PII Detection in Confluence: Where Personal Data Hides and How to Find It
To find personal data in Confluence you need to scan four places, and most tools only cover the first: page bodies, page history, comments, and attachments. A PII detection app scans all four against pattern templates such as email addresses, phone numbers, national identification numbers, credit cards and IBANs, then flags or removes what it finds. Confluence has no built-in capability for this. Native search matches words rather than patterns, and it cannot see inside attachments or previous page versions at all.
Why native Confluence search will not do this
People often assume they can simply search for the data. Three reasons that fails:
- Search matches text, not patterns. You can search for one specific phone number. You cannot search for “any German phone number” or “any IBAN”, which is what a compliance obligation actually requires.
- Search does not look inside attachments. A spreadsheet of customer contacts attached to a page is invisible to it.
- Search only covers current versions. Page history is excluded, and history is where a great deal of removed-but-not-really-removed personal data lives.
What good PII detection looks for
Detection quality comes down to pattern coverage, and pattern coverage is regional. A tool built for the US market recognises social security numbers and US phone formats. It will not recognise a German Steuer-Identifikationsnummer, an Austrian ZMR-Zahl, a Polish PESEL or a Swiss AVS number, because those formats look nothing like their US equivalents.
If your obligation is GDPR, European format coverage is the thing to interrogate. Ask any vendor which specific national identification formats they recognise, and be suspicious of a headline number that is not broken down.
The four places to scan
- Page bodies. Current content, including tables and macros.
- Page history. Every prior version of every page. Editing a page does not remove earlier revisions.
- Comments. Frequently where the specific personal detail was actually pasted.
- Attachments. Text files are straightforward. Scanned PDFs and images require optical character recognition, which many tools skip.
A tool that covers only the first of these will produce a clean report and leave you non-compliant.
Detection alone is not the finish line
Most tools in this category detect and alert. That is genuinely useful for monitoring, but if the reason you are looking is a data subject access request or a right-to-erasure request, a report does not discharge the obligation. You need to act on every finding, and doing that by hand across a large Confluence instance is not realistic.
The practical question to ask is: once this tool finds a thousand matches, what happens next? If the answer is that a person opens each page and edits it, the tool has moved the work rather than removed it.
How Data Protection Toolkit detects PII in Confluence
Data Protection Toolkit ships 62 built-in detection patterns covering 27 countries. The breakdown matters more than the total:
- 32 national identification formats, including the German Steuer-Identifikationsnummer, Rentenversicherungsnummer and Personenkennziffer, the Austrian ZMR-Zahl and ASVG number, the Belgian National Register number, the Czech Občanský průkaz, the Danish CPR number, the Estonian Isikukood, the Finnish Henkilötunnus, the French INSEE code, the Greek Tautotita, both Hungarian formats, the Irish PPS number, the Italian Codice Fiscale, the Latvian and Lithuanian personal codes, the Dutch Burgerservicenummer, the Norwegian Fødselsnummer, the Polish PESEL, the Romanian CNP, the Spanish DNI, the Swedish personnummer, both Swiss AVS formats, and the British National Insurance and NHS numbers.
- 20 country-specific phone formats, covering most of Western and Central Europe plus a generic international pattern.
- 10 general patterns: email addresses, credit cards across six card networks, IBANs, UUIDs, IPv4 and IPv6 addresses with and without ports, USD currency amounts, URLs and script tags.
Beyond that library you can write your own RegEx rules for internal identifiers such as customer numbers, contract references or employee IDs. If you would rather not write them yourself, Actonic will create, test and hand over custom patterns free of charge. There are also several hundred additional prepared patterns available on request that are not in the default picker.
Scanning covers pages, blog posts, comments, attachments and page history. Findings can be redacted, replaced, commented on or reported in bulk rather than one page at a time, and scans can run on a schedule. On Atlassian Cloud the calculation happens in the user’s browser, so content is not sent to Actonic or to any third party.
Frequently asked questions
How do I find personal data in Confluence?
Use a tool that scans by pattern rather than by keyword, and make sure it covers page bodies, page history, comments and attachments. Native Confluence search covers only current page text and cannot match patterns.
Does Confluence have built-in PII detection?
No. Confluence provides permissions and space restrictions, which govern access rather than content. Atlassian Guard Premium adds detection at the organisation level, but does not remove data or scan page history.
Can PII detection scan Confluence attachments?
It depends on the tool. Text-based attachments are widely supported. Scanned documents and images need optical character recognition, which is a specific capability worth confirming before you buy.
What about personal data in old page versions?
It is still there and still counts. Removing personal data from the current version of a page leaves every earlier revision untouched, so any serious cleanup has to address history explicitly.
How many PII types should a tool detect?
The headline count matters less than whether it covers the countries you operate in. Sixty patterns weighted towards European national identification formats will serve a GDPR obligation far better than a larger number of predominantly US formats.
Can I add my own patterns?
With Data Protection Toolkit, yes, through custom RegEx rules. Actonic will also build and test them for you at no cost if you would rather hand over the requirement than write the expression.
In short
Detection is only useful if it covers everywhere the data hides, recognises the formats used in your jurisdictions, and leads to something you can act on in bulk. Check those three things and the shortlist gets short quickly.
See Data Protection Toolkit for Confluence or read the related guide on DLP for Confluence.
Request