Employment/HR Sensitive Data

Detects sensitive employment case records about an identified worker: workplace investigations, disciplinary action and show cause notices, grievance and harassment complaints, workers compensation and return to work plans, termination and redundancy notices.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium: the primary phrases also appear in policies, guidance, blank forms and news, so enforce tiers require a populated person field and 85 adds a record-specific populated detail plus independent corroboration. Person values are customer-defined (employee IDs, position numbers), so the field regexes use labelled loose values with a placeholder guard. 85/75 are heuristic evidence tiers, not measured accuracy.
Jurisdictions: global
Regulations: Fair Work Act 2009 (Cth), Public Sector Act 2022 (Qld), Work Health and Safety Act 2011 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth)
Frameworks: ISO 27001, ISO 27701
Data categories: pii, employment, sensitive-data
Scope: narrow
Risk rating: 7
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:disciplinary\s+action|performance\s+review|workplace\s+(?:investigation|bullying|misconduct)|termination\s+(?:letter|notice)|unfair\s+dismissal|workers?'?\s+compensation|grievance\s+(?:process|procedure|complaint)|harassment\s+complaint|return\s+to\s+work\s+plan|redundancy\s+notice|show\s+cause\s+notice|work\s+capacity\s+certificate)\b

Corroborative evidence keywords

witness, medical certificate, procedural fairness, support person, natural justice, rehabilitation, diagnosis, WorkCover, treating doctor, investigator

Proximity: 300 characters

Should match

Workplace investigation - findings Subject employee: Avery Teston Case number: WI-2026-044 Allegation 1: Inappropriate comments to a colleague on 12/08/2026. Finding: Substantiated. Two witness interviews held; procedural fairness letter issued. — 85: Investigation findings with subject employee, allegation, case number and finding
Workers' compensation claim update Employee ID: 5520117 Claim number: WC4471820 Date of injury: 03/07/2026 Rehabilitation: fit for suitable duties from 01/09/2026; WorkCover notified. — 85: Workers compensation claim update with claim number and injury date
Return to work plan Worker: Jordan Staffson Graduated hours agreed with the treating doctor, reviewed fortnightly. — 75: Return to work plan naming the worker, no case detail

Should not match

This policy explains how a workplace investigation is run and how disciplinary action is decided, including procedural fairness. — Policy text - must stay below 75
Termination letter Employee name: __________ Termination date: ___/___/____ Reason: __________ — Blank letter template - must stay below 75
The Commission heard an unfair dismissal claim from a former council worker, according to a media release. — News / media release - must stay below 75
HR department phone number — No HR sensitive phrase matched by the Purview regex
Employment opportunities available — No HR sensitive phrase present

Known false positives

Policies, directives, fact sheets, guidance and training material that name the record type. Mitigation: Enforce tiers require a populated person field; guidance text has labels without values and guidance/training/media-release framing is excluded.
Blank forms, templates and HR system configuration. Mitigation: Blank lines, square- and angle-bracket placeholders, XXX and n/a/tbc values are rejected by the placeholder guard; template/fixture words are excluded.
Aggregate statistics and news reporting. Mitigation: No populated person field, so these stay at 65 discovery.
Records that identify the person only in free text (no field label) fall to 65. Mitigation: Accepted precision trade-off; extend the person-field regex with the customer employee-id format to recover recall.