Payroll system access logs

Detects references to payroll system access logs in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.

Type: regex
Engine: boost_regex
Confidence: low
Confidence justification: Low confidence marker: phrase-based artifact detection to bootstrap line-by-line coverage. Requires corroborative evidence and later hardening to high-confidence structural patterns. Added context gating and exclusion rules improve precision and reduce incidental matches.
Detection quality: Topic verified
Jurisdictions: global
Regulations: GDPR, AML/CTF Act (Cth), IPA 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), SOCI Act 2018 (Cth)
Data categories: financial
Scope: wide
Risk rating: 4
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible

Pattern

\bpayroll\s+system\s+access\s+logs\b

Corroborative evidence keywords

payroll system access logs, payroll, system, access, logs, tax, operations, employee, benefits, termination, hire date, salary, compensation, 401k, [object Object], [object Object], superannuation, police check, working with children check, WWCC (+81 more)

Proximity: 300 characters

Should match

Payroll system access logs — Topic phrase present
payroll system access logs — Topic phrase, lowercase
this record references the payroll system access logs held on file — Topic phrase within surrounding text

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match phrase marker
template example placeholder record identifier — Template/sample context should be excluded even when anchor words are present

Known false positives

Financial terminology appearing in published reports, accounting textbooks, regulatory guidance, or template documents without actual transaction data. Mitigation: Require corroborative evidence keywords within the proximity window. Cross-reference with structured financial identifiers to confirm actual sensitive data.
In English (as the primary international business language), standard business terminology overlapping with financial detection keywords in routine correspondence and documentation. Mitigation: Increase confidence threshold when scanning business correspondence. Layer with transaction-specific patterns for higher precision.