Social security number

Identifies documents containing references to social security number in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.

Type: regex
Engine: boost_regex
Confidence: low
Confidence justification: Low confidence marker: phrase-based artifact detection to bootstrap line-by-line coverage. Requires corroborative evidence and later hardening to high-confidence structural patterns.
Detection quality: Topic verified
Jurisdictions: global
Regulations: Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
Frameworks: ISO 27001, ISO 27701
Data categories: government-id, pii
Scope: wide
Risk rating: 5
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible

Pattern

\bsocial\s+security\s+number\b

Corroborative evidence keywords

social security number, social, security, number, government, ids, civil, status, ID number, identification, ID card, license, permit, registration, certificate

Proximity: 300 characters

Should match

Social security number — Exact phrase marker match
social security number — Case-insensitive phrase match
Social security number — Normalized whitespace phrase
social security number: Recorded Name: Avery Teston Date of birth: 14/02/1988 — Populated attribute field with a linked record field (85 tier)

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match phrase marker
social security number: Name: Date of birth: — Empty form: the heading and field labels without values must not corroborate themselves (discovery only)
Policy guidance: this procedure explains how records about social security number are handled, who may access them and how long they are kept. It contains no records about any person or system. — Policy guidance naming the topic without any record (discovery only)
social security number: Name: Avery Teston — Record with the attribute label but no value: the label must not corroborate itself (discovery only)

Known false positives

Common words and phrases related to social security number appearing in policy documents, training materials, HR templates, or compliance guidelines without actual personal data. Mitigation: Require corroborative evidence keywords within the proximity window to confirm sensitive data context rather than general discussion.
In Australian English, similar terminology used in formal or administrative contexts (education, professional documentation) that does not constitute sensitive data collection. Mitigation: Layer with additional contextual signals such as structured identifiers, form fields, or database column headers to distinguish sensitive records from general references.
High-frequency pattern matches in large document corpora due to broad regex anchors. Expected match rate is significantly higher than specific identifier patterns. Mitigation: Tune confidence thresholds for bulk scanning. Consider using this pattern primarily as a pre-filter with secondary validation.