Programmatically detect and redact PII in text

WHAT THIS TESTS This checks whether you understand that PII in free text is partly structured and partly unstructured, so a single technique is insufficient, and that the cost of a miss is a privacy leak, making validation essential.

A GOOD ANSWER COVERS Layer your detection. For structured, pattern-based PII such as email addresses, phone numbers, social security numbers, and credit cards, use regular expressions combined with format validators and checksums to reduce false positives. For unstructured PII such as people's names, locations, organizations, and addresses that have no fixed pattern, use named-entity recognition from a library like spaCy or a purpose-built PII detection model, which understands context. Combine both passes. Then choose a redaction strategy: replace matches with a placeholder token, mask characters, or apply consistent pseudonymization or tokenization if you need referential integrity across records while removing identity. After redaction, validate the pipeline by sampling outputs and measuring recall, because for privacy a false negative, a missed identifier, is the dangerous error, so you bias toward catching more even at the cost of some false positives, which a reviewer can prune. Document and keep the original separate and access-controlled.

COMMON WRONG ANSWERS Using regular expressions alone, which cannot catch free-form names or addresses. Doing a single pass with no measurement of what slipped through. Treating false positives as the main risk when, for privacy, missed PII is worse. Ignoring consistency when the same person appears in multiple comments.

LIKELY FOLLOW-UPS How do you handle names that are also common words? How do you measure recall without already-labeled PII? What about PII in other languages?

ONE CONCRETE EXAMPLE A comment reads: contact John Smith at john@acme.com or 555-0100. A regex catches the email and phone with high confidence, and an NER model tags John Smith as a person. The pipeline outputs: contact PERSON at EMAIL or PHONE. You then sample two hundred scrubbed comments, find two missed nicknames, and tune the NER threshold up until recall on your audit set exceeds your target before using the data for training.