PII Field Identification Accuracy

Explanation

PII field identification accuracy checks how completely the system secures the sensitive fields it extracts from documents — the document-extraction counterpart to broader PII detection, focused on whether each identified sensitive field is actually protected. It matters immediately for a bank digitising KYC forms or statements, because an extracted but unsecured PAN or account number is an exposed liability, and it supports the proposed RBI Safety/Resilience, NIST MANAGE 3.1 and ISO Clause 6.1.2 (privacy) mappings. It is measured by the PII Extraction F1 Score, computed here as secured sensitive fields divided by total sensitive fields — the share of sensitive items that were correctly secured. To implement, run the extraction pipeline against a labelled set of documents, count how many true sensitive fields were both identified and secured versus the total present, and log extracted fields, securing actions and any misses as evidence for audit. The thresholds (proposed) are tiered: at least 0.90 is the target, scores below 0.85 should be investigated, and scores below 0.80 must be remediated. A result below 0.85 triggers investigation into why fields are being missed, and below 0.80 mandates active remediation — retraining or rule-fixing and re-testing — before the extraction service continues handling sensitive documents.