Recommendation letters

Identifies recommendation and reference letters about a named person - letters of recommendation or reference, referee reports and academic, character, professional or supervisor references - when the phrase sits with a named candidate and letter structure.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium: enforce tiers need a named candidate; 85 also needs letter structure and evaluative language. Referee guidance, reference-check policies and job ads stay at 65; unframed fictional letters can still reach enforce tiers.
Detection quality: Topic verified
Jurisdictions: global
Regulations: Privacy Act 1988 (Cth), NDB Scheme (Cth), GDPR, FERPA
Frameworks: ISO 27001, ISO 27701
Data categories: pii
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:recommendation\s+letters?|letters?\s+of\s+(?:recommendation|reference)|referee\s+report|(?:academic|character|professional|supervisor)\s+reference|faculty\s+recommendation)\b

Corroborative evidence keywords

strongly recommend, highly recommend, without reservation, work ethic, research potential, intellectual curiosity

Proximity: 300 characters

Should match

Letter of recommendation Dear Admissions Committee, I have known Avery Teston since 2023, when she joined my honours seminar. She ranks in the top 2 percent of students I have supervised and shows real research potential. I recommend her without reservation. Yours sincerely, Dr Jordan Staffson — Populated recommendation letter with a named candidate, letter structure and evaluative language (85)
Referee report Candidate: Casey Rourke Position applied for: Research Officer — Referee report header with a named candidate only (75)
Professional reference To whom it may concern, I have known Morgan Tillbrook for six years, the last four as her line manager in our Townsville logistics team. Her work ethic is exceptional and she led the depot rostering overhaul with no loss of service. I highly recommend Morgan for the Operations Coordinator role. Yours faithfully, P. Lindqvist, Regional Manager — Professional reference using an 'I have known <Name> for' statement, 'To whom it may concern' and evaluative language (85)

Should not match

unrelated generic text without domain phrases — No relevant topic phrases present
placeholder value 12345 — Random text should not match topic-specific regex
student grant — Generic word pair from old broad template should not match
reference check results — Generic vendor/HR term removed from the regex (2026-07 FP fix) after proving overbroad — matched in unrelated vendor due-diligence decoy documents
personal statement — Generic term removed from the regex (2026-07 FP fix) — not specific to the recommendation-letters domain
Policy guidance: this procedure explains how recommendation letters and referee reports are collected, stored and shared, who may access them and how long they are kept. Staff should read the privacy section before completing any form. It contains no details about any individual. — Policy/guidance text naming the topic without any populated record (65 discovery at most)
Referee report Candidate name: ____________________ Position applied for: ____________________ Referee name: ____________________ Signature: ____________ Date: __/__/____ — Blank form with unpopulated labelled fields (placeholder guard keeps it below 75)
Training: this careers workshop explains how to ask for a letter of recommendation, what makes a strong academic reference and why you should thank your referees. — News/training prose about the topic without a populated record (65 discovery at most)

Known false positives

Common words and phrases related to recommendation letters appearing in policy documents, training materials, HR templates, or compliance guidelines without actual personal data. Mitigation: Require corroborative evidence keywords within the proximity window to confirm sensitive data context rather than general discussion.
In English (as the primary international business language), similar terminology used in formal or administrative contexts (education, professional documentation) that does not constitute sensitive data collection. Mitigation: Layer with additional contextual signals such as structured identifiers, form fields, or database column headers to distinguish sensitive records from general references.
High-frequency pattern matches in large document corpora due to broad regex anchors. Expected match rate is significantly higher than specific identifier patterns. Mitigation: Tune confidence thresholds for bulk scanning. Consider using this pattern primarily as a pre-filter with secondary validation.