PII Detection and Classification

Explanation

PII detection and classification checks whether the system reliably finds and labels personally identifiable information — names, PAN, Aadhaar, account numbers, addresses — before that data is processed, stored or sent to a model. It matters immediately because missed PII flowing into a RAG index or extraction pipeline is the root cause of most downstream privacy incidents in a bank, and the control underpins RBI Safety/Resilience expectations, NIST MANAGE 3.1 and ISO Clause 6.1.2. It is measured by the PII Detection F1 Score, computed as F1 = 2 × (Precision × Recall) / (Precision + Recall) for customer data processing — balancing how many flagged items were truly PII (precision) against how much real PII was caught (recall). To implement, run a PII detector (pattern plus model based) over inputs at the Document Extraction and RAG ingestion stages, evaluate it against a labelled gold set to compute precision, recall and F1, and log detections, misses and false positives as evidence for audit. The threshold is an F1 score above 0.95; scoring at or below 0.95 is a breach that triggers detector tuning, expansion of the labelled set and re-evaluation, and should block onward processing of inadequately scanned data until accuracy is restored.