Privacy assessment: find the personal data in your documents

Most organisations hold more personal data than they realise, and much of it sits in documents rather than databases: contracts, HR letters, scanned forms, case files. DOCNUS privacy assessment reads each document you upload, finds the personal data in it, and tells you which privacy laws are likely to apply and what that means. It is available on the Professional and Enterprise plans.

What it looks for

DOCNUS detects 50 personal-data categories, organised into 13 groups.

Several of these groups line up with what UK and EU law calls special category data under Article 9(1) of the UK GDPR, such as health, religious belief, trade union membership and sexual orientation. Criminal records fall under the separate rules for criminal offence data in Article 10. If you are new to the terms, our guide to what counts as PII and personal data explains the difference.

Two detection layers

A single method is not good enough for this job. Identifiers like an IBAN have a strict format, while a sentence such as "she has been off work since her diagnosis" does not. DOCNUS uses two layers and records which one produced each finding.

Layer 1: deterministic checks

The first layer uses pattern matching followed by checksum or format validation. This covers identifiers such as UK National Insurance numbers, NHS numbers, UTRs, IBANs, payment card numbers (checked with the Luhn algorithm), US Social Security numbers, EU VAT numbers and national IDs from many countries. It also picks up email addresses, phone numbers and IP addresses. Validation cuts down false matches, so a number is not reported as a card number simply because it has the right number of digits. You can try this layer on your own text, free and without an account, with the Personal Data Checker.

Layer 2: an AI model reading the text

The second layer uses an AI model (Anthropic Claude) to read the document the way a person would. It finds names, addresses and sensitive information written in ordinary prose, such as health details or political views. It also notes signals that matter for compliance: retention wording, consent wording, privacy notices and mentions of data transfers.

Seven laws, four verdicts

The AI finds facts. Code decides what they mean in law. Verdicts come from versioned regulation packs, not from the model, which is the approach we describe in AI finds facts, code decides the law.

DOCNUS assesses documents against seven laws:

• EU GDPR
• UK GDPR, together with the Data Protection Act 2018
• California CCPA/CPRA
• A US state baseline modelled on Virginia's VCDPA (this is a baseline, not a check of each US state)
• Brazil LGPD
• China PIPL
• India DPDP

Which laws apply to a document is worked out from jurisdiction signals in it. Where a signal is weak, the law is shown as "possible" and not evaluated. If nothing points to one of the seven, a generic baseline is used as a fallback and is clearly labelled "not verified against local law".

Each applicable law produces one of four verdict levels:

Every verdict also has a risk score from 0 to 100 and cites the articles it relies on.

An example

Suppose an HR folder contains a sick-note letter that mentions an employee's diagnosis. Under the UK GDPR, the assessment would flag health data as special category data and return non-compliant / high risk, citing Article 9(1) and 9(2) and, for the UK, Schedule 1 of the Data Protection Act 2018. If the same folder held a letter about a criminal conviction, that finding would be marked attention required under Article 10.

Other findings follow the same logic. Government IDs, financial data, credentials and data about minors or vulnerable adults raise the risk level. Everything else is treated as standard personal data under Articles 4(1) and 6(1). The assessment also surfaces related obligations where relevant, such as a DPIA under Article 35(3), transparency under Articles 13 and 14, storage limitation under Article 5(1)(e), international transfers under Chapter V, and the subject access deadline under Article 12(3). See our UK GDPR overview for more on each.

The document-level result

For each document you see the strictest verdict across all laws, which law drove it, the special categories found, an estimated number of data subjects, and coverage (how many pages were assessed out of the total).

What we store, and what we don't

A tool that finds personal data should not create a new copy of it. For each finding DOCNUS stores:

• the category
• a masked value, for example j***@***.uk
• the page and character position
• which detector found it
• a keyed HMAC-SHA256 fingerprint

The raw value is never stored in the findings, and the raw model response is not kept. The fingerprint is a one-way keyed hash, so it cannot be turned back into the value. Masking is not the same as pseudonymisation, and a masked value can still be personal data. We explain the design in Why we never store the value we found.

To be clear, the document itself and its extracted text are stored, because that is how search works. Deleting a document removes its file, text, search index entries and graph data. More detail is on our security page.

Asking questions about the results

You can ask the DOCNUS chat about your stored assessments, for example how many documents contain health data or which ones have an attention required verdict. Chat answers with counts, categories, verdicts and deadlines. It never returns the raw personal values.

Limits you should know about

• Plans. Privacy assessment is available on Professional and Enterprise only, and works the same on both. It is not included on the Free plan. See pricing.
• Pages per document. Each document is assessed up to 100 pages. Longer documents are marked "partial", and the coverage figure shows how much was assessed.
• Monthly allowance. Each plan has a monthly analysis page allowance (2,000 pages on Professional, 5,000 on Enterprise). Documents over the allowance wait until the next month.
• Not legal advice. This is an automated risk assessment. Every result says so. It helps you find where personal data sits and what to look at first, but it does not replace a qualified person's judgement.
• Review the results. No automated tool catches everything, and some findings will need context only you have. Treat the assessment as a starting point for review.

If you are using the assessment to support a subject access request, our DSAR guide shows where it fits and where it does not.