pii detection (personal identifiable information)

**PII Detection (Personal Identifiable Information)** is the automated process of identifying and optionally **redacting** sensitive personal data in text — such as names, addresses, phone numbers, social security numbers, email addresses, and financial information. It is essential for **data privacy**, **regulatory compliance**, and **AI safety**. **Types of PII Detected** - **Direct Identifiers**: Full names, Social Security numbers, passport numbers, driver's license numbers — data that uniquely identifies a person. - **Contact Information**: Email addresses, phone numbers, physical addresses, IP addresses. - **Financial Data**: Credit card numbers, bank account numbers, financial records. - **Health Information**: Medical record numbers, diagnoses, treatment details (protected under **HIPAA** in the US). - **Biometric Data**: Fingerprints, facial recognition data, voiceprints. - **Quasi-Identifiers**: Combinations of data (zip code + birth date + gender) that can re-identify individuals. **Detection Methods** - **Pattern Matching**: Regular expressions for structured PII like phone numbers (`\d{3}-\d{3}-\d{4}`), SSNs, credit card numbers, and email addresses. - **NER (Named Entity Recognition)**: ML models trained to identify names, locations, organizations, and other entity types in unstructured text. - **Specialized PII Models**: Purpose-built models like **Microsoft Presidio**, **AWS Comprehend PII**, and **Google DLP** that combine pattern matching with ML for comprehensive detection. - **LLM-Based**: Prompt large language models to identify and classify PII, useful for complex or contextual cases. **Actions After Detection** - **Redaction**: Replace PII with placeholder text (e.g., "[NAME]", "[EMAIL]", "***-**-1234"). - **Masking**: Partially obscure PII while preserving format. - **Tokenization**: Replace PII with reversible tokens for authorized de-identification. - **Alerting**: Flag documents containing PII for human review. **Regulatory Drivers** PII detection is mandated by **GDPR** (EU), **CCPA** (California), **HIPAA** (US healthcare), and many other privacy regulations. Failure to protect PII can result in **significant fines** and reputational damage.