PII data-flow maps

Identifies maps or inventories that trace personal-data movement between systems — populated source-to-destination flow edges naming personal-data categories. PII-processing topic language (privacy notices, data-processing prose) without flow/lineage structure is discovery-only. This is privacy architecture / data-lineage content, not credential material.

Type

regex

Engine

boost_regex

Confidence

medium

Confidence justification

category-aware structural regex with anchor and context constraints replaces phrase-only detection.

Detection quality

Topic false positive

Jurisdictions

global

Regulations

NDB Scheme (Cth), SOCI Act 2018 (Cth), TIA Act 1979 (Cth), GDPR

Frameworks

CIS Controls, DISP, ISO 27001, NIST CSF, PCI-DSS, SOC 2

Data categories

privacy, sensitive-data

Scope

wide

Risk rating

8

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?is)\b(?:pii\s+data[\s-]+flow\s+maps|data\s+flow|pii\s+mapping|personal\s+information|data\s+lineage|data\s+inventory|privacy\s+impact|data\s+processing|data\s+subject|information\s+flow|data\s+architecture)\b

Corroborative evidence keywords

pii data-flow maps, pii, data, flow, maps, software, engineering, architecture

Proximity: 300 characters

Should match

• pii data-flow maps — Primary topic phrase match
• data flow — Case-insensitive topic phrase match
• pii mapping — Alternative topic phrase match
• personal information — Additional topic phrase match
• Source: Web signup -> Destination: CRM via API; data: name, email address, customer ID; store: AU-East SQL; retention: 7 years. — Populated source-to-destination flow edge naming PII categories, transfer method, store, and retention (enforcement branch)

Should not match

• unrelated generic text without domain phrases — No relevant topic phrases present
• Privacy policy: we process personal information fairly. — Processing-principles prose without a mapped flow must not enforce (discovery-only)
• The river data flow model predicts water levels. — Hydrology data-flow prose is not a PII flow map and must not enforce
• Privacy workshop sample map: Source A -> CRM, example email. — Workshop/sample/example instructional content must not enforce
• placeholder value 12345 — Random text should not match topic-specific regex
• source code config — Generic word pair from old broad template should not match

Known false positives

• Authentication-related terminology in software documentation, security training materials, or system architecture descriptions without actual credentials. Mitigation: Require proximity to credential-specific patterns (API keys, connection strings, tokens) rather than general security terminology.
• Code snippets and configuration examples containing credential-related keywords or placeholder values in developer documentation. Mitigation: Check for common placeholder patterns (example.com, localhost, 0000) and documentation file types to reduce false positives from technical writing.

References

• https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism
• https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight
• https://www.oaic.gov.au/privacy/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information