piiscope / 26 August 2026

From PII inventory to a clean rescan with one local CLI

Privacy checks often stop at pattern matching. This workflow keeps the dataset local, adds k-anonymity style risk signals, and closes the loop with a verifiable rescan.

Tool documentation Source on GitHub

Context

Use this path when you need to answer three separate questions: which columns contain personal data, what makes the dataset risky in combination, and whether a chosen transformation actually removed the detected exposure. The output supports review; it does not replace a DPIA or legal assessment.

Workflow

1. Inventory

Scan files or supported databases locally and review detector confidence, category, and jurisdiction tags.

piiscope scan samples/customers.csv

2. Measure

Inspect k-anonymity, l-diversity, t-closeness, and the strongest drivers behind the overall risk score.

piiscope scan samples/customers.csv --format json | jq '.risk, .metrics'

3. Remediate

Choose a transformation such as hash, redact, generalise, tokenise, or date shift for the affected columns.

piiscope remediate samples/customers.csv --out customers_safe.csv --strategy hash

4. Prove

Scan the transformed output again. The repository fixture moves from critical risk to a zero-risk finding set after hashing the detected columns.

piiscope scan customers_safe.csv --fail-on medium

Observed result

published benchmark and repository fixture

All 512 structured benchmark cases pass before a clean remediation rescan.

The public synthetic benchmark covers 32 multilingual positive and hard-negative families across 512 rows. The committed customers fixture separately exercises the full remediation round trip.

benchmark 512 / 512 exact
precision 1.000
recall    1.000
rescan    0 / low

Inspect the source open the benchmark

Interpretation

The useful artifact is the pair of reports. Keep the original scan, the explicit remediation command, and the clean rescan together so a reviewer can see exactly what changed and what was measured again.

Limitations

Detection is heuristic and should be reviewed against the context of the dataset
A clean scan is not proof of legal or regulatory compliance
Optional Parquet and NLP features require their matching extras