers (gclid, fbclid, msclkid) or advertising IDs. Phrase-only mentions stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects personalization feature vectors and user embeddings: a feature vector / user embedding / feature store export phrase combined with populated model data - numeric vectors, JSON records keyed by a user or customer ID, or labelled user identifiers. Phrase-only mentions (engineering guidance, course notes) stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects escalated support case notes: an escalated case / escalation notes / complaint escalation phrase combined with populated case structure - case or ticket numbers, labelled customer fields, priority/severity values or timestamped note entries. Phrase-only mentions (escalation procedures) stay discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to taxpayer case management files in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies individual welfare, social-assistance, and income-support eligibility decisions. Topic phrases are retained for discovery; enforcement requires applicant, household, income, dependant, means-test, benefit-category, outcome, review-right, or effective-date fields, and high confidence also requires a formal case/application reference or recorded eligibility decision.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies individual unemployment-benefit, unemployment-insurance, JobSeeker, and re-employment assistance claims and determinations. Topic phrases are retained for discovery; enforcement requires claimant, employer, separation, earnings, job-search, obligation, benefit-period, payment-rate, or sanction fields, and high confidence also requires a formal claim reference or recorded decision.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to public housing assistance files in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to child protection case files in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to foster care placement records in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies individual disability assessment records - disability and functional capacity assessments, NDIS access requests, disability support pension impairment assessments and standardised functional assessment reports - when the phrase sits with populated person identifiers and assessment fields. Health and disability information under applicable privacy law.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), NDB Scheme (Cth), National Disability Insurance Scheme Act 2013 (Cth), Information Privacy Act 2009 (Qld), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies individual pension entitlement records, benefit calculations, eligibility decisions, and payment determinations. Topic phrases are retained for discovery; enforcement requires member, service, retirement-date, salary, contribution, accrued-benefit, beneficiary, payment-frequency, gross-pension, or commutation fields, and high confidence also requires a formal member/claim reference or recorded entitlement decision.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to immigration interview transcripts in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to asylum claim narratives in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to passport application packets in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies individual civil-status and vital-record amendments, including corrections to birth, death, marriage, and legal-name entries. Civil-registry topics are retained for discovery at 65; populated amendment fields raise confidence to 75, while a formal registry reference and personal status fields raise confidence to 85.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies land-title and cadastral ownership records containing populated proprietor, tenure, parcel, legal-description, or encumbrance fields. Land-registry topics are retained for discovery at 65; populated register fields raise confidence to 75, while a formal title or parcel reference plus substantive ownership-interest evidence raise confidence to 85.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to vehicle title and transfer records in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies business and trade licence application records, including renewal and variation applications. Topic phrases are retained for discovery; enforcement requires at least two populated applicant, enterprise, premises, activity, or licence fields, and high confidence also requires a formal application, licence, or permit reference.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies building, construction, development/planning, occupancy, and site-operating permit application records across jurisdictions. Topic phrases are discovery-only; enforcement requires multiple application fields, while high confidence also requires a labelled application, permit, case, or file reference plus authority or decision context.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to inspection and enforcement records in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to emergency aid request files in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to constituent service case notes in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies criminal history records and police identifying-particulars records (custody / booking photographs, photograph index numbers, fingerprints and other identifying particulars taken, linked to a named person, date of birth and police person numbers). Absorbs the former mugshot-image-repositories classifier. This information is personally identifiable law-enforcement information under applicable privacy regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to arrest records in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to witness identity records in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to investigation case notes in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to surveillance video evidence in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to call detail record datasets in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to ballistics evidence records in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations. Coverage differentiates forensic ballistics records and findings from education and general firearms discussion; generic firearms-analysis language is discovery-only unless independent forensic case or examination-result evidence is present.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to forensic dna profile records in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to probation and parole files in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies detention and custody records about an identified person (watch-house custody records, booking and intake records, prisoner and detainee records) with populated person and custody fields.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic partial
- Jurisdictions
- global
- Regulations
- Corrective Services Act 2006 (Qld), Police Powers and Responsibilities Act 2000 (Qld), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth), GDPR
- Frameworks
- QGISCF, ISO 27001
Identifies documents containing references to juvenile justice records in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies sealed or suppressed court filings (documents filed under seal, sealed orders and indictments, suppression / non-publication orders) with populated proceeding and party fields.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic partial
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
Identifies documents containing references to plea negotiation documentation in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to victim impact statements in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects domestic abuse protective, restraining and barring orders, police-issued protection notices, and applications for them, when the document names the parties. Covers the generic English-language order names used across jurisdictions plus United States (order of protection, protection from abuse, domestic violence restraining order, temporary restraining order, injunction for protection), United Kingdom (non-molestation order, occupation order, DVPN/DVPO, domestic abuse protection notice/order, non-harassment order), Ireland (barring, interim barring and emergency barring orders; bare "safety order" is excluded as too generic), Canada (emergency protection order, peace bond) and New Zealand (Police Safety Order) instruments. Australian state and territory DFV orders are covered in more depth by au-dfv-protection-order; the slug is retained from the earlier topic-phrase classifier.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global, us, gb, ie, ca, nz, au
- Regulations
- GDPR, UK GDPR, Data Protection Act 2018 (UK), Family Law Act 1996 (UK), Domestic Abuse Act 2021 (UK), Violence Against Women Act (US), Domestic Violence Act 2018 (Ireland), Family Violence Act 2018 (NZ), Privacy Act 2020 (NZ), PIPEDA, Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Identifies documents containing references to evidence handling logs in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to classified operation plans in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to troop movement information in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to mission briefing packages in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to target package intelligence in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to signals intelligence reports in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to human intelligence source identities in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to geospatial intelligence products in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to satellite tasking and collection plans in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Detects cryptographic keying material records: keying-material, COMSEC or key-ceremony wording with actual key values (PEM private keys, hex key components) or populated custody details (custodians, HSM serials, KCVs, envelope numbers). Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- low
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- CIS Controls, DISP, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Identifies documents containing references to weapons system vulnerability data in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Identifies documents containing references to command authentication code material in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Identifies documents containing references to classified defense procurement specifications in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to security clearance adjudication files in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to force readiness assessments in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to war-gaming simulation outputs in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to contingency operations plans in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to allied intelligence exchange records in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to export-controlled defense technology docs in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to nuclear safeguards information in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to offensive cyber capability documentation in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Detects printed or prose PLC logic programs and program listings: ladder or rung listings with instruction text such as XIC(...)OTE(...), structured-text logic, program/routine/controller names and controller tags. Complements global-plc-project-export, which covers native L5X/L5K/TIA Openness/XEF export files; this pattern does not use those export-file anchors. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- IEC 62443, ISO 27001, NIST CSF
Detects distributed control system configuration records: DCS configuration/database/tag-list wording with instrument tags and populated setpoints, alarm limits, controller nodes, card/channel assignments and IP addresses. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- IEC 62443, ISO 27001, NIST CSF
Identifies substantive substation protection-relay settings and coordination records. Topic phrases are retained for discovery; enforcement requires a populated current, voltage, impedance, timing, or zone value, and high confidence also requires a substation, feeder, breaker, relay model, or device ID.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF, IEC 62443
Identifies substantive pipeline pressure, flow, operating-limit, and control-setpoint records. Topic phrases are retained for discovery; enforcement requires a populated pressure or flow value, and high confidence also requires a pipeline segment, station, valve, control tag, or other live asset reference.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF, IEC 62443
Identifies substantive water-treatment dosing formulas and control values. Topic phrases are retained for discovery; enforcement requires a populated dose, concentration, feed rate, or process value, and high confidence also requires a treatment-plant asset, process, or control-tag reference.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF, IEC 62443
Identifies substantive electric-grid generation dispatch, unit-commitment, and power-system dispatch plans. Topic phrases are retained for discovery; enforcement requires populated generation, reserve, energy, or reactive-power quantities, and high confidence also requires current interval, generating unit, constraint, interconnector, or grid-operator detail.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF, IEC 62443
Identifies substantive industrial plant shutdown, startup, emergency-shutdown, and turnaround procedures. Topic phrases are retained for discovery; enforcement requires ordered isolation, depressurisation, purge, valve, pump, permissive, interlock, handback, or verification actions, and high confidence also requires a populated equipment identifier, operating value, or timing.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF
Identifies substantive refinery process-control setpoint and operating-envelope records. Topic phrases are retained for discovery; enforcement requires an actual process value, and high confidence also requires a control-loop tag or named refinery process asset.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF, IEC 62443
Detects rail signalling configuration data: interlocking or control-table wording with populated signal, route, points, track-circuit and balise identifiers plus overlap, release-timing, speed and chainage values. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- IEC 62443, ISO 27001, NIST CSF
Detects air traffic operational procedures: ATC unit, local operating or separation procedure wording with populated sector, frequency, waypoint, transfer-level and restriction fields and operational values (flight levels, runways, frequencies, distances). Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Not detected
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Identifies substantive port-facility security and access manifests. Topic phrases are retained for discovery; enforcement requires vessel, port-call, berth, cargo, crew, visitor, escort, access-zone, gate, or security-level manifest content, and high confidence also requires a populated IMO, port-call, manifest, berth, zone, or ISPS security-level identifier.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth)
- Frameworks
- ISO 27001, NIST CSF, IEC 62443
Detects telecom core network configurations: mobile/IMS/EPC/5GC configuration wording with populated PLMN, APN, Diameter realm/peer, point-code and peer-address values, 3GPP realm FQDNs and core node names. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth), Telecommunications Act 1997 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Identifies substantive emergency and critical-service restoration prioritisation plans. Topic phrases are retained for discovery; enforcement requires ranked assets/services, restoration sequence, dependencies, alternate supply, crew assignment, affected sites, service areas, or estimated restoration content, and high confidence also requires a populated priority, asset/site identifier, time, capacity, or customer-impact value.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR, Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth)
- Frameworks
- ISO 27001, NIST CSF
Identifies substantive critical and maintenance spare-parts inventories. Topic phrases are retained for discovery; enforcement requires part-number, stock-on-hand, reorder, lead-time, storage, compatible-asset, supplier, or minimum-stock fields, and high confidence also requires a populated part, quantity, reorder, warehouse, bin, or location value.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF
Identifies substantive operational-technology, ICS, SCADA, and industrial-control cyber incident reports. Topic phrases are retained for discovery; enforcement requires case facts such as affected assets, timelines, initial access, containment, indicators, root cause, recovery, or operational impact, and high confidence also requires a concrete indicator, vulnerability, address, or control asset identifier.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF, IEC 62443
Identifies substantive physical badge and door access-control maps. Topic phrases are retained for discovery; enforcement requires floor-plan, reader-to-door, security-zone, access-level, restricted-area, entry-point, zone-boundary, or credential-group relationships, and high confidence also requires populated door, reader, zone, entry, credential-group, or access-level identifiers.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, NIST CSF
Detects CCTV coverage and blind-spot analyses: CCTV survey or blind-spot wording with populated camera records (IDs, NVR channels, locations, FOV) and located coverage weaknesses. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, PSPF
Identifies substantive hazardous-material, dangerous-goods, and chemical storage maps. Topic phrases are retained for discovery; enforcement requires storage-area, containment-zone, chemical-name, dangerous-goods-class, segregation, spill-containment, or emergency-isolation relationships, and high confidence also requires a populated UN number, tank/store/cabinet/area identifier, or quantity.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701, NIST CSF
Detects dam safety and integrity engineering reports: dam safety review, surveillance or inspection report wording with instrumentation readings (piezometers, seepage weirs, survey marks, reservoir levels) and located condition findings (seepage, cracking, erosion at the toe, spillway or abutment). Distinct from the referable-dam emergency action plan classifier, which covers EAP notification and inundation content. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth), Water Supply (Safety and Reliability) Act 2008 (Qld)
- Frameworks
- ISO 27001, NIST CSF
Identifies documents containing references to enterprise data inventories in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to records of processing activities in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies matrices that map data or information categories to classification levels and handling controls. Topic phrases are retained for discovery; enforcement requires multiple matrix-column or control headings, and high confidence also requires a populated category-to-classification mapping.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF
Identifies documents containing references to data retention and deletion schedules in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to data protection impact assessments in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to cross-border transfer assessments in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to standard contractual clause addenda in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to breach likelihood and impact assessments in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to vendor privacy due diligence reports in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to consent audit trail records in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to data subject access request files in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to deletion request case files in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to privacy complaint investigations in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies pre-submission draft responses, reports, and submissions prepared for a regulator or supervisory authority. Topic phrases are retained for discovery; enforcement requires reporting-period, event, proposed-disclosure, affected-record, data-quality, control, corrective-action, legal-review, or outstanding-evidence content, and high confidence also requires approval, submission, clearance, comment, deadline, or regulator-reference workflow evidence.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to compliance monitoring outputs in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to ethics committee decision records in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to policy attestation records in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to model risk assessment reports in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to algorithmic impact assessments in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to third-party assurance attestations in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to voter roll extract files in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to absentee ballot tracking data in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to election incident response records in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Identifies documents containing references to campaign donor identity records in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to politically exposed person assessment files in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to diplomatic cable traffic in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to treaty negotiation drafts in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to sanctions policy drafts in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to export license decision files in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to embargo enforcement case records in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to pre-release national budget drafts in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to national emergency response plans in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to strategic communications plans in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies operational government media war-room plans used to coordinate monitoring, rapid response, approvals, rebuttals, and spokesperson activity. War-room plan topics are retained for discovery; enforcement requires independent government-office context and multiple operational workflow elements, and high confidence also requires populated assignments, times, or issue references.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001
Identifies documents containing references to leak investigation records in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR, Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to whistleblower protection case records in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to sovereign debt issuance plans in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Identifies documents containing references to central bank intervention plans in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Identifies documents containing references to census microdata in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
- Type
- regex
- Confidence
- medium
- Detection quality
- Topic false positive
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
- Frameworks
- ISO 27001
Detects trade secret designations, proprietary information notices, and commercial-in-confidence markings.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)
- Frameworks
- ISO 27001, NIST CSF, PCI-DSS
Detects references to trade union membership: union member status, union dues, shop stewards, collective bargaining unit membership and union local numbers. GDPR Article 9 lists trade union membership as a special category of personal data with no fixed format — detectable only by topic vocabulary. Topic-grade detector.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- global, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, NIST CSF, SOC 2
Detects TRON (TRX) mainnet addresses: Base58Check encoding of a 21-byte payload (0x41 version byte + 20-byte address hash), always starting with the letter "T" and exactly 34 characters long. The 0x41 prefix byte fixes the leading character as "T" and the length at 34 (58^34 > 66*256^24; 58^33 insufficient). A single leading letter is weak structure, so detection is context-gated. Prefix/length/charset verified against TRON developer docs and the TRON protocol overview.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
- Frameworks
- ISO 27001, ISO 27701, SOC 2, FATF Recommendations
Detects Twilio API key SIDs (SK prefix followed by 32 hex characters). Paired with its secret, a leaked Twilio API key allows sending SMS/voice and accessing account data and call logs.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects Types Of Medication patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- global
- Regulations
- GDPR, HIPAA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects URL patterns.
- Type
- regex
- Confidence
- medium
- Detection quality
- Partial
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects user login credential patterns in documents and configuration files. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad, function-based detector. This keyword-based version flags documents that may contain login credentials for further review.
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects completed vendor risk assessments: third-party risk assessment wording with populated vendor/contract fields and inherent/residual risk ratings, supported at high confidence by assurance evidence. Topic wording alone is discovery-only.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth), Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- DISP, ISO 27001, NIST CSF
Detects Vercel credentials: the current prefixed token family introduced in February 2026 (vcp_ personal access tokens, vci_ integration tokens, vca_ app access tokens, vcr_ app refresh tokens, vck_ API keys), Vercel Blob read-write tokens (vercel_blob_rw_), and, when labelled with Vercel context in an assignment, the legacy unprefixed 24-character token form. A leaked token grants control of the account's projects, deployments and environment variables; a leaked Blob token grants read/write access to the associated storage.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects Vehicle Identification Number patterns. Excludes I, O, Q characters
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects vulnerability assessment reports, vulnerability scanner outputs (Nessus, Qualys, OpenVAS, Nexpose/InsightVM), and zero-day vulnerability write-ups containing CVE/CVSS details, scanner plugin/QID host-port rows, and unpatched or pre-disclosure status. Report and scanner titles alone are discovery-only; enforcement requires a concrete finding, CVE/CWE/CAPEC ID, CVSS vector or score, scanner output structure, or zero-day status evidence.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS
Populated staff work rosters and shift schedules (duty rosters, on-call rosters, nursing and custodial post rosters, control room shift patterns), detected from the roster's own structure: repeated shift time ranges, a day or date column header over rows of shift codes (D, N, E, L, AM, PM, RDO, OFF, OT, OC, AL, on call, leave), and site or role context. Staff names are NOT required, because a roster with names removed still shows when a site is staffed or thinly staffed and where a particular line or post will be.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), Security of Critical Infrastructure Act 2018 (Cth), Fair Work Regulations 2009 (Cth)
- Frameworks
- ISO 27001, QGISCF
Detects X.509 certificate private key PEM headers. This is a broad pattern covering RSA, EC, PKCS#8, and OpenSSH private key formats. This pattern is based on a Microsoft Purview built-in sensitive information type. For more specific detection, see global-rsa-private, global-ec-private, global-pkcs8-private, and global-openssh-private.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects xAI (Grok) API keys, which use a distinctive xai- prefix followed by a long alphanumeric body. A leaked key grants unauthorized, billed access to xAI's Grok models and any prompts or data routed through the API.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
Detects XRP Ledger classic addresses: base58-encoded, starting with the character "r", 25-35 characters long, encoding a 21-byte buffer (1-byte prefix value 0 + 160-bit account ID) with a 4-byte checksum. The XRP base58 dictionary excludes 0, capital O, capital I and lowercase l — the same 58-character set as standard base58, so a standard base58 class matches the charset. A single leading letter is weak structure, so detection is context-gated. Length/charset/prefix verified against xrpl.org address docs.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
- Frameworks
- ISO 27001, ISO 27701, SOC 2, FATF Recommendations
Detects internal or QAO (Queensland Audit Office) audit findings identifying material weaknesses in financial controls before public tabling. Disclosure enables exploitation of identified control gaps.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Auditor-General Act 2009 (Qld), Financial Accountability Act 2009 (Qld)
- Frameworks
- QGISCF
Detects whole-of-government or agency-level insurance coverage schedules, self-insurance reserves, indemnity limits, and excess/deductible structures, and quantified contract liability and insurance schedules (liability caps, limits of liability, required professional indemnity and public liability cover), that reveal the State's financial exposure limits. Absorbed global-top500-178-indemnity-and-liability-schedules (2026-09-24).
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Financial Accountability Act 2009 (Qld)
- Frameworks
- QGISCF
Detects sealed pricing schedules submitted by tenderers as part of government procurement processes, held in confidence until evaluation is complete.
- Type
- document_marker
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Financial Accountability Act 2009 (Qld)
- Frameworks
- QGISCF
Detects internal government revenue projections including tax revenue, royalties, mining/gas receipts, and stamp duty forecasts before public release in budget papers or MYFER.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Financial Accountability Act 2009 (Qld)
- Frameworks
- QGISCF
Detects Greece driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- gr, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Αστυνομική Ταυτότητα patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, gr
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Greece passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- gr, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Greece Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- gr, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects ΑΜΚΑ patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, gr
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Greek Tax identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- gr, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects internal scoring sheets, panellist rankings, weighted criteria assessments, and funding recommendations for competitive government grant programs before public announcement.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Financial Accountability Act 2009 (Qld)
- Frameworks
- QGISCF
Detects 香港身份證 patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- hk
- Regulations
- PDPO (Hong Kong)
- Frameworks
- ISO 27001, ISO 27701
Detects Hong Kong Special Administrative Region (HKSAR) passport numbers issued by the Immigration Department under the HKSAR Passports Ordinance (Cap. 539). HKSAR passport numbers are nine characters: the current series is the letter H followed by 8 digits; earlier biometric series used K followed by 8 digits, and KJ (48-page jumbo booklets) followed by 7 digits.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- hk
- Regulations
- HKSAR Passports Ordinance (Cap. 539), PDPO (Hong Kong)
- Frameworks
- ISO 27001, ISO 27701
Detects Croatia driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- hr, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Osobna iskaznica patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, hr
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Croatia passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- hr, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Osobni identifikacijski broj (OIB) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, hr
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Croatia Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- hr, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Hungary driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- hu, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Hungary passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- hu, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Személyi szám patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, hu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Hungary Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- hu, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects TAJ szám patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, hu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Hungary Tax identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- hu, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Hungarian Value Added Tax Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. VAT numbers have country-specific prefixes that aid detection accuracy.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- hu, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Indonesia drivers license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- id
- Regulations
- PDP Law (Indonesia)
- Frameworks
- ISO 27001, ISO 27701
Detects Kartu Tanda Penduduk (KTP) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- id
- Regulations
- PDP Law (Indonesia)
- Frameworks
- ISO 27001, ISO 27701
Detects Indonesian taxpayer identification numbers (NPWP). Classic NPWP is 15 digits commonly formatted 01.234.567.8-012.000; newer 16-digit forms align with NIK for individuals under tax reform.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- id
- Regulations
- UU PDP (Indonesia), KUP Law (Indonesia)
- Frameworks
- ISO 27001, ISO 27701
Detects Indonesia passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- id
- Regulations
- PDP Law (Indonesia)
- Frameworks
- ISO 27001, ISO 27701
Detects Ireland driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ie, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Ireland passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ie, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Ireland Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- ie, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Uimhir PSP patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, ie
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Israel Bank Account Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Financial account numbers require corroborative evidence for reliable detection due to their generic numeric format.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- il
- Regulations
- Protection of Privacy Law (Israel)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects Teudat Zehut patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- il
- Regulations
- Protection of Privacy Law (Israel)
- Frameworks
- ISO 27001, ISO 27701
Detects Aadhaar patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- in
- Regulations
- Digital Personal Data Protection Act 2023 (India), IT Act 2000 (India)
- Frameworks
- ISO 27001, ISO 27701
Detects India driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- in
- Regulations
- Digital Personal Data Protection Act 2023 (India)
- Frameworks
- ISO 27001, ISO 27701
Detects India GST Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- in
- Regulations
- Digital Personal Data Protection Act 2023 (India), IT Act 2000 (India)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects Indian Financial System Codes (IFSC) used to identify bank branches on the NEFT/RTGS/IMPS networks. Format is four letters (bank code), a mandatory zero, then six alphanumeric characters (branch code), total length 11, typically uppercase.
- Type
- regex
- Confidence
- high
- Jurisdictions
- in
- Regulations
- Digital Personal Data Protection Act 2023 (India), IT Act 2000 (India), Payment and Settlement Systems Act 2007
- Frameworks
- ISO 27001, ISO 27701
Detects PAN patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- in
- Regulations
- Digital Personal Data Protection Act 2023 (India), IT Act 2000 (India)
- Frameworks
- ISO 27001, ISO 27701
Detects Indian passport numbers issued by the Ministry of External Affairs. The standard format is a single letter (A-Z excluding Q, X and Z, which are not used as the leading character) followed by 7 digits, sometimes printed with a space between the letter and the digits (e.g. 'K1234567' or 'K 1234567'). Corroborative keyword proximity is strongly recommended because the body is only 7 digits.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- in
- Regulations
- Digital Personal Data Protection Act 2023 (India), GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Indian mobile telephone numbers per the Department of Telecommunications' National Numbering Plan 2003 (as amended): 10-digit mobile numbers with a constrained leading digit (6-9, expanded from 7-9 to include 6 when DoT authorized 6-series allocation in 2017), in both the bare domestic form and the +91 international form (leading 0 dropped). Landline/STD (Subscriber Trunk Dialling) numbers are intentionally out of scope: STD codes vary 2-8 digits with no verified structural rule constraining their leading digit, so a regex loose enough to cover them (just "10 digits after a leading 0") would be barely tighter than matching any 11-digit sequence — far too high a digit-collision risk to ship without a genuinely verified constraint. See false_positives.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- in
- Regulations
- Digital Personal Data Protection Act 2023 (India), IT Act 2000 (India), TCCCPR
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Employees Provident Fund Organisation (EPFO) Universal Account Numbers (UAN). UAN is a 12-digit number assigned to employees to link multiple PF member IDs across employers. Leading digit is non-zero.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- in
- Regulations
- Digital Personal Data Protection Act 2023 (India), IT Act 2000 (India), EPF and MP Act 1952
- Frameworks
- ISO 27001, ISO 27701
Detects Unified Payments Interface (UPI) Virtual Payment Addresses (VPA / UPI ID) used in India. Format is a local part and a payment-service provider handle separated by @ (for example name@oksbi or business@ybl). Handles are alphabetic PSP codes; local parts allow letters, digits, dot, underscore and hyphen.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- in
- Regulations
- Digital Personal Data Protection Act 2023 (India), IT Act 2000 (India), Payment and Settlement Systems Act 2007
- Frameworks
- ISO 27001, ISO 27701
Detects Electoral Photo Identity Card (EPIC) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- in
- Regulations
- Digital Personal Data Protection Act 2023 (India), IT Act 2000 (India)
- Frameworks
- ISO 27001, ISO 27701
Detects Iceland Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- eu, is
- Regulations
- Data Protection Act (Iceland)
- Frameworks
- ISO 27001, ISO 27701
Detects Codice Fiscale patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, it
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Italy driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- it, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Italy passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- it, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Italian mobile telephone numbers per AGCOM's national numbering plan (Delibera n. 8/15/CIR, Allegato A): the mobile/personal-communications block, structurally defined as "3XYZ" plus six further digits (a 10-digit total for numbering assigned under the current plan), in both the domestic and +39 international forms. The delibera permits already-assigned legacy 9-digit mobile numbering to persist, so any surviving legacy 9-digit mobile numbers are a known potential false negative of this 10-digit regex — kept at 10 digits deliberately, since evidence that live 9-digit stock persists today is inconclusive and loosening the length bound would raise digit collision for every match. Geographic (landline) numbers are intentionally out of scope: the AGCOM plan family bounds geographic numbers at a 10-11 digit total (11 maximum), but within that bound the "0" block's second digit is structurally unconstrained and the minimum/per-prefix length variability across the legacy short-number stock is not verified from a primary source — a 0-prefixed regex spanning that length range with no second-digit constraint would be highly collision-prone — and Italian landline numbers are also the one well-known exception where the leading 0 is retained even in the +39 international form, a further formatting axis to model. Mobile numbers carry no such leading-0 quirk (they never had a leading 0 to begin with).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- it
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Italy Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- it, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Italy Value Added Tax Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. VAT numbers have country-specific prefixes that aid detection accuracy.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- it, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Japan Bank Account Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Financial account numbers require corroborative evidence for reliable detection due to their generic numeric format.
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- jp
- Regulations
- APPI
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects Japan driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- jp
- Regulations
- APPI
- Frameworks
- ISO 27001, ISO 27701
Detects Japanese My Number Corporate patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. The Corporate Number (法人番号) is a 13-digit identifier assigned to corporations and organisations in Japan by the National Tax Agency.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- jp
- Regulations
- APPI
- Frameworks
- ISO 27001
Detects My Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- jp
- Regulations
- APPI
- Frameworks
- ISO 27001, ISO 27701
Detects Japan passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- jp
- Regulations
- APPI
- Frameworks
- ISO 27001, ISO 27701
Detects Japan Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- jp
- Regulations
- APPI
- Frameworks
- ISO 27001, ISO 27701
Detects 在留カード番号 patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- jp
- Regulations
- APPI
- Frameworks
- ISO 27001, ISO 27701
Detects 住民票コード patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- jp
- Regulations
- APPI
- Frameworks
- ISO 27001, ISO 27701
Detects 社会保険番号 patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- jp
- Regulations
- APPI
- Frameworks
- ISO 27001, ISO 27701
Detects government defence materials for judicial review of administrative decisions. These files contain the State's candid assessment of decision-making deficiencies and legal vulnerabilities. Disclosure directly prejudices the State's defence and may establish precedent affecting thousands of similar decisions.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Evidence Act 1977 (Qld), Judicial Review Act 1991 (Qld)
- Frameworks
- QGISCF
Detects Kenya national identity card numbers (typically 7-8 digits).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- ke
- Regulations
- Data Protection Act 2019 (Kenya)
- Frameworks
- ISO 27001, ISO 27701
Detects South Korea driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- kr
- Regulations
- PIPA (South Korea)
- Frameworks
- ISO 27001, ISO 27701
Detects South Korea passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- kr
- Regulations
- PIPA (South Korea)
- Frameworks
- ISO 27001, ISO 27701
Detects Korea Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- kr
- Regulations
- PIPA (South Korea)
- Frameworks
- ISO 27001, ISO 27701
Detects RRN patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- kr
- Regulations
- PIPA (South Korea)
- Frameworks
- ISO 27001, ISO 27701
Detects telecommunications interception warrants, stored communications warrants and the intercept product they produce (call transcripts, line / session logs, intercepted communications) under the Telecommunications (Interception and Access) Act 1979 (Cth). Disclosure of the existence of an interception warrant or of interception product is a criminal offence under the TIA Act and alerts targets to switch to unmonitored channels. Absorbs the former lawful-intercept-transcripts classifier.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Police Powers and Responsibilities Act 2000 (Qld), Telecommunications (Interception and Access) Act 1979 (Cth)
- Frameworks
- QGISCF
Detects Liechtenstein Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- li, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects internal assessments evaluating whether specific documents or communications attract legal professional privilege, including analysis of privilege vulnerabilities. These meta-privilege documents map where the State's privilege claims are strong and where they are vulnerable.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Evidence Act 1977 (Qld), Right to Information Act 2009 (Qld)
- Frameworks
- QGISCF
Detects Lithuania driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- lt, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Lithuania passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- lt, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Asmens kodas patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, lt
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Lithuania Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- lt, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Luxembourg driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Mixed
- Jurisdictions
- lu, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Numéro d'identification national (entités) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, lu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Numéro d'identification national patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, lu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Luxembourg passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- lu, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Luxembourg Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- lu, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Latvia driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- lv, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Latvia passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- lv, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Personas kods patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- eu, lv
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Latvia Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- lv, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects legal opinions and due diligence reports for mergers, acquisitions, or privatisations involving Government Owned Corporations (GOCs) or government assets. Disclosure is market-sensitive and commercially prejudicial, potentially breaching continuous disclosure obligations.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Evidence Act 1977 (Qld), Government Owned Corporations Act 1993 (Qld)
- Frameworks
- QGISCF
Detects privileged litigation strategy documents and related case strategy materials, including high-exposure matters (significant financial exposure or systemic policy impact), defence strategy content, prospects assessments, and settlement posture. Covers both formal major-matter strategy packs and general litigation strategy document references in Australian legal contexts.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Evidence Act 1977 (Qld), Right to Information Act 2009 (Qld)
- Frameworks
- QGISCF
Detects Malta driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Mixed
- Jurisdictions
- mt, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Karta tal-Identità patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, mt
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Malta passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- mt, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Malta Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- mt, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Malta Tax ID Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- mt, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Mexican CLABE (Clave Bancaria Estandarizada) numbers used for SPEI interbank transfers. CLABE is an 18-digit standardized bank account number including bank code, branch, account and check digit.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- mx
- Regulations
- LFPDPPP (Mexico), Fintech Law (Mexico)
- Frameworks
- ISO 27001, ISO 27701
Detects CURP patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- mx
- Regulations
- LFPDPPP (Mexico)
- Frameworks
- ISO 27001, ISO 27701
Detects Mexican passport numbers issued by the Secretaría de Relaciones Exteriores (SRE). Older passports use a single letter followed by 7-8 digits; newer books carry an 8-9 character alphanumeric serial. Mixed alphanumeric serials are broad candidates that also match order IDs, booking codes, and product serials — they are not treated as Mexican passport numbers without issuer or passport-document evidence. Because the format is short and loosely structured, corroborative keyword proximity is strongly recommended to reduce false positives.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- mx
- Regulations
- LFPDPPP (Mexico), CCPA/CPRA
- Frameworks
- ISO 27001, ISO 27701
Detects Mexican RFC (Registro Federal de Contribuyentes) taxpayer identifiers in both official formats: the 13-character natural-person form (4-letter name stem + 6-digit date + 3-character homoclave) and the 12-character legal-entity form (3-character name stem, which may include Ñ or &, + 6-digit date + 3-character homoclave).
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- mx
- Regulations
- LFPDPPP (Mexico)
- Frameworks
- ISO 27001, ISO 27701
Detects MyKad patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- my
- Regulations
- PDPA (Malaysia)
- Frameworks
- ISO 27001, ISO 27701
Detects Malaysia passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- my
- Regulations
- PDPA (Malaysia)
- Frameworks
- ISO 27001, ISO 27701
Detects Malaysian individual Tax Identification Numbers (TIN / Nombor Pengenalan Cukai) issued by the Inland Revenue Board of Malaysia (LHDN / HASiL). Since 2 January 2023 individual TINs use the prefix IG followed by 9-11 digits (11-13 characters total); the legacy individual prefixes SG (employment income) and OG (business income) with the same digit range remain in circulation in older records. Entity TINs (C, D, F, PT, TA and similar prefixes) are deliberately out of scope: single-letter prefixes over a digit run are too collision-prone and entity TINs are not personal data.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- my
- Regulations
- Income Tax Act 1967 (Malaysia), PDPA (Malaysia)
- Frameworks
- ISO 27001, ISO 27701
Detects legal strategy documents for native title negotiations, ILUAs, and compensation claims under the Native Title Act 1993 (Cth). Disclosure reveals the State's negotiation position on land rights with multi-generational consequences and multi-billion dollar implications.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Native Title Act 1993 (Cth)
- Frameworks
- QGISCF
Detects NATO security classification markings under the NATO security policy (C-M(2002)49): the spelled-out national-security levels NATO RESTRICTED (NR), NATO CONFIDENTIAL (NC) and NATO SECRET (NS), and the highest level COSMIC TOP SECRET (CTS) — where the codeword COSMIC attaches only to TOP SECRET. ATOMAL caveat markings (NATO CONFIDENTIAL ATOMAL, NATO SECRET ATOMAL, COSMIC TOP SECRET ATOMAL) are covered as suffixes of their parent level marking. Marking syntax verified directly against the International Programs Security Handbook (US-government primary source reproducing NATO security-directive marking rules) and corroborating NATO security briefings; matched case-sensitively so ordinary lowercase prose ("a nato secret") does not trigger it.
- Type
- regex
- Confidence
- high
- Jurisdictions
- nato
- Regulations
- NATO Security Policy C-M(2002)49
- Frameworks
- NATO Security Policy
Detects Nigeria National Identification Numbers (NIN) — 11 digits from NIMC.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- ng
- Regulations
- NDPR (Nigeria), NIMC Act
- Frameworks
- ISO 27001, ISO 27701
Detects BSN patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, nl
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Netherlands driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- nl, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Netherlands passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- nl, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Dutch national telephone numbers per the ACM-administered numbering plan: 10-digit numbers (leading trunk 0 included) covering geographic numbers (area code first significant digit 1-5 or 7, e.g. 020 Amsterdam, 010 Rotterdam, 070 Den Haag) and mobile numbers (06 prefix), plus the +31 international form (leading 0 dropped), including the widespread "+31 (0)6 12345678" letterhead rendering (a common-but-nonstandard practice — ITU-T E.123 advises against the parenthesised trunk digit in international notation, but it is ubiquitous on Dutch letterheads, so it is matched for detection purposes). Numbers beginning 08 (0800 free-of-charge service numbers, 088 non-geographic business lines) and 09 (0900/0906/0909 premium-rate information numbers) are intentionally out of scope — these are organizational/service numbers rather than personal PII, mirroring how uk-phone-number and fr-phone-number scope out their own non-geographic service ranges. Note this also excludes the 085 and 091 location-independent subscriber ranges (VoIP numbers ACM makes available to individuals as well as businesses): a personal 085/091 VoIP line is therefore a known false negative, accepted because the 085/088/091 block is predominantly organizational in practice and cannot be split from it structurally.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- nl
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Netherlands Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- nl, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Netherlands Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- nl, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Netherlands Value Added Tax Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. VAT numbers have country-specific prefixes that aid detection accuracy.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- nl, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Fødselsnummer patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, no
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Norwegian passport numbers issued by the police (politiet). The 2020 series uses a nine-character document number: ordinary (C) and emergency (K) passports are one prefix letter plus two characters that may be letters or digits plus six digits (specimen CCC002251); diplomatic (FG), service (FH), special (FJ), travel-document (FK) and foreigner (FL) passports are a two-letter prefix plus one letter-or-digit plus six digits. Pre-2020 series passports (in circulation until October 2030) carry an eight-digit document number.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- no
- Regulations
- GDPR, Passport Act (Norway, passloven)
- Frameworks
- ISO 27001, ISO 27701
Detects Norway Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- eu, no
- Regulations
- Personal Data Act (Norway)
- Frameworks
- ISO 27001, ISO 27701
Detects New Zealand bank account number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Financial account numbers require corroborative evidence for reliable detection due to their generic numeric format.
- Type
- regex
- Confidence
- medium
- Detection quality
- Mixed
- Jurisdictions
- nz
- Regulations
- Privacy Act 2020 (NZ)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects New Zealand driver license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- nz
- Regulations
- Privacy Act 2020 (NZ)
- Frameworks
- ISO 27001, ISO 27701
Detects New Zealand Inland Revenue number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- nz
- Regulations
- Privacy Act 2020 (NZ)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects the New Zealand Government CONFIDENTIAL national-security classification under the Protective Security Requirements (PSR) classification system: the verified control/dissemination marking separator (CONFIDENTIAL//..., e.g. CONFIDENTIAL//NZEO) and a gated bracket form ([CONFIDENTIAL]). Deliberately narrow v1: no bare-word tier (CONFIDENTIAL is overwhelmingly common as generic business/legal boilerplate — NDAs, email footers, "STRICTLY CONFIDENTIAL", "PRIVATE AND CONFIDENTIAL" — and would swamp any bare-word detector), and the bracket tier is hard-gated by New Zealand government context because, unlike its sibling markings, [CONFIDENTIAL] is not a verified SEEMail trigger word. Regex logic verified directly against official PSR marking-format guidance (protectivesecurity.govt.nz); matched case-sensitively.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- nz
- Regulations
- Privacy Act 2020 (NZ)
- Frameworks
- PSR
Detects the New Zealand Government IN-CONFIDENCE protective marking under the Protective Security Requirements (PSR) classification system: endorsed forms (e.g. MEDICAL IN-CONFIDENCE, BUDGET: IN-CONFIDENCE), the legacy SEEMail bracket trigger-word convention ([IN-CONFIDENCE]), and the bare ALL-CAPS document-banner form. Regex logic verified against the official PSR Classification Handbook (protectivesecurity.govt.nz) and Cabinet Office Circular CO(08)1; matched case-sensitively.
- Type
- regex
- Confidence
- high
- Detection quality
- Mixed
- Jurisdictions
- nz
- Regulations
- Privacy Act 2020 (NZ)
- Frameworks
- PSR
Detects the New Zealand Government RESTRICTED national-security classification under the Protective Security Requirements (PSR) classification system: the verified control/dissemination marking separator (RESTRICTED//..., e.g. RESTRICTED//REL TO NZL, GBR), the legacy SEEMail bracket trigger-word convention ([RESTRICTED]), and the bare ALL-CAPS document-banner form gated by New Zealand government context and a collocation-noise exclusion. Regex logic verified directly against official PSR marking-format guidance (protectivesecurity.govt.nz); matched case-sensitively.
- Type
- regex
- Confidence
- high
- Detection quality
- Mixed
- Jurisdictions
- nz
- Regulations
- Privacy Act 2020 (NZ)
- Frameworks
- PSR
Detects the New Zealand Government SECRET and TOP SECRET national-security classifications under the Protective Security Requirements (PSR) classification system: the verified control/dissemination marking separator ((TOP )SECRET//..., e.g. SECRET//NZEO, TOP SECRET//REL TO NZL, FVEY), the TOP SECRET banner-words phrase (tolerant of a hyphen or PDF-line-wrap-inserted whitespace between TOP and SECRET), and a New Zealand government/PSR-context-gated bare SECRET banner. Deliberately omits a SEEMail square-bracket trigger-word tier: the complete SEEMail bracket trigger-word set is [SEEMAIL]/[TRUSTED]/[RESTRICTED]/[SENSITIVE]/[IN-CONFIDENCE], all at or below SEEMail's own RESTRICTED-tier service ceiling, so [SECRET]/[TOP SECRET] bracket forms are structurally implausible and unattested. Regex logic verified directly against official PSR marking-format guidance (protectivesecurity.govt.nz); matched case-sensitively.
- Type
- regex
- Confidence
- high
- Detection quality
- Mixed
- Jurisdictions
- nz
- Regulations
- Privacy Act 2020 (NZ)
- Frameworks
- PSR
Detects the New Zealand Government SENSITIVE protective marking under the Protective Security Requirements (PSR) classification system: the legacy SEEMail bracket trigger-word convention ([SENSITIVE]), endorsed forms (e.g. BUDGET SENSITIVE, COMMERCIAL: SENSITIVE, CABINET SENSITIVE), and the bare ALL-CAPS document-banner form gated by New Zealand government context. Regex logic verified against the official PSR Classification Handbook (protectivesecurity.govt.nz) and Cabinet Office Circular CO(08)1; matched case-sensitively.
- Type
- regex
- Confidence
- high
- Detection quality
- Mixed
- Jurisdictions
- nz
- Regulations
- Privacy Act 2020 (NZ)
- Frameworks
- PSR
Detects New Zealand Ministry of Health Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the generic numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- nz
- Regulations
- Privacy Act 2020 (NZ)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects New Zealand Business Numbers (NZBNs) — the 13-digit universal business identifier administered by MBIE. Every NZBN is a GS1 Global Location Number (GLN): the first two digits are 94 (the GS1 prefix identifying New Zealand entities), the next ten digits are the business entity identifier, and the final digit is a GS1 mod-10 check digit. A bare 13-digit run has a phone-number-sized collision surface (NZ mobile/landline numbers, card fragments, timestamps), so every tier requires the number to be directly attached to an NZBN label — label-embedded-in-regex counts as label gating per the D1 decision record. There is deliberately no bare unlabelled tier.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- nz
- Regulations
- Privacy Act 2020 (NZ), Companies Act 1993 (NZ)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects New Zealand Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- nz
- Regulations
- Privacy Act 2020 (NZ)
- Frameworks
- ISO 27001, ISO 27701
Detects New Zealand Social Welfare Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the generic numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- nz
- Regulations
- Privacy Act 2020 (NZ)
- Frameworks
- ISO 27001, ISO 27701
Detects documents containing strategic and tactical intelligence on organised crime networks including network mapping, financial flow analysis, key facilitator identification, and cross-jurisdictional cooperation intelligence. QPS Taskforce Maxima handles OMCG investigations. Disclosure enables criminal organisations to restructure and eliminate suspected informants.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Crime and Corruption Act 2001 (Qld), Police Powers and Responsibilities Act 2000 (Qld)
- Frameworks
- QGISCF
Detects legal strategy for patent prosecution before filing, including prior art assessments, claim drafting strategy, and freedom-to-operate opinions. Disclosure destroys patent novelty or reveals prosecution strategy to competitors. Note: trainable classifier recommended for production deployment.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Patents Act 1990 (Cth)
- Frameworks
- QGISCF, ISO 27001
Detects bulk payroll data files containing employee names, Tax File Numbers (TFNs), bank account details, and salary information. Disclosure enables mass identity theft, fraudulent tax returns, and targeted social engineering.
- Type
- regex
- Confidence
- high
- Detection quality
- Error
- Jurisdictions
- au
- Regulations
- Criminal Code Act 1899 (Qld), Privacy Act 1988 (Cth), Taxation Administration Act 1953 (Cth)
- Frameworks
- QGISCF
Detects Peru Documento Nacional de Identidad (DNI) numbers — 8 digits.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- pe
- Regulations
- Ley de Protección de Datos Personales (Peru)
- Frameworks
- ISO 27001, ISO 27701
Detects Philippine Identification System (PhilSys) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- ph
- Regulations
- Data Privacy Act of 2012 (Philippines)
- Frameworks
- ISO 27001, ISO 27701
Detects Philippines passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ph
- Regulations
- Data Privacy Act of 2012 (Philippines)
- Frameworks
- ISO 27001, ISO 27701
Detects Philippines PhilHealth Identification Numbers (PIN) in the common dashed format ##-#########-# (12 digits). Used for national health insurance membership and claims.
- Type
- regex
- Confidence
- high
- Jurisdictions
- ph
- Regulations
- Data Privacy Act of 2012 (Philippines), Universal Health Care Act (Philippines)
- Frameworks
- ISO 27001, ISO 27701
Detects Philippines Social Security System (SSS) numbers in the common dashed format ##-#######-# (10 digits total). Continuous digit forms are intentionally out of scope to reduce collision with other national identifiers.
- Type
- regex
- Confidence
- high
- Jurisdictions
- ph
- Regulations
- Data Privacy Act of 2012 (Philippines), SSS Act
- Frameworks
- ISO 27001, ISO 27701
Detects Philippine Taxpayer Identification Numbers (TIN) issued by the Bureau of Internal Revenue (BIR) under Section 236(j) of the National Internal Revenue Code. The base TIN is a 9-digit number (the 9th digit is a check digit), usually written XXX-XXX-XXX. Registered businesses append a branch code — historically 3 digits (000 for the head office, 12 digits total) and, since eBIRForms v7.9.6.0 (RMC No. 36-2026, April 2026), up to 5 digits (14 digits total).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- ph
- Regulations
- National Internal Revenue Code of 1997 (Philippines), Data Privacy Act of 2012 (Philippines)
- Frameworks
- ISO 27001, ISO 27701
Detects UMID patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- ph
- Regulations
- Data Privacy Act of 2012 (Philippines)
- Frameworks
- ISO 27001, ISO 27701
Detects Poland driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- pl, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Dowód osobisty patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, pl
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Poland passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- pl, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects PESEL patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, pl
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Poland Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- pl, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects REGON patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, pl
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Poland Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- pl, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects metadata records from police body-worn camera (BWC) systems including activation timestamps, officer identification, incident cross-references, and footage catalogue entries. This pattern targets the metadata and logs, NOT the footage itself. BWC metadata reveals which officers attended which incidents, activation patterns, and evidence chain-of-custody details.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Police Powers and Responsibilities Act 2000 (Qld), Police Service Administration Act 1990 (Qld)
- Frameworks
- QGISCF
Detects internal investigation documents of police use of lethal or serious force, including compelled officer statements under s.7.2 PPRA and Ethical Standards Command evidence before investigation completion.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Crime and Corruption Act 2001 (Qld), Police Powers and Responsibilities Act 2000 (Qld), Police Service Administration Act 1990 (Qld)
- Frameworks
- QGISCF
Detects ministerial briefing notes or departmental submissions recommending specific grant funding decisions before public announcement.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Financial Accountability Act 2009 (Qld)
- Frameworks
- QGISCF
Detects draft earnings guidance, profit warnings, or financial results before market disclosure. For QLD Government, this applies to GOCs subject to continuous disclosure obligations.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Corporations Act 2001 (Cth), Criminal Code Act 1899 (Qld)
- Frameworks
- QGISCF
Detects weighted evaluation matrices scoring tender responses, including commercial pricing from multiple bidders in government procurement processes.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Financial Accountability Act 2009 (Qld)
- Frameworks
- QGISCF
Detects Cartão de Cidadão patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- eu, pt
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Portugal driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Mixed
- Jurisdictions
- pt, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Portugal passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- pt, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Portuguese Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- pt, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Portugal Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- pt, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects بطاقة الهوية القطرية patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- qa
- Regulations
- PDPPL (Qatar)
- Frameworks
- ISO 27001, ISO 27701
Detects unreleased Queensland state budget allocation figures, forward estimates, and expenditure projections. These are market-moving documents that enable insider trading on government-linked securities if disclosed prematurely.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Corporations Act 2001 (Cth), Criminal Code Act 1899 (Qld), Right to Information Act 2009 (Qld)
- Frameworks
- QGISCF
Detects Queensland Police Service (QPS) incident reports containing operational details about reported offences, informant information, and occurrence records. These are non-covert operational documents that are sensitive due to informant and victim details but do not involve covert methodology or life-safety risks.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Police Powers and Responsibilities Act 2000 (Qld), Police Service Administration Act 1990 (Qld)
- Frameworks
- QGISCF
Detects legal defence strategy prepared in response to regulatory investigations by bodies such as ACCC, ASIC, APRA, OAIC, and Queensland regulators (CCC, OIA). Disclosure reveals the target's assessment of its own regulatory exposure and defence approach.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Right to Information Act 2009 (Qld), Information Privacy Act 2009 (Qld)
- Frameworks
- ISO 27001, ISO 27701, QGISCF
Detects prosecution briefs prepared by Queensland regulatory bodies (Workplace Health and Safety, Environmental Protection Authority, Office of Fair Trading) for enforcement action. Disclosure compromises prosecution integrity and alerts enforcement targets.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Criminal Code Act 1899 (Qld), Environmental Protection Act 1994 (Qld), Work Health and Safety Act 2011 (Qld)
- Frameworks
- QGISCF
Detects Romania driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ro, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Romania passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ro, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Cod Numeric Personal patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- eu, ro
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Romania Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- ro, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects draft submissions to Royal Commissions before formal tabling. Pre-tabling drafts reveal the State's narrative strategy, admissions under consideration, and positions not yet finalised. Disclosure prejudices the State's participation in proceedings of national significance.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Commissions of Inquiry Act 1950 (Qld)
- Frameworks
- QGISCF
Detects Russian domestic passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ru
- Regulations
- Federal Law 152-FZ (Russia)
- Frameworks
- ISO 27001, ISO 27701
Detects Russian international passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ru
- Regulations
- Federal Law on Personal Data (152-FZ) (Russia)
- Frameworks
- ISO 27001, ISO 27701
Detects Russia Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- ru
- Regulations
- Federal Law 152-FZ (Russia)
- Frameworks
- ISO 27001, ISO 27701
Detects Russian Taxpayer Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ru
- Regulations
- Federal Law 152-FZ (Russia)
- Frameworks
- ISO 27001, ISO 27701
Detects Saudi Arabian Iqama (residence permit) numbers issued to expatriate residents. Iqama numbers are 10 digits and start with 2. Saudi national IDs start with 1 and are covered by sa-national-id.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- sa
- Regulations
- PDPL (Saudi Arabia)
- Frameworks
- ISO 27001, ISO 27701
Detects National Id patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Partial
- Jurisdictions
- sa
- Regulations
- PDPL (Saudi Arabia)
- Frameworks
- ISO 27001, ISO 27701
Detects internal legal assessments evaluating compliance with sanctions regimes (DFAT, OFAC, EU). Disclosure reveals identified compliance gaps, risk exposures, and remediation strategies before implementation, exposing the organisation to criminal prosecution under the Autonomous Sanctions Act 2011.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Autonomous Sanctions Act 2011 (Cth), Charter of the United Nations Act 1945 (Cth)
- Frameworks
- QGISCF
Detects Sweden driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- se, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Sweden passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- se, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Personnummer patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, se
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Sweden Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- se, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Sweden Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- se, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects documents authorising settlement ranges, negotiation floors/ceilings, and approved concession parameters, and unexecuted draft settlement instruments (draft deeds of settlement/release, settlement agreements, terms of settlement) carrying a proposed settlement sum. Disclosure reveals the State's maximum position or proposed terms, destroying negotiation leverage and potentially costing tens of millions in lost bargaining position. Absorbed global-top500-166-settlement-agreement-drafts (2026-09-24).
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Evidence Act 1977 (Qld), Right to Information Act 2009 (Qld)
- Frameworks
- QGISCF
Detects sexual assault counselling records and the legal material that seeks or protects them, for an identified person: counselling session notes, trauma counselling and victim/survivor support records, forensic medical examination referrals, specialist sexual assault service records (Queensland SARAS, Centres Against Sexual Assault, Yarrow Place, Sexual Assault Resource Centre, sexual assault response teams), and subpoena or privilege material about protected counselling communications — Qld sexual assault counselling privilege (Evidence Act 1977 Pt 2 Div 2A), NSW sexual assault communications privilege (Criminal Procedure Act 1986 ss295-306), Vic confidential communications (Evidence (Miscellaneous Provisions) Act 1958 Div 2A), and WA, SA, Tas, ACT and NT equivalents. These records are subject to strong statutory privilege and carry the highest privacy protections — disclosure can re-traumatise survivors, compromise criminal proceedings, and endanger safety.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Criminal Code Act 1899 (Qld), Evidence Act 1977 (Qld), Information Privacy Act 2009 (Qld), Criminal Procedure Act 1986 (NSW), Evidence (Miscellaneous Provisions) Act 1958 (Vic), Evidence Act 1906 (WA), Evidence Act 1929 (SA), Evidence Act 2001 (Tas), Evidence (Miscellaneous Provisions) Act 1991 (ACT), Evidence Act 1939 (NT), Privacy Act 1988 (Cth)
- Frameworks
- QGISCF
Detects Singapore driving license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- sg
- Regulations
- PDPA (Singapore)
- Frameworks
- ISO 27001, ISO 27701
Detects NRIC patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- sg
- Regulations
- PDPA (Singapore)
- Frameworks
- ISO 27001, ISO 27701
Detects Singapore passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- sg
- Regulations
- PDPA (Singapore)
- Frameworks
- ISO 27001, ISO 27701
Detects Singapore Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- sg
- Regulations
- PDPA (Singapore)
- Frameworks
- ISO 27001, ISO 27701
Detects Singapore Unique Entity Numbers (UEN) issued by ACRA and other agencies to businesses and other entities. Common forms are 8 or 9 digits plus a check letter (local companies) and the issued-year form TyyPQnnnnX / SyyPQnnnnX / RyyPQnnnnX used for other entities.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- sg
- Regulations
- PDPA (Singapore), ACRA Act
- Frameworks
- ISO 27001, ISO 27701
Detects Slovenia driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- si, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Enotna matična številka občana (EMŠO) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, si
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Slovenia passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- si, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Slovenia Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- si, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Slovenia Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- si, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Slovakia driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- sk, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Slovakia passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- sk, eu
- Regulations
- BDSG, CNIL / LIL, GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Rodné číslo patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- eu, sk
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects Slovakia Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- sk, eu
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects credentials and sensitive configuration directives in Cisco IOS/NX-OS configuration files, including enable passwords/secrets, SNMP community strings with write access, PAC keys, and NVRAM/LDAP authentication indicators. Mirrors Snaffler rule KeepNetConfigCreds.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Computer Fraud and Abuse Act, Computer Misuse Act 1990
- Frameworks
- CIS Controls, ISO 27001, NIST CSF
Detects credentials passed as command-line arguments in Windows batch scripts, PowerShell, and shell scripts. Covers net use /user:, schtasks /rp, psexec -p, cmdkey, and bare password= assignments. Mirrors Snaffler rule KeepCmdCredentials.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS
Detects Microsoft Defender for Identity (MDI) SensorConfiguration.json files containing DirectoryServicesAccount credentials and Microsoft Defender for Endpoint (MDE) mdatp_managed.json files containing onboardingInfo blobs, both of which represent high-value security tool configuration secrets. Mirrors Snaffler rule KeepDefenderConfigByName.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF
Detects Microsoft Deployment Toolkit (MDT) customsettings.ini files that embed domain join credentials, including DomainAdminPassword and DomainAdmin account values used during automated OS deployments. Mirrors Snaffler rule KeepDomainJoinCredsByName / KeepDomainJoinCredsByPath.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF
Detects Firefox logins.json encrypted password entries in the JSON format used by Firefox's NSS (Network Security Services) credential store. Mirrors Snaffler rule KeepFFRegexRed.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF
Detects passwords stored in FTP server and client configuration files, including FileZilla server/client recentservers.xml base64-encoded passwords, proftpd-style shadow passwd lines with hashed credentials, and sftp-config.json plaintext password fields. Mirrors Snaffler rules KeepFtpServerConfigByName and KeepFtpClientConfigConfigByName.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS
Detects embedded credentials (username:password) in Git repository URLs. Mirrors Snaffler rule KeepGitCredsByName.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF
Detects Apache htpasswd file entries containing hashed passwords in MD5 ($apr1$), bcrypt ($2y$, $2b$, $2a$), or SHA ({SHA}) formats. Mirrors Snaffler rule KeepConfigByName.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF
Detects secrets embedded in Infrastructure as Code files including Terraform/HCL variable assignments and Azure Cloud Service configuration (.cscfg) XML settings. Mirrors Snaffler rule KeepInfraAsCodeByExtension.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF
Detects Jenkins-encrypted credential values in the {base64...} format used by Jenkins credentials.xml and similar configuration files. Mirrors Snaffler rule KeepJenkinsByName.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF
Detects MediaWiki LocalSettings.php files containing database passwords ($wgDBpassword), secret keys ($wgSecretKey), and upgrade keys ($wgUpgradeKey). These are high-value secrets that grant database and administrative access to a MediaWiki installation. Mirrors Snaffler rule KeepPhpByName.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects credential list files — documents containing multiple username/password pairs in a structured, enumerated format (passwords.txt, secrets.*, BitlockerLAPSPasswords.csv, etc.). Distinguishes a credential roster from prose mentioning "password". Mirrors Snaffler rule KeepPasswordFilesByName.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects PostgreSQL .pgpass file entries containing hostname, port, database, username, and password in colon-separated format. Mirrors Snaffler rule KeepDbMgtConfigByName.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF
Detects PowerShell credential constructs that embed plaintext passwords, including ConvertTo-SecureString with -AsPlainText and [Net.NetworkCredential]::new() calls. Mirrors Snaffler rule KeepPsCredentials.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS
Detects secret credentials embedded in Ruby on Rails configuration files: secret_token/secret_key_base assignments (config/initializers/secret_token.rb, config/secrets.yml), database passwords (config/database.yml), and Chef knife client keys (knife.rb). These files are frequently committed to source control and expose application secrets and infrastructure access. Mirrors Snaffler rule KeepRubyByName.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- GDPR, Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Detects DPAPI-encrypted saved passwords stored in Windows Remote Desktop Protocol (.rdp) configuration files. The characteristic line "password 51:b:<base64-blob>" contains a DPAPI ciphertext blob representing a saved RDP credential. These files are frequently found on file shares, workstations, and in source-control repositories and represent a high-severity finding because the blob can be decrypted on the originating machine under the same user context. Mirrors Snaffler rule KeepRdpPasswords.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Computer Fraud and Abuse Act, Criminal Code Act 1995 (Cth), Network and Information Systems (NIS) Directive
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, CMMC
Detects passwords and credentials stored in remote access configuration files including RDCMan .rdg files (logonCredentials blocks), mRemoteNG confCons.xml (Node Password attributes), and OpenVPN .ovpn files with embedded auth directives. MobaXterm .ini files are a Snaffler filename target only — passwords are stored obfuscated (proprietary XOR cipher) with no plaintext fingerprint detectable by content regex. Mirrors Snaffler rules KeepRemoteAccessConfByExtension and KeepRemoteAccessConfByName.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF
Detects S3 and S3A URI references in source code or configuration files when accompanied by AWS credential context. S3 URIs alone are high-FP enumeration signals; this pattern only fires at 75+ confidence when AWS credential evidence (access key, secret, AKIA prefix) is present within 300 characters. URI-only matches surface at 65 as discovery inventory. Mirrors Snaffler rule KeepS3UriPrefixInCode.
- Type
- regex
- Confidence
- low
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS
Detects credentials embedded in shell history files (.bash_history, .zsh_history, ConsoleHost_History.txt) including exported environment variable secrets, mysql command-line passwords, curl basic auth credentials, and sshpass invocations. Mirrors Snaffler rule KeepShellHistoryByName.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF
Detects database connection credentials embedded in source code across Java (JDBC), PHP, Perl, Ruby, and Python. Matches database driver connect() calls containing credentials inline. Mirrors Snaffler rules KeepJavaDbConnStrings, KeepPhpDbConnStrings, KeepPerlDbConnStrings, KeepRubyDbConnStrings, KeepPyDbConnStrings.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS
Detects SQL statements that create database user accounts or logins with embedded passwords, covering SQL Server CREATE LOGIN, MySQL CREATE USER IDENTIFIED BY, and PostgreSQL CREATE USER WITH PASSWORD. Mirrors Snaffler rule KeepSqlAccountCreation.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF
Detects plaintext passwords stored in Windows unattend.xml answer files, specifically the AdministratorPassword and AutoLogon <Value> XML elements used during Windows automated setup. These files frequently contain Administrator or auto-logon credentials in cleartext and represent a high severity finding when discovered on file shares or in software repositories. Mirrors Snaffler rule KeepUnattendXmlRegexRed.
- Type
- regex
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth), Computer Fraud and Abuse Act
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, CMMC
Detects QTC (Queensland Treasury Corporation) borrowing strategies, debt issuance timelines, yield curve management plans, and refinancing schedules. Premature disclosure enables bond market front-running.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Corporations Act 2001 (Cth), Criminal Code Act 1899 (Qld)
- Frameworks
- QGISCF
Detects internal legal assessments quantifying the State's liability exposure on specific matters (tort, contract, statutory). Disclosure reveals the State's own estimate of its likely loss, undermining defence and settlement positions across multiple related matters. Note: trainable classifier recommended for production using liability document structural features.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Evidence Act 1977 (Qld), Right to Information Act 2009 (Qld)
- Frameworks
- QGISCF
Detects bulk superannuation member data including individual balances, employer contributions, TFN-linked records, and beneficiary nominations from government super schemes such as QSuper.
- Type
- regex
- Confidence
- high
- Detection quality
- Error
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), Superannuation Industry (Supervision) Act 1993 (Cth), Taxation Administration Act 1953 (Cth)
- Frameworks
- QGISCF
Detects surrogacy arrangement records including parentage orders, surrogacy agreements, birth mother medical records, and intended parent assessments under the Surrogacy Act 2010 (Qld). These records contain deeply personal information about reproductive choices, medical procedures, and legal parentage transfers — disclosure can cause severe emotional distress and breach court-sealed parentage orders.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Information Privacy Act 2009 (Qld), Status of Children Act 1978 (Qld), Surrogacy Act 2010 (Qld)
- Frameworks
- QGISCF
Detects documents containing physical and electronic surveillance operation plans including observation post positions, equipment deployments, team compositions, and target movement tracking plans. Disclosure enables counter-surveillance by criminal targets and compromises reusable surveillance positions and techniques.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Police Powers and Responsibilities Act 2000 (Qld), Crime and Corruption Act 2001 (Qld)
- Frameworks
- ISO 27001, ISO 27701, QGISCF
Detects terrorism and national security watchlist entries including risk ratings, monitoring status, intelligence basis, and border alert configurations. Disclosure enables subjects to evade monitoring and compromises border security.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- QGISCF
Detects Thai passport numbers issued by the Department of Consular Affairs, Ministry of Foreign Affairs of Thailand. Documented formats are one letter followed by six digits (older series, e.g. A123456), two letters followed by six digits (e.g. AA123456), or two letters followed by seven digits (current e-passport series, e.g. AA1234567, nine characters total matching the MRZ document-number field). Note: the legacy A123456 / AA123456 forms are documented by a single source (Thai Wikipedia); the current AA1234567 form is corroborated independently via the MRZ document-number field.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- th
- Regulations
- PDPA (Thailand)
- Frameworks
- ISO 27001, ISO 27701
Detects เลขประจำตัวประชาชน patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- th
- Regulations
- PDPA (Thailand)
- Frameworks
- ISO 27001, ISO 27701
Detects T.C. Kimlik Numarası patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- tr
- Regulations
- KVKK (Law No. 6698 on Protection of Personal Data) (Turkey)
- Frameworks
- ISO 27001, ISO 27701
Detects Turkish (Türkiye) ordinary ("umuma mahsus", bordo/burgundy) passport numbers. New-generation ordinary passports, issued by the General Directorate of Civil Registration and Citizenship (Nüfus ve Vatandaşlık İşleri Genel Müdürlüğü, NVİ) since 2018, carry a nine-character document number consisting of the series letter "U" followed by eight digits (e.g. U12345678), printed in the top-right corner of the data page. Turkish sources report different series letters for the special/green (hususi, "S") and service/grey (hizmet, "Z") passports; those series are NOT covered by this pattern because their letter-plus-digit shape could not be independently corroborated. Ordinary bordo passports are by far the dominant variant.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- tr
- Regulations
- KVKK (Law No. 6698 on Protection of Personal Data) (Turkey), Passport Law No. 5682 (Türkiye)
- Frameworks
- ISO 27001, ISO 27701
Detects Turkey Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- tr
- Regulations
- KVKK (Law No. 6698 on Protection of Personal Data) (Turkey)
- Frameworks
- ISO 27001, ISO 27701
Detects the Turkish tax identification number (Vergi Kimlik Numarası, VKN) issued by the Turkish Revenue Administration (Gelir İdaresi Başkanlığı, GİB). The VKN is a 10-digit number structured as a 3-digit alpha group code (001-999), a 6-digit sequence number and a single check digit. Since 1 July 2006 Turkish citizens use their 11-digit T.C. Kimlik Numarası as their tax number (covered by the separate tr-national-id pattern); the 10-digit VKN remains the tax identifier for legal entities, ordinary partnerships, foreign legal entities and foreign nationals without a Foreign Identity Number.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- tr
- Regulations
- KVKK (Law No. 6698 on Protection of Personal Data) (Turkey), Law No. 4358 on Expanding the Use of Tax Identification Numbers (Türkiye), Tax Procedure Law No. 213 (Türkiye)
- Frameworks
- ISO 27001, ISO 27701
Detects proprietary trading algorithms, quantitative investment strategies, or systematic risk models used by government investment vehicles such as QIC (Queensland Investment Corporation). This deployable record is the keyword/regex fallback detector (basis-points anchor with quantitative and proprietary-marker evidence); any trainable ML classifier is a separate tenant artifact with an external identity and is not represented in this record.
- Type
- trainable_classifier
- Confidence
- high
- Jurisdictions
- global
- Regulations
- Corporations Act 2001 (Cth)
- Frameworks
- QGISCF
Detects traffic camera and speed camera infringement records containing driver identification details, vehicle registration, and photographic evidence references, and automatic number plate recognition (ANPR / ALPR) read records that place a plate at a camera site, lane, direction and time. These records link specific vehicles and individuals to locations and traffic offences via camera evidence under the Transport Operations (Road Use Management) Act 1995 (Qld). Absorbs the former automated-plate-reader-data classifier.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- State Penalties Enforcement Act 1999 (Qld), Transport Operations (Road Use Management) Act 1995 (Qld)
- Frameworks
- QGISCF
Detects 國民身分證統一編號 patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- tw
- Regulations
- PDPA (Taiwan)
- Frameworks
- ISO 27001, ISO 27701
Detects Taiwan passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- tw
- Regulations
- PDPA (Taiwan)
- Frameworks
- ISO 27001, ISO 27701
Detects Taiwan Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- tw
- Regulations
- PDPA (Taiwan)
- Frameworks
- ISO 27001, ISO 27701
Detects 外僑居留證 / 台灣地區居留證 patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- tw
- Regulations
- PDPA (Taiwan)
- Frameworks
- ISO 27001, ISO 27701
Detects Ukraine domestic passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ua
- Regulations
- Law on Personal Data Protection (Ukraine)
- Frameworks
- ISO 27001, ISO 27701
Detects Ukraine international passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- ua
- Regulations
- Law on Protection of Personal Data (Ukraine)
- Frameworks
- ISO 27001, ISO 27701
Detects Ukraine Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- ua
- Regulations
- Personal Data Protection Law (Ukraine)
- Frameworks
- ISO 27001, ISO 27701
Detects the Ukrainian individual tax number — the registration number of the taxpayer's account card (РНОКПП / RNOKPP, historically called RNTRC or ІПН), assigned by the State Tax Service of Ukraine to every individual taxpayer in the State Register of Individuals – Taxpayers. Per the OECD AEOI TIN description for Ukraine, the RNOKPP is a ten-digit numerical code (no letters, hyphens, or other symbols) with structure XXXXXNNNNK: a 5-digit birth-date registration sequence, a 4-digit account-card sequence, and a control digit.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- ua
- Regulations
- Tax Code of Ukraine, Law on Personal Data Protection (Ukraine)
- Frameworks
- ISO 27001, ISO 27701
Detects Scottish Community Health Index (CHI) 10-digit patient identifiers used by NHS Scotland.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- uk
- Regulations
- UK GDPR, Data Protection Act 2018 (UK)
- Frameworks
- ISO 27001, ISO 27701
Detects UK Companies House company registration numbers (CRNs). A company number is always 8 characters: either 8 digits (England & Wales incorporations), a 2-letter jurisdiction/entity-type prefix followed by 6 digits (e.g. SC Scottish company, NI Northern Ireland company, OC/SO/NC LLPs, RC/SR/NR royal-charter bodies, FC overseas companies, OE overseas entities), or R0 + 6 digits (pre-partition Northern Ireland companies, registered under the R0 prefix). The prefix allow-list is taken from the Companies House Uniform Resource Identifiers (URI) Customer Guide plus the post-2011 additions CE/CS (charitable incorporated organisations), SG (Scottish qualifying partnerships), OE (Register of Overseas Entities, 2022), RS (registered societies, e.g. the live entry RS008375) and FE (further education / sixth form college corporations). Bare 8-digit runs collide heavily with invoice, order and account numbers, so the all-numeric form is only ever matched when directly attached to a company-number label; the more distinctive prefixed form additionally gets a keyword-gated tier without a directly-attached label. Two allow-list prefixes are excluded from that bare prefixed form because they collide with common document-number abbreviations — NO ("INVOICE NO123456") and SO (ERP sales-order numbers such as SO123456) — and are matched only via the label-attached regex.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- uk
- Regulations
- Companies Act 2006, UK GDPR
- Frameworks
- ISO 27001, ISO 27701, SOC 2
>- This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation. Detects UK driving licence numbers. GB licences follow a 16-character format encoding surname, date of birth, and gender. Northern Ireland licences are 8-digit numbers.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- uk
- Regulations
- UK GDPR, Data Protection Act 2018 (UK)
- Frameworks
- ISO 27001, ISO 27701
Detects Electoral Roll Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- uk
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects the UK Government Security Classifications Policy (GSCP) OFFICIAL classification and its -SENSITIVE marking, written OFFICIAL-SENSITIVE and applied immediately after the OFFICIAL classification per the current policy. Matches the verified structured "CLASSIFICATION - HANDLING INSTRUCTION[- DESCRIPTOR]" format (e.g. OFFICIAL-SENSITIVE - RECIPIENTS ONLY, OFFICIAL-SENSITIVE - COMMERCIAL) using the centrally-defined GSCP handling-instruction and descriptor vocabulary, the bare OFFICIAL-SENSITIVE banner, and — at a lower, UK-government-context gated tier — bare OFFICIAL alone, which is a common English word. Regex logic verified directly against the current Government Security Classifications Policy (gov.uk, version 2.0, August 2024); matched case-sensitively so ordinary lowercase English use of "official"/"official-sensitive" does not trigger it.
- Type
- regex
- Confidence
- high
- Jurisdictions
- uk
- Regulations
- Official Secrets Act 1989
- Frameworks
- GSCP
Detects the UK Government Security Classifications Policy (GSCP) SECRET and TOP SECRET national-security classifications: the verified UK Prefix form (UK SECRET / UK TOP SECRET, applied to assets shared with foreign governments or international organisations), the classification followed by a verified National Caveat handling instruction (SECRET/TOP SECRET - UK EYES ONLY, - UK/US EYES ONLY, - FIVE EYES ONLY, per the GSCP's "CLASSIFICATION - HANDLING INSTRUCTION" additional-marking format — National Caveats apply only to SECRET and TOP SECRET, never OFFICIAL), the distinctive TOP SECRET banner-words phrase, and a UK-government-context-gated bare SECRET banner. Intended to surface content that should not reside on this platform. Regex logic verified directly against the current Government Security Classifications Policy (gov.uk, version 2.0, August 2024); matched case-sensitively.
- Type
- regex
- Confidence
- high
- Jurisdictions
- uk
- Regulations
- Official Secrets Act 1989
- Frameworks
- GSCP
Detects National Insurance Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- uk
- Regulations
- UK GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects NHS Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Mixed
- Jurisdictions
- uk
- Regulations
- UK GDPR, Data Protection Act 2018 (UK)
- Frameworks
- ISO 27001, ISO 27701
Detects Passport patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- low
- Detection quality
- Partial
- Jurisdictions
- uk
- Regulations
- UK GDPR, Data Protection Act 2018 (UK)
- Frameworks
- ISO 27001, ISO 27701
Detects UK national telephone numbers per Ofcom's National Telephone Numbering Plan: geographic numbers (01/02 prefix) and mobile numbers (07 prefix, second digit restricted to 1-5 or 7-9, plus the 07624 Isle of Man mobile range — the one mobile block inside the otherwise-excluded 076 radiopaging range, allocated to Isle of Man operators under the UK plan; 070 personal-numbering and the rest of 076 remain excluded), both as 11-digit domestic strings (leading 0 + 10 significant digits), plus the +44 international form (10 significant digits, leading 0 dropped per ITU/Ofcom convention). Digit groups after the initial prefix use a flexible per-digit optional separator rather than a single fixed grouping, because Ofcom's numbering plan allows multiple valid group-length conventions (4+6, 3+7, 2+8, 5+5) that vary by area. Two additional conventional renderings are covered: the parenthesised-area-code national notation for geographic numbers, e.g. "(020) 7946 0958" / "(01632) 960960" (ITU-T E.123 national notation, parentheses marking the optionally-dialled area code, for 2-5 digit area codes), and the widespread "+44 (0)20 7946 0958" letterhead form (a common-but-nonstandard practice — E.123 advises against the parenthesised trunk digit in international notation, but it is ubiquitous in UK signatures and letterheads, so it is matched for detection purposes). Non-geographic service numbers (03/08/09) are intentionally out of scope — they are typically organizational/service numbers rather than personal PII, mirroring how au-fixed-line-telephone scopes to geographic numbers only.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- uk
- Regulations
- UK GDPR, PECR
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects U.K. Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- uk
- Regulations
- GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects the paired UK domestic bank sort code (6 digits, written XX-XX-XX, XX XX XX, or XXXXXX) and account number (8 digits) as they normally appear together in UK bank-detail blocks (invoices, remittance advice, payroll/BACS instructions). Both digit groups must be directly attached to their own label ("sort code" / "account number" or "a/c no") in either order — bare unlabelled 6- or 8-digit sequences are never matched, because unlabelled digit sequences of this length collide heavily with dates, phone extensions, invoice numbers, and other structured identifiers.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- uk
- Regulations
- UK GDPR, Payment Services Regulations 2017
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects Unique Taxpayer Reference patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- uk
- Regulations
- UK GDPR
- Frameworks
- ISO 27001, ISO 27701
Detects United Kingdom (and Northern Ireland XI) Value Added Tax registration numbers. Standard trader numbers are GB followed by 9 digits; branch traders use GB plus 12 digits; government departments use GBGD### and health authorities GBHA###. Northern Ireland post-Brexit issues XI-prefixed numbers with the same body formats. Matching is uppercase letter prefixes as issued by HMRC.
- Type
- regex
- Confidence
- high
- Jurisdictions
- uk
- Regulations
- UK GDPR, Data Protection Act 2018 (UK), VATA 1994
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Us ABA Routing patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- us
- Regulations
- CCPA/CPRA, FTC Act, GLBA, HIPAA, SOX, State Breach Laws (US)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects USCIS Alien Registration Numbers (A-Numbers). An A-Number is the unique identifier the Department of Homeland Security assigns to a noncitizen: the letter "A" followed by 7-9 digits, written compactly (A012345678) or grouped (A-123-456-789). A-Numbers appear on Green Cards, EADs, immigration court records, and Form I-9 / E-Verify data held by virtually every U.S. employer.
- Type
- regex
- Confidence
- high
- Jurisdictions
- us
- Regulations
- State Breach Laws (US), CCPA/CPRA, FTC Act
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects U.S. Bank Account Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Financial account numbers require corroborative evidence for reliable detection due to their generic numeric format.
- Type
- regex
- Confidence
- low
- Detection quality
- Verified
- Jurisdictions
- us
- Regulations
- CCPA/CPRA, FTC Act, GLBA, HIPAA, SOX, State Breach Laws (US)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects U.S. national-security classification banner and portion markings (per Executive Order 13526 and the Intelligence Community marking system): a classification level — TOP SECRET, SECRET, CONFIDENTIAL — followed by one or more "//"-separated control or dissemination markings (SI, TK, HCS, SCI, SAP, NOFORN, ORCON, REL TO ...), or a parenthetical portion mark such as (S//NF) or (TS//SI). The bare words "secret" and "confidential" are far too common to match alone, so a match requires the "//" control structure or a parenthetical portion mark.
- Type
- regex
- Confidence
- high
- Jurisdictions
- us
- Regulations
- Executive Order 13526, FISMA
- Frameworks
- NIST SP 800-53, NIST CSF, ISO 27001, SOC 2
Detects Controlled Unclassified Information (CUI) banner and portion markings as defined by 32 CFR 2002.20 and the NARA CUI Registry. A CUI banner is the control marking "CUI" optionally followed by category markings (CUI//SP-PRVCY) and limited-dissemination controls (//NOFORN, //FEDCON, //FED ONLY, //NOCON, //DL ONLY, //REL TO ...), with elements separated by double slashes. The bare token "CUI" is too common to match alone, so a match requires either the "//" banner structure or the spelled-out phrase "Controlled Unclassified Information".
- Type
- regex
- Confidence
- high
- Jurisdictions
- us
- Regulations
- 32 CFR 2002, FISMA
- Frameworks
- NIST CSF, ISO 27001, SOC 2, NIST SP 800-171
Detects DEA patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- us
- Regulations
- CCPA/CPRA, FTC Act, HIPAA, State Breach Laws (US)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects Impairments Listed In The U.S. Disability Evaluation Under Social Security patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- us
- Regulations
- CCPA/CPRA, FTC Act, HIPAA, State Breach Laws (US)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
A multi-state helper for detecting U.S. driver's license numbers using the real structural formats of several high-population states, rather than the broad "letter + 7-12 digits" catch-all. Covers California, New York, Texas, Florida, New Jersey, and Illinois. This is a companion to the generic us-drivers-license pattern (which it does not replace); use it when you want tighter, state-aware matching for those jurisdictions.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- us
- Regulations
- State Breach Laws (US), CCPA/CPRA
- Frameworks
- ISO 27001, ISO 27701
Detects U.S. driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- us
- Regulations
- CCPA/CPRA, State Breach Laws (US)
- Frameworks
- ISO 27001, ISO 27701
Detects Employer Identification Number patterns.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- us
- Regulations
- CCPA/CPRA
- Frameworks
- ISO 27001, ISO 27701
Detects student identifiers that appear in education records protected under the Family Educational Rights and Privacy Act (FERPA). Student ID formats are institution-specific, so this pattern anchors on an explicit student/enrolment/SIS context label immediately preceding a 6-12 character alphanumeric ID, and relies on education-record keywords (transcript, GPA, enrollment, registrar) for corroboration.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- us
- Regulations
- FERPA, State Breach Laws (US), CCPA/CPRA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects US Individual Taxpayer Identification Numbers (ITINs) issued by the IRS to individuals who are required to have a US taxpayer identification number but are not eligible for a Social Security Number. ITINs always begin with the digit 9, and the fourth and fifth digits fall in the range 70-99, distinguishing them from SSNs. The pattern matches both formatted (9XX-7X-XXXX) and unformatted (9XX7XXXXX) variants.
- Type
- regex
- Confidence
- high
- Detection quality
- Mixed
- Jurisdictions
- us
- Regulations
- CCPA/CPRA, FTC Act, GLBA, HIPAA, SOX, State Breach Laws (US)
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS, SOC 2
Detects labelled U.S. Medicaid member or recipient identification numbers. Medicaid ID formats are not standardised nationally — they vary by state in length and composition (typically 8-12 alphanumeric characters) — so this pattern anchors on an explicit Medicaid/recipient context label immediately preceding the ID rather than on a fixed structure.
- Type
- regex
- Confidence
- high
- Jurisdictions
- us
- Regulations
- HIPAA, State Breach Laws (US), CCPA/CPRA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
'Detects MBI patterns. Excluded letters: S, L, O, I, B, Z.' This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- high
- Detection quality
- Verified
- Jurisdictions
- us
- Regulations
- CCPA/CPRA, FTC Act, HIPAA, State Breach Laws (US)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects US National Provider Identifier (NPI) values structurally: a ten-digit number beginning with 1 or 2. Detection is structural only — the NPI Luhn checksum (80840 prefix) is NOT enforced. Confidence comes from healthcare context tiers (NPI-specific terms at 85, broader provider/claims context at 75, bare shape discovery-only at 65), and an all-same-digit guard rejects repeated-digit values such as 1111111111.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- us
- Regulations
- CCPA/CPRA, FTC Act, HIPAA, State Breach Laws (US)
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects US passport numbers in exactly two accepted formats: a nine-digit numeric value (older US passports), or a single uppercase letter followed by exactly eight digits (newer passport books and cards). Bare eight-digit values and letter-plus-nine-digit values are not valid US passport numbers. Due to the relatively simple format, corroborative keyword proximity is strongly recommended to reduce false positives. Keywords are US-scoped (passport / US passport / State Department); foreign-passport labels are not treated as US passport evidence.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- us
- Regulations
- CCPA/CPRA, HIPAA, State Breach Laws (US)
- Frameworks
- ISO 27001, ISO 27701
Detects North American Numbering Plan (NANP) telephone numbers in US contexts: the domestic NPA-NXX-XXXX form (bracketed, hyphenated, dotted, spaced, or bare, with an optional leading trunk "1") and the international +1 NPA-NXX-XXXX form. Area-code (NPA) and exchange-code (NXX) groups are constrained to a leading digit of 2-9 with the N11 service-code shape (211/311/411/511/611/711/811/911) excluded from both groups, per NANPA's published format rules. NANP area codes are drawn from a single pool shared by the US, Canada, and Caribbean member territories — the digit structure itself cannot distinguish a US number from a Canadian one (see ca-phone-number for the sibling pattern). Differentiation between the two patterns is by jurisdiction/regulation metadata and country-specific corroborative evidence keywords only, not by regex — this is the documented convention for the whole NANP pair.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- us
- Regulations
- CCPA/CPRA, TCPA
- Frameworks
- ISO 27001, ISO 27701, SOC 2
Detects U.S. Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- us
- Regulations
- CCPA/CPRA
- Frameworks
- ISO 27001, ISO 27701
Detects US Social Security Numbers (SSNs) in both formatted (XXX-XX-XXXX) and unformatted (XXXXXXXXX) representations. The pattern excludes invalid SSN ranges including area numbers 000, 666, and 900-999, group numbers 00, and serial numbers 0000, in accordance with SSA assignment rules. SSNs are critical PII used across healthcare, financial, and government contexts.
- Type
- regex
- Confidence
- high
- Detection quality
- Mixed
- Jurisdictions
- us
- Regulations
- CCPA/CPRA, GLBA, HIPAA, SOX
- Frameworks
- ISO 27001, ISO 27701, PCI-DSS
Detects Vietnam Citizen Identity Card numbers (Căn cước công dân / CCCD). Modern chip-card numbers are 12 digits beginning with 0, embedding gender/century and place-of-birth codes.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- vn
- Regulations
- Cybersecurity Law (Vietnam), Personal Data Protection Decree 13/2023
- Frameworks
- ISO 27001, ISO 27701
Detects bulk payment authorisation files extracted from government ERP systems (SAP, Oracle, TechnologyOne) containing payee bank accounts, payment amounts, and authorisation codes for batch processing.
- Type
- regex
- Confidence
- high
- Detection quality
- Error
- Jurisdictions
- au
- Regulations
- Financial Accountability Act 2009 (Qld)
- Frameworks
- QGISCF
Detects documents containing witness protection program records including new identities, relocation details, and safe house locations for protected witnesses. Disclosure directly endangers the lives of witnesses and their families who have testified against violent criminals.
- Type
- keyword_proximity
- Confidence
- medium
- Jurisdictions
- au
- Regulations
- Crime and Corruption Act 2001 (Qld), Police Powers and Responsibilities Act 2000 (Qld), Witness Protection Act 2000 (Qld)
- Frameworks
- QGISCF
Detects Id Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Confidence
- medium
- Detection quality
- Verified
- Jurisdictions
- za
- Regulations
- POPIA
- Frameworks
- ISO 27001, ISO 27701
Detects South African passport numbers issued by the Department of Home Affairs under the South African Passports and Travel Documents Act 4 of 1994. Passport numbers are nine characters: one uppercase prefix letter identifying the passport type — A (normal/tourist), M (maxi), E (official), D (diplomatic), T (travel document) — followed by eight digits (SARS documents current issuance as starting A0, M0, E0).
- Type
- regex
- Confidence
- medium
- Jurisdictions
- za
- Regulations
- POPIA, South African Passports and Travel Documents Act 4 of 1994
- Frameworks
- ISO 27001, ISO 27701
Detects South Africa Physical Addresses patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that uses machine learning and function-based detection for physical address identification. This keyword list provides address-related terms for supplementary matching.
- Type
- keyword_list
- Confidence
- low
- Jurisdictions
- za
- Regulations
- POPIA
- Frameworks
- ISO 27001, ISO 27701
Detects South African income tax reference numbers (TIN) allocated by the South African Revenue Service (SARS) under section 24 of the Tax Administration Act, 2011. The number is ten digits, may only start with 0, 1, 2, 3 or 9, and its tenth digit is a check digit computed with a modulus-10 (Luhn-style) algorithm documented by SARS.
- Type
- regex
- Confidence
- medium
- Jurisdictions
- za
- Regulations
- POPIA, Tax Administration Act 2011 (South Africa)
- Frameworks
- ISO 27001, ISO 27701