Carte Nationale d'Identité

Detects Carte Nationale d'Identité patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.

Type

regex

Engine

universal

Confidence

medium

Confidence justification

Medium confidence: pattern has structural constraints but corroborative keywords are recommended to reduce false positive rates. Context label evidence plus explicit template/example exclusion improves precision for high-risk identifiers. Added context gating and exclusion rules improve precision and reduce incidental matches.

Detection quality

Verified

Jurisdictions

eu, fr

Regulations

BDSG, CNIL / LIL, GDPR

Frameworks

ISO 27001, ISO 27701

Data categories

pii, government-id

Scope

narrow

Risk rating

9

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible

Pattern

\b\d{12}\b

Corroborative evidence keywords

carte nationale, CNI, carte d'identité, ID number, identification, ID card, license, permit, registration, certificate, field, column, row, entry, record, value, form, register, database, extract (+19 more)

Proximity: 300 characters

Should match

• 123456789012 — Twelve-digit French CNI number
• 987654321098 — Another twelve-digit CNI
• 456789012345 — Valid format CNI number

Should not match

• 12345678901 — Too few digits (11)
• 1234567890123 — Too many digits (13)
• sample template placeholder number 123456789 — Template/sample context should be excluded even when numeric-like values appear
• template example placeholder record identifier — Template/sample context should be excluded even when anchor words are present

Known false positives

• Twelve-digit numeric sequences may match account numbers, transaction IDs, or other administrative references. Mitigation: Require corroborative evidence keywords such as "carte nationale d'identité" or "CNI" within the proximity window.
• In multiple languages, similar terminology used in formal or administrative contexts (education, professional documentation) that does not constitute sensitive data collection. Mitigation: Layer with additional contextual signals such as structured identifiers, form fields, or database column headers to distinguish sensitive records from general references.

References

• France National ID Card (CNI) entity definition - Microsoft Learn