Free Personal Data Checker

What the checker finds

The checker looks for identifiers: numbers and codes that point to one person. It finds:

• UK numbers: NHS numbers, National Insurance numbers and Unique Taxpayer References
• Financial details: IBANs and payment card numbers
• Contact and online details: email addresses, phone numbers and IPv4 addresses
• Other countries' IDs: US Social Security numbers, EU VAT numbers, and national, tax and social security numbers from 15 other countries: Italy, Spain, France, Germany, the Netherlands, Poland, Brazil, India, China, South Korea, South Africa, Turkey, Canada, Australia and Mexico

These are the same deterministic checks that run first in DOCNUS privacy assessment.

How it works

Each check runs in two steps. First, a pattern finds anything with roughly the right shape. Then a validator decides whether it is real. Where an identifier has a check digit, the checksum has to pass. Card numbers also need a real issuer prefix and length before the Luhn check runs. So a 16-digit order number is not reported as a card just because it has 16 digits.

Each result says how it was confirmed:

• Checksum verified: the number passed its check digit. False matches are rare.
• Format match: the identifier has no check digit, so only its format was tested. This applies to National Insurance numbers, email addresses, phone numbers and IP addresses.

Results show masked values, such as ****5432, and never the full number. If the same identifier appears more than once, it is listed once with a count.

What the results mean

Each identifier is placed in a tier under the UK GDPR and the EU GDPR. The tiers come from the same regulation packs DOCNUS uses for full document assessments.

The summary for each law shows the most serious tier found. This is a risk assessment, not a ruling. Whether your use of the data is lawful depends on why you hold it and what you do with it, which a scan of text can't tell you. The ICO's guide to lawful basis is a good place to start.

What it doesn't find

It is worth knowing the limits before you rely on a clean result:

• Names, postal addresses and dates of birth. These have no fixed format, so a pattern can't find them reliably.
• Sensitive details written in words. "She has been off sick since her diagnosis" is health data, but no pattern will find it. See special category data for what falls into this group.
• Phone numbers without a country code. Only international numbers like +44 20 7946 0958 are found. Without the code, a local number could belong to any country.
• Numbers without a label nearby. Some identifiers are just a run of digits, such as NHS numbers, UTRs and several national IDs. These are only reported when a label like "NHS" or "UTR" appears near them, because a bare 10-digit number is more often a reference than an ID.

So "no identifiers found" does not mean the text holds no personal data. For a broader definition, see what counts as PII and personal data.

What happens to your text

The text goes to our server over HTTPS and is checked in memory. Nothing is written to a database, a file or a cache. It is not sent to an AI model or to any third party. Our logs record only the length band of the text, the number of findings and how long the check took, never the text itself. Results come back marked as not to be cached.

Each address can run a limited number of checks, to keep the tool free and stop it being used for bulk scanning. You can paste up to 20,000 characters at a time.

Checking whole documents

This page checks one paste at a time, for identifiers only. DOCNUS privacy assessment checks every PDF, Word file and scan you upload. It adds an AI reading layer that finds names, addresses and sensitive details in prose. It then checks each document against seven privacy laws and cites the articles behind each verdict. Privacy assessment is on the Professional and Enterprise plans, and you can start on the free plan and upgrade later. See pricing.