How to Check a CSV for Personal Data Before You Share It

To check a CSV for personal data, look at each column's header and a sample of its values, then decide what each column should do in the file you share. The CSV PII scanner does that in your browser: it flags emails, phone numbers, names, addresses, birth dates, IP addresses, national IDs and card numbers, and lets you keep, mask, hash or drop each column.

The file is never uploaded. Scanning, masking and hashing all run on your machine.

The by-hand way

1. Open the CSV and read the header row. Words like email, phone, mobile, dob, surname, street and SSN give most of it away.
2. Scroll the first rows of unnamed columns. A column of nine-digit numbers or dates is not harmless.
3. Look through free-text columns such as notes and comments for names, numbers and health details.
4. Decide what the recipient actually needs.

Step 1: upload the CSV

Upload or paste the file with its header row.

Step 2: run the scan

Each column shows what it looks like and how many sampled values match. Detection uses the header and the values.

Kind	Found by
Email, phone	Header words such as email and mobile, plus address format and 7-15 digits
Name, address	Header words first, then UK postcodes and US ZIPs
Date of birth	Header words such as dob, plus date formats
National ID	Header words, plus US SSN and UK National Insurance formats
Card, IBAN	Header words, plus a Luhn checksum and the IBAN shape

Step 3: choose per column

• Drop what the recipient does not need. It is the only option that removes the risk. Sensitive kinds default to drop.
• Hash (SHA-256 of the trimmed, lower-cased value) when they need to match records against their own, because equal values give equal hashes.
• Mask when a person needs to recognise a row without reading it, such as a***@domain for screenshots and support tickets.
• Keep what they need in the clear.

A hash is still personal data under the GDPR. Treat a hashed file with the same care.

What this check cannot do

• Detection is by header and value patterns. It is a signal, not a legal classification, and the legal call is yours.
• Free-text columns can contain personal data that no pattern finds.
• Names and addresses are found mainly by header, so an unnamed column of names may be missed.
• National ID checks cover US SSNs and UK National Insurance numbers only.

For related list work, see finding emails and phone numbers in a CSV and finding masked emails in a list.

Verify the copy you keep

Keep the email column in plain text in the copy you verify, and hash or mask it only in the copy you hand to a vendor that does not send. Upload that copy on the verify page: the first 100 email checks are free with a Google sign-in, no card. Each address comes back valid, risky or invalid with a reason, and nothing is sent to anyone on the list. For larger or recurring lists, see bulk email verification, list cleaning and pricing.

Scan your file now

Open the CSV PII scanner.