EU ID Gap: Steuer-ID, NIR, Personnummer
US-built PII tools were made for American data. They detect SSNs, US phone formats, and US driver's licenses well. EU identifiers work differently. They follow different structures and different check rules. A US regex will not match a German Steuer-ID. The structural gap is not a minor one.
Why EU Identifiers Are Different
The German Steuer-ID has 11 positions. The first cannot be zero. No position value may repeat more than three times in a row. A checksum formula validates the last position. It is published by the Bundeszentralamt für Steuern. No US SSN pattern will find this.
The French NIR has 15 positions total. Each carries meaning. Position 1 encodes gender. Positions 2–3 encode birth year. Positions 4–5 encode birth month. Positions 6–7 encode the department of birth. Positions 14–15 form a check key. No US format pattern will find a NIR.
The Swedish Personnummer follows the form YYMMDD-XXXX. The Norwegian Fødselsnummer has 11 positions with a two-stage checksum. These formats are not minor US variations. They are set by national law. There is no US equivalent.
The Compliance Gap in Practice
A pan-European HR platform using a US-built PII tool for 18 EU countries will miss most national IDs. Every file with a Steuer-ID, NIR, Personnummer, or Fødselsnummer passes through with that ID exposed.
This gap is systematic. It is not a configuration issue. The tool was simply not built to see these formats.
Full EU Coverage Requirements
Minimum EU coverage for GDPR compliance includes identifiers across several regions.
DACH: German Steuer-ID and Reisepass; Austrian Sozialversicherungsnummer; Swiss AHV-Nr with check value.
France: NIR, Carte Vitale, SIRET, and SIREN.
UK: NHS Number, National Insurance number (AA-NN-NN-NN-A format), and UTR.
Nordic: Swedish Personnummer (YYMMDD-XXXX), Norwegian Fødselsnummer, Finnish Henkilötunnus (DDMMYY-XXXX), and Danish CPR (DDMMYY-XXXX).
Southern EU: Spanish DNI/NIE, Italian Codice Fiscale (16-character alphanumeric), Polish PESEL, and Czech Rodné číslo.
Organizations switching from US-built tools to EU-comprehensive coverage often find their prior tool achieved only 30–40% detection of EU identifiers. Most European national IDs went undetected.
For more on GDPR technical obligations, see GDPR compliance resources.
What Full Coverage Looks Like
A managed EU entity library covers all the formats above. Updates ship when national formats change. No custom code or pull request is needed from your team.
For IDs outside the standard library, a custom entity builder lets you add patterns without writing code. See security and compliance details for how updates and audit trails work.