Global PII Compliance: Three Laws, Three ID Formats
A UK marketplace handles seller documents from 80 countries. Three laws apply at once: GDPR for EU sellers, LGPD for Brazilian sellers, and India's DPDP Act for Indian sellers. Each law names different national IDs as protected. Each format has its own check logic.
Brazilian CPF: Format and LGPD Status
The CPF (Cadastro de Pessoas Físicas) is Brazil's taxpayer number. It has 11 digits in the format XXX.XXX.XXX-XX. The last two digits are check digits. A math algorithm on the first nine digits produces them.
Brazil's LGPD treats CPF as a protected personal identifier, similar in sensitivity to a US SSN. A tool that does not know the CPF format cannot find it. One that skips the checksum will flag false matches.
Indian Aadhaar: Format and DPDP Rules
Aadhaar is a 12-digit number issued by India's UIDAI. Numbers are assigned at random. The last digit is a Verhoeff check digit.
India's DPDP Act creates duties for any group handling Aadhaar-linked data. Detection needs two steps. First, match the 12-digit format and check the Verhoeff digit. Second, filter by context. Not every 12-digit string is an Aadhaar.
US SSN: A Known Structure
The SSN is nine digits. The first three are the area number. The next two are the group number. The last four are the serial number. Each segment has set rules. Validation is well documented.
The Gap Between Single-Country Tools and Global Rules
These three IDs share no format and no check rule. A tool built for US use will catch SSNs. It may miss CPF and Aadhaar entirely.
Most teams find this gap when a regulator asks — not before. The gap creates real risk under each law:
- GDPR Article 28 requires a written Data Processing Agreement with each processor. A DPIA that lists "SSN detection" as the main control — when the dataset also holds CPF numbers — has a documented gap. An auditor can find it.
- LGPD fines can reach 2% of Brazilian revenue, up to R$50M per breach. A CPF that goes undetected is a direct LGPD violation.
- DPDP enforcement is still new. Teams that log their coverage now will be better placed when early rulings set the standard.
Three fine regimes at once create layered risk. Single-country tools leave global teams exposed.
What Full Coverage Requires
A tool needs each ID's format, check algorithm, and legal context. CPF needs a modular checksum. Aadhaar needs the Verhoeff check plus context filtering. SSN needs area and group rules. These are three separate problems. No single search pattern covers all of them.
See also: global PII identifier gap: SSN, CPF, Aadhaar, ANPD Brazil LGPD enforcement guide, and DPDPA India privacy law technical compliance.