Detecting and removing BSNs in documents

A BSN (Dutch citizen service number) can almost never be shared with third parties. In practice it hides in scans, payslips and old contracts. Here's how to find and remove it systematically.

The BSN (Burgerservicenummer — Dutch citizen service number) is one of the most sensitive pieces of personal data. Sharing it with third parties without a specific legal basis is a serious GDPR violation.

Where does it appear in documents?

\n
• Payslips (mandatory, internal use permitted).
\n
• Annual income statements and payroll tax declarations.
\n
• Old employment contracts.
\n
• Job application forms (it shouldn't be there).
\n
• Invoices from certain freelancers to clients (it shouldn't be there either).
\n
• Scans of ID documents (do not store without good reason).
\n

Why does it need to go?

A BSN can be exploited for identity fraud. If sharing is required (accountant, Tax Authority): there is a justified legal basis. Otherwise, there isn't. See GDPR pillar.

Detection

\n
• Format: 9 digits. Often formatted as XXX-XX-XXXX or XXXXXXXXX.
\n
• Validation: The 11-check. Not every 9-digit number is a valid BSN — the 11-check algorithm confirms it.
\n
• Context: The words "BSN", "Sofi", "SoFi-nummer", or "Burgerservicenummer" nearby increase confidence.
\n

Workflow

\n
1. Pattern-match on 9-digit blocks (see pattern mode).
\n
2. Apply the 11-check to filter out false positives.
\n
3. Context check as an extra layer (the word "BSN" within 50 characters).
\n
4. Redact by replacing with "[BSN]" or a simple blank box.
\n

The 11-check algorithm (brief explanation)

Take the 9 digits. Multiply the 1st by 9, the 2nd by 8, the 3rd by 7, …, the 8th by 2, and the 9th by −1. Add the results. Divisible by 11? → Valid BSN. Most pattern-redaction tools have this built in as an option.

See also: redaction pillar, pattern mode.