CPR-nummer

Detects CPR-nummer patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.

Type

regex

Engine

universal

Confidence

medium

Confidence justification

Medium confidence: pattern has structural constraints but corroborative keywords are recommended to reduce false positive rates. Context label evidence plus explicit template/example exclusion improves precision for high-risk identifiers. Added context gating and exclusion rules improve precision and reduce incidental matches.

Detection quality

Verified

Jurisdictions

eu, dk

Regulations

BDSG, CNIL / LIL, GDPR

Frameworks

ISO 27001, ISO 27701

Data categories

pii, government-id

Scope

narrow

Risk rating

9

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible

Pattern

\b\d{6}-?\d{4}\b

Corroborative evidence keywords

CPR, personnummer, personal identification, ID number, identification, ID card, license, permit, registration, certificate, field, column, row, entry, record, value, form, register, database, extract (+19 more)

Proximity: 300 characters

Should match

• 010175-1234 — CPR number with dash
• 1201881234 — CPR number without dash
• 150392-5678 — Another CPR number with dash

Should not match

• 01017-1234 — Too few digits in first part
• 010175-12345 — Too many digits in second part
• sample template placeholder number 123456789 — Template/sample context should be excluded even when numeric-like values appear
• template example placeholder record identifier — Template/sample context should be excluded even when anchor words are present

Known false positives

• Ten-digit sequences with optional dash may match dates, phone numbers, or administrative reference codes. Mitigation: Require corroborative evidence keywords such as "CPR" or "personnummer" within the proximity window.
• In multiple languages, similar terminology used in formal or administrative contexts (education, professional documentation) that does not constitute sensitive data collection. Mitigation: Layer with additional contextual signals such as structured identifiers, form fields, or database column headers to distinguish sensitive records from general references.

References

• Denmark Personal Identification Number entity definition - Microsoft Learn