Passport

Detects Passport patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.

Type

regex

Engine

universal

Confidence

low

Confidence justification

Low confidence: generic pattern format that may match unrelated data. Corroborative evidence keywords are essential for reliable detection. Context label evidence plus explicit template/example exclusion improves precision for high-risk identifiers. Added context gating and exclusion rules improve precision and reduce incidental matches.

Detection quality

Partial

Jurisdictions

uk

Frameworks

ISO 27001, ISO 27701

Data categories

pii, government-id

Scope

wide

Risk rating

8

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible

Pattern

\b\d{9}\b

Corroborative evidence keywords

passport, passport number, travel document, australian passport, ID number, identification, ID card, license, permit, registration, certificate, field, column, row, entry, record, value, form, register, database (+20 more)

Proximity: 300 characters

Should match

• 123456789 — UK passport number (9 digits)
• 987654321 — Alternate UK passport number
• 501234567 — Mid-range UK passport number

Should not match

• 12345678 — Only 8 digits instead of 9
• 1234567890 — 10 digits instead of 9
• 12345678A — Contains a letter instead of all digits
• sample template placeholder number 123456789 — Template/sample context should be excluded even when numeric-like values appear
• template example placeholder record identifier — Template/sample context should be excluded even when anchor words are present

Known false positives

• Common words and phrases related to passport appearing in policy documents, training materials, HR templates, or compliance guidelines without actual personal data. Mitigation: Require corroborative evidence keywords within the proximity window to confirm sensitive data context rather than general discussion.
• In British English, similar terminology used in formal or administrative contexts (education, professional documentation) that does not constitute sensitive data collection. Mitigation: Layer with additional contextual signals such as structured identifiers, form fields, or database column headers to distinguish sensitive records from general references.
• High-frequency pattern matches in large document corpora due to broad regex anchors. Expected match rate is significantly higher than specific identifier patterns. Mitigation: Tune confidence thresholds for bulk scanning. Consider using this pattern primarily as a pre-filter with secondary validation.

References

• U.S./U.K. passport number entity definition - Microsoft Learn

Collections

• European National IDs