{"id":227673,"date":"2026-10-06T15:59:23","date_gmt":"2026-10-06T15:59:23","guid":{"rendered":"https:\/\/datatrue.com\/?page_id=227673"},"modified":"2026-10-06T15:59:23","modified_gmt":"2026-10-06T15:59:23","slug":"pii-scanning","status":"publish","type":"page","link":"https:\/\/datatrue.com\/en\/resources\/privacy-compliance\/pii-scanning\/","title":{"rendered":"PII Scanning"},"content":{"rendered":"\n<style id=\"dt-divi-integration\">body h1.entry-title.main_title{display:none !important}#main-content .container{width:100% !important;max-width:100% !important;padding-left:0 !important;padding-right:0 !important;padding-top:0 !important}#left-area{width:100% !important;float:none !important;padding:0 !important}#sidebar{display:none !important}#main-content .container:before{display:none !important}.yarpp-related,.yarpp.yarpp-related{display:none !important}#left-area article.et_pb_post{margin-bottom:0 !important}#dt-page p{padding-bottom:0}#dt-page :is(h1,h2,h3,h4,h5,h6){padding-bottom:0}#dt-page :is(ul,ol){padding:0;margin:0;list-style:none;line-height:inherit}#dt-page img{max-width:100%;height:auto}<\/style><style id=\"dt-page-css\">@import url('https:\/\/fonts.googleapis.com\/css2?family=Lato:wght@400;#dt-page 700;900&family=Work+Sans:wght@400;500;600&family=IBM+Plex+Mono:wght@500;600&display=swap');:root{--ink:#242923;--ink-soft:#55605A;--ink-faint:#8B958E;--mint:#0EA173;--mint-fill:#10B981;--mint-tint:#F3FAF7;--teal:#4C7E93;--teal-tint:#EAF2F4;--surface:#FFFFFF;--border:#DCE7E2;--draft:#B5791A;--draft-tint:#FBF1DF;--warn:#C0453B;--warn-tint:#FDF0EE;--shadow:0 24px 48px -28px rgba(36,41,35,0.28);}#dt-page,#dt-page *{box-sizing:border-box;}#dt-page{-webkit-text-size-adjust:100%;scroll-behavior:smooth;}#dt-page{margin:0;background:var(--surface);color:var(--ink);font-family:'Work Sans','Helvetica Neue',Arial,sans-serif;line-height:1.55;}#dt-page h1,#dt-page h2,#dt-page h3,#dt-page h4{font-family:'Lato','Helvetica Neue',Arial,sans-serif;color:var(--ink);margin:0;text-wrap:balance;}#dt-page p{margin:0;}#dt-page a{color:inherit;}#dt-page code{font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:.86em;background:var(--mint-tint);border:1px solid #DCEDE5;border-radius:5px;padding:1px 6px;color:var(--ink);white-space:nowrap;}#dt-page .wrap{max-width:1120px;margin:0 auto;padding:0 32px;}#dt-page .sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0;}#dt-page .notice{background:var(--draft-tint);border-bottom:1px solid #EEDDB8;color:#7A5312;font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:12px;line-height:1.55;}#dt-page .notice .wrap{padding:10px 32px;display:flex;align-items:flex-start;gap:10px;flex-wrap:wrap;}#dt-page .notice strong{color:#5C3D0E;}#dt-page .notice .n-body{flex:1 1 520px;}#dt-page .notice ul{margin:4px 0 0;padding-left:18px;}#dt-page .draft-tag{display:inline-flex;align-items:center;gap:5px;background:#fff8ea;color:#7A5312;border:1px solid #EEDDB8;font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:10.5px;font-weight:600;letter-spacing:.06em;text-transform:uppercase;padding:3px 8px;border-radius:4px;white-space:nowrap;}#dt-page .draft-tag::before{content:\"\\270E\";font-size:11px;}#dt-page .breadcrumb{font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:11px;letter-spacing:.04em;color:var(--ink-faint);text-transform:uppercase;}#dt-page .breadcrumb ol{list-style:none;margin:0;padding:0;display:flex;flex-wrap:wrap;gap:6px;}#dt-page .breadcrumb li{display:inline-flex;gap:6px;align-items:center;}#dt-page .breadcrumb li + li::before{content:\"\\203A\";color:#B9C4BE;}#dt-page .breadcrumb a{color:var(--teal);text-decoration:none;}#dt-page .breadcrumb a:hover{text-decoration:underline;}#dt-page .eyebrow{display:inline-flex;align-items:center;gap:8px;font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:12px;font-weight:600;letter-spacing:.09em;text-transform:uppercase;color:var(--mint);background:var(--mint-tint);border:1px solid #CFE9DF;padding:6px 12px 6px 10px;border-radius:999px;}#dt-page .eyebrow .dot{width:6px;height:6px;border-radius:50%;background:var(--mint-fill);}#dt-page .eyebrow .sep{color:#9CCFBA;}#dt-page .eyebrow.on-dark{background:rgba(255,255,255,0.1);border-color:rgba(255,255,255,0.18);color:#8FE3C3;}#dt-page .eyebrow.on-dark .dot{background:#6FE3B6;}#dt-page .section-head{max-width:64ch;}#dt-page .section-head h2{font-size:28px;font-weight:900;letter-spacing:-0.01em;line-height:1.2;}#dt-page .section-head p{margin-top:10px;color:var(--ink-soft);font-size:15px;line-height:1.6;}#dt-page .pc-head{padding:40px 0 0;}#dt-page .pc-head .eyebrow{margin-top:22px;}#dt-page .pc-head h1{margin-top:16px;font-size:40px;font-weight:900;letter-spacing:-0.015em;line-height:1.14;max-width:900px;}#dt-page .definition{position:relative;margin-top:28px;max-width:900px;background:var(--mint-tint);border:1px solid #CFE9DF;border-left:5px solid var(--mint-fill);border-radius:14px;padding:26px 34px 28px 32px;overflow:hidden;}#dt-page .definition::after{content:\"\\201C\";position:absolute;right:22px;top:-18px;font-family:'Lato',Georgia,serif;font-weight:900;font-size:132px;line-height:1;color:var(--mint-fill);opacity:.13;pointer-events:none;}#dt-page .def-kicker{display:flex;align-items:center;gap:8px;font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:11px;font-weight:600;letter-spacing:.09em;text-transform:uppercase;color:var(--mint);margin-bottom:10px;}#dt-page .def-kicker::before{content:\"\";width:16px;height:2px;background:var(--mint-fill);border-radius:2px;}#dt-page .def-text{position:relative;font-family:'Lato','Helvetica Neue',Arial,sans-serif;font-weight:700;font-size:19.5px;line-height:1.58;color:var(--ink);letter-spacing:-0.002em;}#dt-page .art-grid{display:grid;grid-template-columns:minmax(0,1fr) 248px;gap:72px;padding:44px 0 8px;align-items:start;}#dt-page .prose{max-width:700px;min-width:0;}#dt-page .prose>* + *{margin-top:16px;}#dt-page .prose .lede{font-size:17.5px;line-height:1.68;color:var(--ink);}#dt-page .prose h2{font-size:26px;font-weight:900;letter-spacing:-0.01em;line-height:1.22;margin-top:52px;scroll-margin-top:24px;}#dt-page .prose h2 + *{margin-top:14px;}#dt-page .prose h3{font-size:19px;font-weight:900;line-height:1.3;margin-top:30px;scroll-margin-top:24px;}#dt-page .prose h3 + *{margin-top:8px;}#dt-page .prose p{font-size:16px;line-height:1.72;color:var(--ink-soft);}#dt-page .prose strong{color:var(--ink);font-weight:600;}#dt-page .prose a,#dt-page .inline-link{color:var(--teal);font-weight:500;text-decoration:underline;text-decoration-color:#B8CFD8;text-underline-offset:3px;text-decoration-thickness:1px;}#dt-page .prose a:hover,#dt-page .inline-link:hover{text-decoration-color:var(--teal);}#dt-page .prose ul{list-style:none;margin-left:0;padding:0;}#dt-page .prose ul li{position:relative;padding-left:24px;font-size:16px;line-height:1.68;color:var(--ink-soft);}#dt-page .prose ul li + li{margin-top:8px;}#dt-page .prose ul li::before{content:\"\";position:absolute;left:4px;top:.72em;width:7px;height:7px;border-radius:50%;background:var(--mint-fill);}#dt-page .prose ol.steps{list-style:none;padding:0;counter-reset:step;}#dt-page .prose ol.steps li{position:relative;counter-increment:step;padding:2px 0 0 50px;font-size:16px;line-height:1.68;color:var(--ink-soft);min-height:32px;}#dt-page .prose ol.steps li + li{margin-top:16px;}#dt-page .prose ol.steps li::before{content:counter(step);position:absolute;left:0;top:0;width:32px;height:32px;border-radius:50%;background:var(--mint-tint);border:1px solid #CFE9DF;color:var(--mint);font-family:'Lato',sans-serif;font-weight:900;font-size:14px;display:flex;align-items:center;justify-content:center;}#dt-page .prose ol.steps li:not(:last-child)::after{content:\"\";position:absolute;left:15.5px;top:36px;bottom:-14px;width:1px;background:#D5E8DF;}#dt-page .prose ul.check-list li{padding:14px 18px 14px 50px;background:var(--surface);border:1px solid var(--border);border-radius:12px;}#dt-page .prose ul.check-list li + li{margin-top:10px;}#dt-page .prose ul.check-list li::before{content:\"\\2713\";left:16px;top:15px;width:22px;height:22px;background:var(--mint-tint);border:1px solid #CFE9DF;color:var(--mint);font-size:12px;font-weight:700;display:flex;align-items:center;justify-content:center;}#dt-page .prose ul.check-list li strong{font-family:'Lato',sans-serif;font-weight:900;}#dt-page .lead-stack{display:flex;flex-direction:column;gap:10px;}#dt-page .prose .lead-stack{margin-top:18px;}#dt-page .lead-card{border:1px solid var(--border);border-left:3px solid var(--mint-fill);border-radius:10px;padding:16px 20px;background:var(--surface);}#dt-page .lead-card p{font-size:15.5px;line-height:1.66;}#dt-page .lead-card .lead{display:block;font-family:'Lato',sans-serif;font-weight:900;font-size:16.5px;color:var(--ink);margin-bottom:4px;}#dt-page .next-read{display:flex;flex-wrap:wrap;gap:10px;}#dt-page .prose .next-read{margin-top:22px;}#dt-page .next-link{display:inline-flex;align-items:center;gap:8px;font-size:14px;font-weight:600;color:var(--teal);text-decoration:none;background:var(--teal-tint);border:1px solid #D3E3E9;border-radius:999px;padding:9px 16px;}#dt-page .next-link:hover{border-color:var(--teal);}#dt-page .next-link svg{width:14px;height:14px;}#dt-page .visual-slot{border:1px dashed #C4D3CC;border-radius:14px;background:linear-gradient(180deg,#FBFDFC,#F4F8F6);padding:26px 24px;text-align:center;color:var(--ink-faint);display:flex;flex-direction:column;align-items:center;}#dt-page .prose .visual-slot{margin-top:26px;}#dt-page .visual-slot .vs-badge{font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:10.5px;font-weight:600;letter-spacing:.06em;text-transform:uppercase;color:var(--mint);background:var(--mint-tint);border:1px solid #CFE9DF;padding:3px 9px;border-radius:5px;margin-bottom:10px;}#dt-page .visual-slot .vs-title{font-family:'Lato',sans-serif;font-weight:700;font-size:14.5px;color:var(--ink-soft);}#dt-page .visual-slot .vs-desc{font-size:12.5px;margin-top:6px;max-width:52ch;line-height:1.5;}#dt-page .visual-slot.tall{min-height:220px;justify-content:center;}#dt-page .checklist{list-style:none;margin:22px 0 0;padding:0;display:flex;flex-direction:column;gap:14px;counter-reset:ck;}#dt-page .checklist>li{display:grid;grid-template-columns:44px minmax(0,1fr);gap:16px;border:1px solid var(--border);border-radius:14px;padding:22px 24px 22px 20px;background:var(--surface);}#dt-page .checklist .ck-num{width:40px;height:40px;border-radius:50%;background:var(--mint-fill);color:#fff;font-family:'Lato',sans-serif;font-weight:900;font-size:17px;display:flex;align-items:center;justify-content:center;}#dt-page .checklist .ck-body>* + *{margin-top:12px;}#dt-page .prose .checklist h3{margin-top:6px;font-size:18.5px;}#dt-page .checklist .ck-body p,#dt-page .checklist .ck-body li{font-size:15.5px;}#dt-page .checklist-wrap{margin-top:22px;}#dt-page .checklist-head{display:flex;align-items:center;gap:10px;font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:11px;font-weight:600;letter-spacing:.08em;text-transform:uppercase;color:var(--ink-faint);}#dt-page .checklist-head .bar{flex:1;height:1px;background:var(--border);}#dt-page .toc{position:sticky;top:24px;border-left:1px solid var(--border);padding:4px 0 4px 20px;}#dt-page .toc-label{font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:10.5px;font-weight:600;letter-spacing:.09em;text-transform:uppercase;color:var(--ink-faint);margin-bottom:12px;}#dt-page .toc ol{list-style:none;margin:0;padding:0;display:flex;flex-direction:column;gap:10px;}#dt-page .toc a{display:block;font-size:13.5px;line-height:1.4;color:var(--ink-soft);text-decoration:none;}#dt-page .toc a:hover{color:var(--mint);}#dt-page .faq-block{padding:12px 0 8px;}#dt-page .faq-block h2{font-size:26px;font-weight:900;margin-bottom:18px;scroll-margin-top:24px;}#dt-page .faq-list{max-width:80ch;display:flex;flex-direction:column;gap:10px;}#dt-page .faq-item{border:1px solid var(--border);border-radius:10px;padding:2px 18px;background:var(--surface);}#dt-page .faq-item summary{display:flex;align-items:center;justify-content:space-between;gap:16px;padding:16px 0;font-size:15.5px;font-weight:700;color:var(--ink);cursor:pointer;list-style:none;font-family:'Lato',sans-serif;}#dt-page .faq-item summary::-webkit-details-marker{display:none;}#dt-page .faq-item summary::after{content:\"+\";font-size:20px;font-weight:400;color:var(--mint);flex-shrink:0;}#dt-page .faq-item[open] summary::after{content:\"\\2013\";}#dt-page .faq-item p{padding-bottom:16px;font-size:15px;color:var(--ink-soft);line-height:1.65;}#dt-page .band{padding:52px 0;}#dt-page .band.alt{background:var(--mint-tint);border-top:1px solid #E4F1EB;border-bottom:1px solid #E4F1EB;}#dt-page .band.rule{border-top:1px solid var(--border);}#dt-page .tile-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:14px;margin-top:22px;}#dt-page .tile-grid.two{grid-template-columns:repeat(2,minmax(0,1fr));}#dt-page .tile{position:relative;display:flex;flex-direction:column;background:var(--surface);border:1px solid var(--border);border-radius:12px;padding:18px 44px 18px 20px;text-decoration:none;color:var(--ink);transition:border-color .15s,background .15s;}#dt-page .tile:hover{border-color:var(--mint-fill);}#dt-page .tile::after{content:\"\\2192\";position:absolute;right:18px;top:17px;color:var(--ink-faint);font-size:15px;transition:color .15s,transform .15s;}#dt-page .tile:hover::after{color:var(--mint);transform:translateX(2px);}#dt-page .tile .t-label{font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:10px;font-weight:600;letter-spacing:.06em;text-transform:uppercase;color:var(--ink-faint);margin-bottom:6px;}#dt-page .tile h3{font-size:16px;font-weight:900;line-height:1.3;}#dt-page .tile p{margin-top:6px;font-size:13.5px;color:var(--ink-soft);line-height:1.55;}#dt-page .tile.feature{grid-column:span 2;background:var(--surface);border-color:#BFDFD1;box-shadow:var(--shadow);padding:24px 52px 24px 26px;}#dt-page .tile.feature h3{font-size:21px;}#dt-page .tile.feature p{font-size:14.5px;}#dt-page .tile.feature .t-label{color:var(--mint);}#dt-page .tile .t-lane{align-self:flex-start;margin-top:10px;}#dt-page .market{margin-top:22px;max-width:900px;display:grid;grid-template-columns:minmax(0,1fr);border:1px solid #CFE0E6;border-radius:14px;overflow:hidden;}#dt-page .market-main{background:var(--teal-tint);padding:24px 28px 26px;position:relative;}#dt-page .market-code{position:absolute;right:22px;top:18px;font-family:'Lato',sans-serif;font-weight:900;font-size:44px;letter-spacing:-0.02em;color:var(--teal);opacity:.18;line-height:1;}#dt-page .market-main .market-k{font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:11px;font-weight:600;letter-spacing:.09em;text-transform:uppercase;color:var(--teal);}#dt-page .market-main h2{margin-top:10px;font-size:22px;font-weight:900;}#dt-page .market-main p.m-line{margin-top:8px;max-width:60ch;font-size:17px;color:var(--ink);line-height:1.6;}#dt-page .market-main .m-src{margin-top:12px;font-size:12px;color:var(--ink-faint);}#dt-page .market-main .m-src a{color:var(--teal);}#dt-page .market-laws{background:var(--surface);padding:20px 22px;}#dt-page .market-laws .ml-k{font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:10.5px;font-weight:600;letter-spacing:.08em;text-transform:uppercase;color:var(--ink-faint);margin-bottom:10px;}#dt-page .mini-tiles{display:grid;grid-template-columns:repeat(auto-fill,minmax(240px,1fr));gap:8px;}#dt-page .mini-tile{display:flex;align-items:center;justify-content:space-between;gap:12px;border:1px solid var(--border);border-radius:9px;padding:10px 14px;text-decoration:none;color:var(--ink);font-size:14px;font-weight:600;line-height:1.3;}#dt-page .mini-tile:hover{border-color:var(--mint-fill);background:var(--mint-tint);}#dt-page .mini-tile::after{content:\"\\2192\";color:var(--ink-faint);font-weight:400;}#dt-page .mini-tile .mt-type{display:block;font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:9.5px;font-weight:600;letter-spacing:.06em;text-transform:uppercase;color:var(--ink-faint);margin-bottom:2px;}#dt-page .market-laws .ml-empty{font-size:13px;color:var(--ink-faint);line-height:1.5;}#dt-page .jump{margin-top:22px;max-width:900px;display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:0;border:1px solid var(--border);border-radius:14px;background:var(--surface);}#dt-page .jump-col{padding:20px 24px 22px;}#dt-page .jump-col + .jump-col{border-left:1px solid var(--border);}#dt-page .jump-k{font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:10.5px;font-weight:600;letter-spacing:.08em;text-transform:uppercase;color:var(--ink-faint);}#dt-page .jump-col h2{margin-top:6px;font-size:16.5px;font-weight:900;}#dt-page .chips{display:flex;flex-wrap:wrap;gap:8px;margin-top:12px;}#dt-page .chip{display:inline-flex;align-items:center;gap:7px;font-size:13px;font-weight:600;color:var(--ink);background:var(--surface);border:1px solid var(--border);border-radius:999px;padding:7px 13px;text-decoration:none;}#dt-page .chip:hover{border-color:var(--mint-fill);background:var(--mint-tint);color:var(--mint);}#dt-page .chip::after{content:\"\\2192\";color:var(--ink-faint);font-weight:400;font-size:12px;}#dt-page .pillar-body{padding-top:40px;padding-bottom:8px;}#dt-page .pillar-body .prose{max-width:720px;}#dt-page .module{margin-top:22px;}#dt-page .card-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:14px;}#dt-page .card-grid.three{grid-template-columns:repeat(3,minmax(0,1fr));}#dt-page .r-card{display:flex;flex-direction:column;border:1px solid var(--border);border-radius:14px;padding:22px 22px 20px;background:var(--surface);}#dt-page .r-card .rc-k{font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:10px;font-weight:600;letter-spacing:.06em;text-transform:uppercase;color:var(--mint);margin-bottom:8px;}#dt-page .r-card h3{font-size:17px;font-weight:900;line-height:1.3;}#dt-page .r-card p{margin-top:8px;font-size:14.5px;color:var(--ink-soft);line-height:1.62;flex:1;}#dt-page .r-card .rc-go{margin-top:14px;font-size:13.5px;font-weight:600;color:var(--teal);text-decoration:none;display:inline-flex;gap:6px;align-items:center;}#dt-page .r-card .rc-go:hover{text-decoration:underline;}#dt-page .r-card.numbered{position:relative;padding-top:58px;}#dt-page .r-card.numbered .rc-n{position:absolute;left:22px;top:18px;width:30px;height:30px;border-radius:50%;background:var(--mint-fill);color:#fff;font-family:'Lato',sans-serif;font-weight:900;font-size:14px;display:flex;align-items:center;justify-content:center;}#dt-page .r-card.region{text-decoration:none;color:var(--ink);position:relative;}#dt-page .r-card.region:hover,#dt-page a.r-card:hover{border-color:var(--mint-fill);}#dt-page .r-card.region .rc-code{font-family:'Lato',sans-serif;font-weight:900;font-size:26px;color:var(--teal);opacity:.35;line-height:1;margin-bottom:10px;}#dt-page .feat-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:14px;}#dt-page .feat{border:1px solid var(--border);border-radius:12px;padding:20px;background:var(--surface);}#dt-page .feat .f-check{width:26px;height:26px;border-radius:50%;background:var(--mint-tint);color:var(--mint);display:flex;align-items:center;justify-content:center;font-size:13px;font-weight:700;margin-bottom:12px;border:1px solid #CFE9DF;}#dt-page .feat h3{font-size:15.5px;font-weight:900;margin-bottom:6px;line-height:1.3;}#dt-page .feat p{font-size:14px;color:var(--ink-soft);line-height:1.62;}#dt-page .feat p a{color:var(--teal);}#dt-page .feat.wide{grid-column:1 \/ -1;}#dt-page .cat-nav{margin-top:26px;display:flex;flex-wrap:wrap;gap:10px;}#dt-page .cat-nav a{display:inline-flex;align-items:center;gap:9px;font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:12px;font-weight:600;letter-spacing:.05em;text-transform:uppercase;color:var(--ink-soft);background:var(--surface);border:1px solid var(--border);padding:8px 14px;border-radius:999px;text-decoration:none;transition:border-color .15s,color .15s,background .15s;}#dt-page .cat-nav a:hover{border-color:var(--mint-fill);color:var(--mint);background:var(--mint-tint);}#dt-page .cat-nav a .count{font-size:11px;color:var(--ink-faint);font-weight:500;letter-spacing:.02em;}#dt-page .hub-intro{margin-top:26px;max-width:76ch;font-size:16px;color:var(--ink-soft);line-height:1.65;}#dt-page .cat{padding:48px 0 8px;border-top:1px solid var(--border);scroll-margin-top:24px;}#dt-page .cat:first-of-type{border-top:none;}#dt-page .cat .eyebrow{margin-bottom:14px;}#dt-page .cat-note{margin-top:16px;font-size:14px;color:var(--ink-soft);max-width:76ch;}#dt-page .hub-callout{margin-top:4px;background:var(--teal-tint);border:1px solid #CFE0E6;border-left:4px solid var(--teal);border-radius:12px;padding:22px 26px;max-width:82ch;}#dt-page .hub-callout .hc-k{font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:11px;font-weight:600;letter-spacing:.08em;text-transform:uppercase;color:var(--teal);margin-bottom:6px;}#dt-page .hub-callout h2{font-size:20px;font-weight:900;line-height:1.3;}#dt-page .hub-callout p{margin-top:8px;font-size:15px;line-height:1.62;color:var(--ink);}#dt-page .hub-callout a{color:var(--teal);font-weight:600;}#dt-page .closing-section{padding:56px 0 72px;}#dt-page .closing{background:var(--ink);padding:56px 32px;text-align:center;border-radius:14px;}#dt-page .closing h2{color:#fff;font-size:28px;font-weight:900;margin-top:16px;}#dt-page .closing .single-cta{margin-top:24px;display:flex;flex-direction:column;align-items:center;}#dt-page .region-btn{display:inline-flex;align-items:center;justify-content:center;gap:8px;background:var(--mint-fill);color:#fff;font-family:'Lato',sans-serif;font-weight:700;font-size:15px;border:none;border-radius:8px;padding:14px 24px;min-width:260px;text-decoration:none;letter-spacing:.005em;line-height:1.3;cursor:pointer;}#dt-page .region-btn:hover{background:#0C9A6E;}#dt-page .region-btn svg{width:15px;height:15px;flex-shrink:0;}#dt-page .trial-fine{margin-top:14px;font-size:13px;color:#9DB3A8;line-height:1.5;}@media (max-width:980px){#dt-page .art-grid{grid-template-columns:minmax(0,1fr);gap:0;}#dt-page .toc{display:none;}#dt-page .prose{max-width:none;}#dt-page .tile-grid{grid-template-columns:repeat(2,minmax(0,1fr));}#dt-page .card-grid.three{grid-template-columns:repeat(2,minmax(0,1fr));}}@media (max-width:820px){#dt-page .market,#dt-page .jump{grid-template-columns:minmax(0,1fr);}#dt-page .jump-col + .jump-col{border-left:none;border-top:1px solid var(--border);}#dt-page .card-grid,#dt-page .feat-grid{grid-template-columns:minmax(0,1fr);}#dt-page .card-grid.three{grid-template-columns:minmax(0,1fr);}}@media (max-width:680px){#dt-page .wrap,#dt-page .notice .wrap{padding-left:20px;padding-right:20px;}#dt-page .pc-head{padding-top:28px;}#dt-page .pc-head h1{font-size:30px;}#dt-page .definition{padding:22px 20px 22px 20px;}#dt-page .def-text{font-size:16.5px;}#dt-page .prose h2{font-size:23px;margin-top:42px;}#dt-page .tile-grid,#dt-page .tile-grid.two{grid-template-columns:minmax(0,1fr);}#dt-page .tile.feature{grid-column:auto;}#dt-page .checklist>li{grid-template-columns:minmax(0,1fr);gap:10px;padding:18px;}#dt-page .closing{padding:44px 20px;}#dt-page .closing h2{font-size:24px;}#dt-page .region-btn{width:100%;min-width:0;}#dt-page code{white-space:normal;word-break:break-word;}}#dt-page .prose a.next-link,#dt-page .prose a.rc-go,#dt-page .prose a.tile,#dt-page .prose a.chip,#dt-page .prose a.mini-tile,#dt-page .prose a.r-card{text-decoration:none;}#dt-page .prose a.next-link:hover{text-decoration:none;}#dt-page .rc-go svg,#dt-page .next-link svg,#dt-page .chip svg{width:14px;height:14px;flex-shrink:0;}#dt-page .cat.faq-cat{padding-top:36px;}#dt-page .def-top{display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap;margin-bottom:10px;}#dt-page .def-top .def-kicker{margin-bottom:0;}#dt-page .verdict{position:relative;z-index:1;display:inline-flex;align-items:center;gap:10px;background:var(--surface);border:1px solid #CFE9DF;border-radius:999px;padding:6px 16px 6px 12px;margin-right:64px;}#dt-page .verdict .v-k{font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:10.5px;font-weight:600;letter-spacing:.09em;text-transform:uppercase;color:var(--ink-faint);}#dt-page .verdict .v-v{font-family:'Lato',sans-serif;font-weight:900;font-size:17px;color:var(--ink);}#dt-page .glance{margin-top:14px;max-width:900px;background:var(--surface);border:1px solid var(--border);border-radius:14px;padding:18px 24px 20px;}#dt-page .glance .g-k{font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:11px;font-weight:600;letter-spacing:.09em;text-transform:uppercase;color:var(--teal);margin-bottom:10px;}#dt-page .glance dl{margin:0;display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:18px;}#dt-page .glance .g-row{border-left:3px solid var(--teal-tint);padding-left:14px;}#dt-page .glance dt{font-family:'Lato',sans-serif;font-weight:900;font-size:14px;color:var(--ink);margin-bottom:4px;}#dt-page .glance dd{margin:0;font-size:15px;line-height:1.6;color:var(--ink-soft);}@media (max-width:680px){#dt-page .glance dl{grid-template-columns:minmax(0,1fr);}#dt-page .verdict{margin-right:0;}}#dt-page .shot-img{margin:28px 0 0;}#dt-page .shot-img img{display:block;width:100%;height:auto;border:1px solid var(--border);border-radius:14px;background:#F4F8F6;box-shadow:var(--shadow);}#dt-page .shot-img figcaption{margin-top:10px;font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:11px;letter-spacing:.04em;text-transform:uppercase;color:var(--ink-faint);}#dt-page .diagram{margin:28px 0 0;border:1px solid var(--border);border-radius:14px;padding:20px 20px 16px;background:var(--surface);}#dt-page .diagram svg{display:block;width:100%;height:auto;}#dt-page .diagram .dg-narrow{display:none;}#dt-page .diagram figcaption{margin-top:14px;font-size:13.5px;line-height:1.55;color:var(--ink-soft);}#dt-page .diagram .dg-tag{display:block;margin-top:8px;font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:10.5px;letter-spacing:.06em;text-transform:uppercase;color:var(--ink-faint);}@media (max-width:680px){#dt-page .diagram .dg-wide{display:none;}#dt-page .diagram .dg-narrow{display:block;max-width:360px;margin:0 auto;}#dt-page .diagram{padding:16px 12px 14px;}}#dt-page .r1-fig{margin:22px 0 6px;}#dt-page .r1-fig img{display:block;max-width:100%;height:auto;}#dt-page .r1-diagram img{width:100%;max-width:960px;border:1px solid var(--border,#E3EAE6);border-radius:12px;background:#fff;}#dt-page .r1-hero img,#dt-page .r1-card img{width:100%;max-width:640px;aspect-ratio:640\/440;border-radius:14px;}#dt-page .r1-crop>img{display:block;width:100%;height:auto;}#dt-page .r1-crop{border:1px solid var(--border,#E3EAE6);border-radius:12px;overflow:hidden;background:#fff;}#dt-page .r1-shots .r1-crop + .r1-crop{margin-top:14px;}#dt-page .r1-fig figcaption{margin-top:10px;font-size:13.5px;color:var(--ink-soft,#51605A);line-height:1.55;max-width:80ch;}#dt-page .r1-cards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;}#dt-page .r1-cards img{width:100%;aspect-ratio:640\/440;border-radius:12px;}#dt-page .head-grid{display:grid;grid-template-columns:minmax(0,1fr) minmax(0,440px);gap:40px;align-items:start;}#dt-page .head-grid .r1-fig{margin-top:6px;}#dt-page .r1-hero-wide{margin-top:28px;}#dt-page .ty-hero-grid.r1-onecol{grid-template-columns:1fr;}@media (max-width:900px){#dt-page .head-grid{grid-template-columns:1fr;}#dt-page .r1-cards{grid-template-columns:1fr;}}#dt-page .head-grid.hv2{grid-template-columns:minmax(0,1fr) minmax(0,440px);grid-template-areas:\"title media\" \"rest media\";grid-template-rows:auto 1fr;column-gap:48px;row-gap:0;align-items:start;}#dt-page .head-grid.hv2>.head-title{grid-area:title;}#dt-page .head-grid.hv2>.head-media{grid-area:media;}#dt-page .head-grid.hv2>.head-rest{grid-area:rest;}#dt-page .head-media{display:flex;flex-direction:column;gap:18px;}#dt-page .head-media .r1-fig{margin:6px 0 0;}#dt-page .head-media .definition{margin-top:0;max-width:none;}#dt-page .head-media .def-text{font-size:16px;line-height:1.55;}#dt-page .head-lead{margin-top:24px;}#dt-page .head-rest>.head-lead{margin-top:0;}#dt-page .head-rest{padding-top:24px;}#dt-page .head-rest>.hero-copy>p:first-child{margin-top:0;}#dt-page .head-rest>.hero-copy{margin-top:0;}#dt-page .head-lead h2{font-size:22px;line-height:1.3;margin:0 0 10px;}#dt-page .head-lead p{margin:0 0 14px;}#dt-page .head-lead .section-head{margin:0;max-width:none;}#dt-page .ew-head{padding-bottom:56px;}#dt-page .def-kicker::before{content:none;}#dt-page .definition::after{content:none;}#dt-page .definition .def-text{font-weight:400;letter-spacing:0;}#dt-page .definition .def-text strong{font-weight:700;}#dt-page .hero-link{margin-top:24px;}#dt-page .prof-grid.no-aside{grid-template-columns:minmax(0,780px);}#dt-page .case-hero .head-media .prof-glance{position:static;width:100%;}#dt-page .art-grid>article.prose>h2:first-child,#dt-page .pillar-body>.prose:first-child>h2:first-child{margin-top:0;}#dt-page .head-lead p.lede,#dt-page .head-rest p.lede{font-size:inherit;}#dt-page .case-layout.no-aside{grid-template-columns:minmax(0,780px);grid-template-areas:\"main\";}#dt-page .case-hero .head-lead .definition{margin-top:22px;}#dt-page .case-hero .head-lead .def-text{font-size:16px;line-height:1.55;}#dt-page .case-hero .head-media .case-aside{position:static;}#dt-page .case-hero .head-media .factbox{margin:0;width:100%;max-width:none;}#dt-page .case-hero .head-media .case-aside{width:100%;}@media (max-width:900px){#dt-page .head-grid.hv2{display:flex;flex-direction:column;gap:0;}#dt-page .head-grid.hv2 .head-media{display:contents;}#dt-page .head-grid.hv2>.head-title{order:1;}#dt-page .head-grid.hv2 .head-media .definition{order:2;margin-top:22px;}#dt-page .head-grid.hv2 .head-media .r1-fig{order:3;margin-top:22px;}#dt-page .head-grid.hv2>.head-rest{order:4;}#dt-page .head-grid.case-hero>.head-rest{order:2;}#dt-page .head-grid.case-hero .head-media>*{order:3;margin-top:22px;}}#dt-page .tcta-band{padding:48px 0;}#dt-page .tcta{position:relative;overflow:hidden;display:grid;grid-template-columns:minmax(0,1fr) minmax(0,1.1fr);gap:40px;align-items:center;border-radius:16px;padding:40px 0 40px 40px;background:var(--ink);color:#fff;text-align:left;}#dt-page .tcta::after{content:\"\";position:absolute;right:-120px;top:-120px;width:360px;height:360px;border-radius:50%;background:radial-gradient(circle,rgba(16,185,129,.28),rgba(16,185,129,0) 70%);pointer-events:none;}#dt-page .tcta .eyebrow.on-dark{display:inline-flex;align-items:center;gap:8px;background:rgba(255,255,255,0.1);border:1px solid rgba(255,255,255,0.18);color:#8FE3C3;border-radius:999px;padding:6px 12px;font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:12px;font-weight:600;letter-spacing:.08em;text-transform:uppercase;margin-bottom:14px;}#dt-page .tcta .eyebrow.on-dark .dot{width:6px;height:6px;border-radius:50%;background:#6FE3B6;}#dt-page .tcta h2{font-size:28px;font-weight:900;letter-spacing:-0.01em;line-height:1.2;color:#fff;margin:0;}#dt-page .tcta .tcta-sub{margin:12px 0 0;font-size:15px;line-height:1.6;color:#CFE0D8;}#dt-page .tcta-k{margin-top:22px;font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:10.5px;font-weight:600;letter-spacing:.08em;text-transform:uppercase;color:#8FA69A;}#dt-page .tcta-list{list-style:none;margin:10px 0 0;padding:0;display:grid;gap:8px;font-size:14px;}#dt-page .tcta-list li{display:flex;gap:8px;align-items:flex-start;line-height:1.45;color:#fff;font-weight:600;padding-bottom:8px;border-bottom:1px solid rgba(255,255,255,.08);}#dt-page .tcta-more{list-style:none;margin:10px 0 0;padding:0;display:grid;grid-template-columns:1fr 1fr;gap:8px 18px;font-size:13.5px;color:#E4EEE9;}#dt-page .tcta-more li{display:flex;gap:7px;align-items:flex-start;line-height:1.45;}#dt-page .tcta svg{width:14px;height:14px;flex-shrink:0;margin-top:3px;color:#6FE3B6;}#dt-page .tcta-act{margin-top:26px;display:flex;align-items:center;gap:16px;flex-wrap:wrap;}#dt-page .tcta-btn{display:inline-flex;align-items:center;gap:8px;background:var(--mint-fill);color:#fff;font-family:'Lato',sans-serif;font-weight:700;font-size:16px;border-radius:8px;padding:14px 22px;text-decoration:none;}#dt-page .tcta-btn:hover{background:#0C9A6E;}#dt-page .tcta-btn svg{width:16px;height:16px;margin:0;color:#fff;}#dt-page .tcta-g2{font-size:12.5px;color:#CFE0D8;}#dt-page .tcta-g2 strong{color:#fff;}#dt-page .tcta-g2 .stars{color:#E0A32E;letter-spacing:1px;font-size:11px;}#dt-page .tcta-fine{margin:12px 0 0;font-size:12.5px;line-height:1.55;max-width:52ch;color:#8FA69A;}#dt-page .tcta-shot{align-self:stretch;display:flex;align-items:center;}#dt-page .tcta-frame{width:calc(100% + 140px);border-radius:10px 0 0 10px;overflow:hidden;box-shadow:0 30px 60px -30px rgba(0,0,0,.55);border:1px solid rgba(255,255,255,.14);border-right:none;background:#fff;}#dt-page .tcta-frame .bar{height:26px;display:flex;align-items:center;gap:6px;padding:0 12px;background:#EEF2F0;border-bottom:1px solid var(--border);}#dt-page .tcta-frame .bar i{width:8px;height:8px;border-radius:50%;background:#C9D3CE;}#dt-page .tcta-frame img{display:block;width:100%;height:auto;}#dt-page .tcta-cap{margin-top:10px;font-family:'IBM Plex Mono',ui-monospace,monospace;font-size:10.5px;letter-spacing:.06em;text-transform:uppercase;color:#8FA69A;}@media (max-width:900px){#dt-page .tcta{grid-template-columns:1fr;padding:32px 24px 0;gap:28px;}#dt-page .tcta-shot{margin:0 -24px 0 0;}#dt-page .tcta-frame{width:100%;}}@media (max-width:600px){#dt-page .tcta h2{font-size:23px;}#dt-page .tcta-more{grid-template-columns:1fr;}#dt-page .tcta-btn{width:100%;justify-content:center;}}#dt-page .definition .def-text{font-size:16px;line-height:1.6;}<\/style><div id=\"dt-page\" class=\"dt-page\"><section class=\"pc-head\"><div class=\"wrap\"><nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol><li><a href=\"\/en\/\">Home<\/a><\/li><li><a href=\"https:\/\/datatrue.com\/en\/resources\/\">Resources<\/a><\/li><li><a href=\"https:\/\/datatrue.com\/en\/resources\/privacy-compliance\/\">Privacy &amp; Compliance<\/a><\/li><li aria-current=\"page\">PII Scanning<\/li><\/ol><\/nav><div class=\"head-grid hv2\"><div class=\"head-title\"><span class=\"eyebrow\"><span class=\"dot\"><\/span>Privacy &amp; Compliance <span class=\"sep\">\/<\/span> Guide<\/span><h1>What Is PII Scanning? Tools, Methods, and a Checklist<\/h1><\/div><div class=\"head-media\"><figure class=\"r1-fig r1-hero\"><img loading=\"lazy\" decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/09\/H-PII.png\" alt=\"\" width=\"640\" height=\"440\"><\/figure><div class=\"definition\" id=\"definition\"><p class=\"def-kicker\">Summary<\/p><p class=\"def-text\"><strong>PII scanning<\/strong> is the process of discovering where your business collects and stores personally identifiable information, so you can secure it or dispose of it. It covers the obvious places, like databases and files, and the easily missed one: the personal data your website tags and cookies quietly send to third parties.<\/p><\/div><\/div><div class=\"head-rest\"><div class=\"head-lead\"><p>Most businesses store more personal data than they intend to. It accumulates in old form submissions, exported spreadsheets, backup drives, and the tracking tags running on every page. PII scanning is how you find all of it, which is the first step in any real compliance effort. This guide explains what PII scanning is, when to run it, and a 6-step checklist to do it well.<\/p><p>The checklist starts with a physical audit and a stock-take of devices and servers, then moves to the scan itself. It also includes a tag and cookie audit, because tracking tags are one of the places personal data ends up.<\/p><\/div><\/div><\/div><\/div><\/section><div class=\"wrap\"><div class=\"art-grid\"><article class=\"prose\"><h2 id=\"what-is-pii\">What is PII?<\/h2><p>PII stands for personally identifiable information: any data that can be used to identify an individual. That includes names, addresses, phone numbers, credit card details, and email addresses. It also includes online identifiers like an IP address or a cookie ID, which is why your website tags are a PII question and not just your internal systems.<\/p><p>For the wider picture of how PII is regulated, see our guide to <a href=\"https:\/\/datatrue.com\/en\/resources\/privacy-compliance\/pii-compliance\/\">PII compliance<\/a>.<\/p><h2 id=\"what-is-pii-scanning\">What is PII scanning?<\/h2><p>PII scanning is a process undertaken to discover the personal data your business is accumulating. Your business is likely storing PII without intending to, across devices, servers, files, and the third-party tags on your website. A scan locates that data so you can decide what to keep, secure, or delete.<\/p><figure class=\"r1-fig r1-shots\" role=\"group\"><div class=\"r1-crop\" style=\"max-width:1102px\"><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/09\/pii-persona-config-crop.png\" alt=\"A DataTrue test persona with fictitious sensitive items, a credit card number, an email address and an SSN, each marked sensitive.\" width=\"1102\" height=\"450\" loading=\"lazy\"><\/div><div class=\"r1-crop\" style=\"max-width:890px\"><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/09\/pii-leak-alert-crop.png\" alt=\"DataTrue sensitive data results for a PII leak check: the persona&#x27;s credit card number, email and SSN were each found once.\" width=\"890\" height=\"345\" loading=\"lazy\"><\/div><\/figure><p>There are two sides to it. Data-at-rest scanning looks through your stored files and systems. Data-in-motion scanning looks at what your website sends as people use it, catching tags that transmit an email address or other identifier to an ad platform or analytics vendor. Both matter, because a leak in motion never touches a file you could scan at rest.<\/p><h2 id=\"when-should-you-use-a-pii-scanning-tool\">When should you use a PII scanning tool?<\/h2><p>Run a scan whenever you cannot confidently answer the question &#8220;what personal data do we hold, and where.&#8221; In practice that means before a compliance audit, after adding or changing marketing tags, when preparing a record of processing activities, and on a regular schedule so new leakage is caught early rather than discovered by a regulator.<\/p><p>The website side deserves particular attention. Tags change often, vendors update their scripts without telling you, and a marketing team can add a pixel in minutes. Any of those can start sending personal data you never signed off on.<\/p><h2 id=\"complying-with-the-general-data-protection-regulation\">Complying with the General Data Protection Regulation<\/h2><p>The GDPR is the reason many organizations run PII scans in the first place. It requires you to know what personal data you process, to hold it lawfully and securely, and to be able to respond to a data subject access request by producing everything you hold about a person. You cannot meet any of those obligations without first knowing where the data is.<\/p><p>Scanning also supports the GDPR&#8217;s data minimization principle: once you can see what you collect, you can stop collecting what you do not need. For the tag-level detail, see <a href=\"https:\/\/datatrue.com\/en\/resources\/privacy-compliance\/gdpr-for-analytics-tags\/\">GDPR for analytics tags<\/a>.<\/p><h2 id=\"the-pii-scanning-checklist\">The PII scanning checklist<\/h2><p>These six steps establish a repeatable process rather than a one-off cleanup.<\/p><ol class=\"checklist\"><li id=\"conduct-a-physical-audit\"><span class=\"ck-num\" aria-hidden=\"true\">1<\/span><div class=\"ck-body\"><h3><span class=\"sr-only\">1. <\/span>Conduct a physical audit<\/h3><p>Start with what is offline: paper records, printouts, and any physical files that hold personal data. These are easy to forget and hard to secure, so account for them before moving to digital.<\/p><\/div><\/li><li id=\"take-stock-of-devices-and-servers\"><span class=\"ck-num\" aria-hidden=\"true\">2<\/span><div class=\"ck-body\"><h3><span class=\"sr-only\">2. <\/span>Take stock of devices and servers<\/h3><p>List every device and server that could hold personal data, including staff laptops, shared drives, cloud storage, and backups. You are building the map of places a scan needs to reach.<\/p><\/div><\/li><li id=\"conduct-a-pii-scan-for-devices-and-servers\"><span class=\"ck-num\" aria-hidden=\"true\">3<\/span><div class=\"ck-body\"><h3><span class=\"sr-only\">3. <\/span>Conduct a PII scan for devices and servers<\/h3><p>Run a scanning tool across that inventory to find the personal data actually stored on it. Expect to find data in places nobody remembered, which is the point of scanning rather than guessing.<\/p><\/div><\/li><li id=\"conduct-a-tag-and-cookie-audit\"><span class=\"ck-num\" aria-hidden=\"true\">4<\/span><div class=\"ck-body\"><h3><span class=\"sr-only\">4. <\/span>Conduct a tag and cookie audit<\/h3><p>This is the step most PII programs miss. Your website tags and cookies collect and transmit personal data as visitors use the site, and that data never lands in a file you can scan at rest. A <a href=\"https:\/\/datatrue.com\/en\/resources\/privacy-compliance\/cookie-audit\/\">cookie audit<\/a> shows what your cookies gather, and scanning your tag payloads shows whether any tag is sending personal data to a third party. DataTrue automates this by loading your site the way a real visitor would and inspecting what each tag sends, using fictitious personas so you can test for a leak without exposing a real customer&#8217;s data.<\/p><\/div><\/li><li id=\"secure-or-dispose-of-data\"><span class=\"ck-num\" aria-hidden=\"true\">5<\/span><div class=\"ck-body\"><h3><span class=\"sr-only\">5. <\/span>Secure or dispose of data<\/h3><p>For everything the scan found, decide: keep and secure it, or delete it. Encrypt sensitive PII, restrict who can access it, and remove anything you have no lawful reason to hold. Less stored data means less to protect and less to lose.<\/p><\/div><\/li><li id=\"set-future-processes\"><span class=\"ck-num\" aria-hidden=\"true\">6<\/span><div class=\"ck-body\"><h3><span class=\"sr-only\">6. <\/span>Set future processes<\/h3><p>A single scan goes stale the moment a new tag ships or a new form goes live. Schedule scans on a recurring basis, monitor your tags for changes, and assign someone ownership of the process, so PII scanning becomes a standing control rather than a fire drill.<\/p><\/div><\/li><\/ol><p>DataTrue helps with the parts of this that live in your tags and cookies. It detects PII leakage using fictitious personas, audits your cookie behavior, and alerts you when a change starts sending data it should not.<\/p><section class=\"faq-block\" aria-labelledby=\"questions\"><h2 id=\"questions\">Questions<\/h2><div class=\"faq-list\"><details class=\"faq-item\" open><summary>What is PII scanning?<\/summary><p>It is the process of finding where your organization collects and stores personally identifiable information, so you can secure or delete it. It covers stored data in files and systems, and data in motion, meaning the personal data your website tags and cookies send to third parties as people use your site.<\/p><\/details><details class=\"faq-item\"><summary>Why does website tracking matter for PII scanning?<\/summary><p>Because tags and cookies transmit personal data, like an email address or an IP, to third parties in real time. That data never lands in a file you could scan at rest, so a scan that only looks at stored data misses it entirely. Auditing what your tags actually send is the only way to catch it.<\/p><\/details><details class=\"faq-item\"><summary>How often should I run a PII scan?<\/summary><p>On a recurring schedule, and after any change to your marketing or analytics tags. Tags change frequently and vendors update their scripts without notice, so a scan that was clean last quarter can be leaking today.<\/p><\/details><details class=\"faq-item\"><summary>How do I scan for PII without exposing real customer data?<\/summary><p>Use fictitious personas: invented profiles with fake names, emails, and payment details. Submitting those through your forms and watching what the tags transmit lets you test for a leak without ever putting a real person&#8217;s data at risk. DataTrue uses this approach for its tag and cookie scanning.<\/p><\/details><details class=\"faq-item\"><summary>What is the difference between PII scanning and a cookie audit?<\/summary><p>A cookie audit inventories the cookies your site sets and what they store. PII scanning is broader: it looks for personal data everywhere it accumulates, including in tag payloads sent to third parties. The two overlap on the website, and running both gives you the full picture.<\/p><\/details><\/div><\/section><\/article><aside class=\"toc\" aria-label=\"On this page\"><p class=\"toc-label\">On this page<\/p><ol><li><a href=\"#what-is-pii\">What is PII?<\/a><\/li><li><a href=\"#what-is-pii-scanning\">What is PII scanning?<\/a><\/li><li><a href=\"#when-should-you-use-a-pii-scanning-tool\">When should you use a PII scanning tool?<\/a><\/li><li><a href=\"#complying-with-the-general-data-protection-regulation\">Complying with the General Data Protection Regulation<\/a><\/li><li><a href=\"#the-pii-scanning-checklist\">The PII scanning checklist<\/a><\/li><li><a href=\"#questions\">Questions<\/a><\/li><li><a href=\"#related\">Related guides<\/a><\/li><\/ol><\/aside><\/div><\/div><section class=\"band alt\" aria-labelledby=\"related\"><div class=\"wrap\"><div class=\"section-head\"><h2 id=\"related\">Related guides<\/h2><\/div><div class=\"tile-grid\"><a href=\"https:\/\/datatrue.com\/en\/resources\/privacy-compliance\/cookie-audit\/\" class=\"tile\"><span class=\"t-label\">Guide<\/span><h3>Cookie Audit<\/h3><\/a><a href=\"https:\/\/datatrue.com\/en\/resources\/privacy-compliance\/gdpr-for-analytics-tags\/\" class=\"tile\"><span class=\"t-label\">Law guide<\/span><h3>GDPR for Analytics Tags<\/h3><\/a><a href=\"https:\/\/datatrue.com\/en\/resources\/privacy-compliance\/pii-compliance\/\" class=\"tile\"><span class=\"t-label\">Guide<\/span><h3>PII Compliance<\/h3><\/a><\/div><\/div><\/section><section class=\"tcta-band\"><div class=\"wrap\"><div class=\"tcta\"> <div class=\"tcta-copy\"><span class=\"eyebrow on-dark\"><span class=\"dot\"><\/span>30-day free trial<\/span><h2>Find personal data in your tags before an ad platform does<\/h2><p class=\"tcta-sub\">DataTrue fills your forms with test personas and reads each tag request for emails, names and card numbers. A leak shows up in a test, with the tag and the page that sent it.<\/p> <div class=\"tcta-k\">What DataTrue checks<\/div><ul class=\"tcta-list\"><li><svg viewBox=\"0 0 16 16\" fill=\"none\" aria-hidden=\"true\"><path d=\"M3.5 8.5l3 3 6-7\" stroke=\"currentColor\" stroke-width=\"1.8\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg>Every page, with coverage scans<\/li><li><svg viewBox=\"0 0 16 16\" fill=\"none\" aria-hidden=\"true\"><path d=\"M3.5 8.5l3 3 6-7\" stroke=\"currentColor\" stroke-width=\"1.8\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg>Scheduled runs, with alerts when a result changes<\/li><li><svg viewBox=\"0 0 16 16\" fill=\"none\" aria-hidden=\"true\"><path d=\"M3.5 8.5l3 3 6-7\" stroke=\"currentColor\" stroke-width=\"1.8\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg>Full journeys, like checkout and signup, in each consent state<\/li><li><svg viewBox=\"0 0 16 16\" fill=\"none\" aria-hidden=\"true\"><path d=\"M3.5 8.5l3 3 6-7\" stroke=\"currentColor\" stroke-width=\"1.8\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg>What each tag sent, field by field<\/li><\/ul> <div class=\"tcta-k\">Also in the full platform<\/div><ul class=\"tcta-more\"><li><svg viewBox=\"0 0 16 16\" fill=\"none\" aria-hidden=\"true\"><path d=\"M3.5 8.5l3 3 6-7\" stroke=\"currentColor\" stroke-width=\"1.8\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg>PII detection with test personas<\/li><li><svg viewBox=\"0 0 16 16\" fill=\"none\" aria-hidden=\"true\"><path d=\"M3.5 8.5l3 3 6-7\" stroke=\"currentColor\" stroke-width=\"1.8\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg>iOS and Android app testing<\/li><li><svg viewBox=\"0 0 16 16\" fill=\"none\" aria-hidden=\"true\"><path d=\"M3.5 8.5l3 3 6-7\" stroke=\"currentColor\" stroke-width=\"1.8\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg>Pre-publish testing for GTM and Adobe Tags<\/li><li><svg viewBox=\"0 0 16 16\" fill=\"none\" aria-hidden=\"true\"><path d=\"M3.5 8.5l3 3 6-7\" stroke=\"currentColor\" stroke-width=\"1.8\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg>REST API, plus Slack and Jira alerts<\/li><\/ul> <div class=\"tcta-act\"><a class=\"tcta-btn\" href=\"https:\/\/datatrue.com\/en\/start-free-trial\/\">Start a free 30-day trial <svg viewBox=\"0 0 16 16\" fill=\"none\" aria-hidden=\"true\"><path d=\"M3 8h10M9 4l4 4-4 4\" stroke=\"currentColor\" stroke-width=\"1.6\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg><\/a><span class=\"tcta-g2\"><span class=\"stars\">\u2605\u2605\u2605\u2605\u2605<\/span> <strong>4.6\/5<\/strong> on G2<\/span><\/div> <p class=\"tcta-fine\">The full platform, every feature, free for 30 days.<\/p><\/div> <div class=\"tcta-shot\"><div style=\"width:100%\"><div class=\"tcta-frame\"><div class=\"bar\"><i><\/i><i><\/i><i><\/i><\/div><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/09\/pii-leak-alert.png\" alt=\"DataTrue flagging sensitive data found in a tag request: a credit card number, an email address and an SSN from a test persona\" width=\"1402\" height=\"876\" loading=\"lazy\"><\/div><div class=\"tcta-cap\">Sensitive data found in a tag request<\/div><\/div><\/div> <\/div><\/div><\/section><\/div><script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"What is PII scanning?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"It is the process of finding where your organization collects and stores personally identifiable information, so you can secure or delete it. It covers stored data in files and systems, and data in motion, meaning the personal data your website tags and cookies send to third parties as people use your site.\"}},{\"@type\":\"Question\",\"name\":\"Why does website tracking matter for PII scanning?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Because tags and cookies transmit personal data, like an email address or an IP, to third parties in real time. That data never lands in a file you could scan at rest, so a scan that only looks at stored data misses it entirely. Auditing what your tags actually send is the only way to catch it.\"}},{\"@type\":\"Question\",\"name\":\"How often should I run a PII scan?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"On a recurring schedule, and after any change to your marketing or analytics tags. Tags change frequently and vendors update their scripts without notice, so a scan that was clean last quarter can be leaking today.\"}},{\"@type\":\"Question\",\"name\":\"How do I scan for PII without exposing real customer data?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Use fictitious personas: invented profiles with fake names, emails, and payment details. Submitting those through your forms and watching what the tags transmit lets you test for a leak without ever putting a real person's data at risk. DataTrue uses this approach for its tag and cookie scanning.\"}},{\"@type\":\"Question\",\"name\":\"What is the difference between PII scanning and a cookie audit?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"A cookie audit inventories the cookies your site sets and what they store. PII scanning is broader: it looks for personal data everywhere it accumulates, including in tag payloads sent to third parties. The two overlap on the website, and running both gives you the full picture.\"}}]}<\/script>\n","protected":false},"excerpt":{"rendered":"<p>Home Resources Privacy &amp; Compliance PII Scanning Privacy &amp; Compliance \/ Guide What Is PII Scanning? Tools, Methods, and a Checklist Summary PII scanning is the process of discovering where your business collects and stores personally identifiable information, so you can secure it or dispose of it. It covers the obvious places, like databases and [&hellip;]<\/p>\n","protected":false},"author":14,"featured_media":0,"parent":227593,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"off","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"class_list":["post-227673","page","type-page","status-publish","hentry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>What Is PII Scanning? Tools &amp; Methods | DataTrue<\/title>\n<meta name=\"description\" content=\"PII scanning is the process of finding where your business is collecting and storing personal data, including the personal data your website tags and cookies send to third parties. What it is, when to run it, and a 6-step checklist.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/datatrue.com\/en\/resources\/privacy-compliance\/pii-scanning\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What Is PII Scanning? Tools &amp; Methods | DataTrue\" \/>\n<meta property=\"og:description\" content=\"PII scanning is the process of finding where your business is collecting and storing personal data, including the personal data your website tags and cookies send to third parties. What it is, when to run it, and a 6-step checklist.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/datatrue.com\/en\/resources\/privacy-compliance\/pii-scanning\/\" \/>\n<meta property=\"og:site_name\" content=\"DataTrue\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/datatruedigital\/\" \/>\n<meta property=\"og:image\" content=\"https:\/\/datatrue.com\/wp-content\/uploads\/2022\/04\/New-DT-Logo.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1328\" \/>\n\t<meta property=\"og:image:height\" content=\"208\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@data_true\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/datatrue.com\\\/en\\\/resources\\\/privacy-compliance\\\/pii-scanning\\\/\",\"url\":\"https:\\\/\\\/datatrue.com\\\/en\\\/resources\\\/privacy-compliance\\\/pii-scanning\\\/\",\"name\":\"What Is PII Scanning? Tools & Methods | DataTrue\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/datatrue.com\\\/en\\\/#website\"},\"datePublished\":\"2026-10-06T15:59:23+00:00\",\"description\":\"PII scanning is the process of finding where your business is collecting and storing personal data, including the personal data your website tags and cookies send to third parties. What it is, when to run it, and a 6-step checklist.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/datatrue.com\\\/en\\\/resources\\\/privacy-compliance\\\/pii-scanning\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/datatrue.com\\\/en\\\/resources\\\/privacy-compliance\\\/pii-scanning\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/datatrue.com\\\/en\\\/resources\\\/privacy-compliance\\\/pii-scanning\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/datatrue.com\\\/en\\\/datatrue-home-2026\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Resources\",\"item\":\"https:\\\/\\\/datatrue.com\\\/en\\\/resources\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Privacy &amp; Compliance\",\"item\":\"https:\\\/\\\/datatrue.com\\\/en\\\/resources\\\/privacy-compliance\\\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"PII Scanning\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/datatrue.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/datatrue.com\\\/en\\\/\",\"name\":\"DataTrue\",\"description\":\"Web Analytics Quality Assurance\",\"publisher\":{\"@id\":\"https:\\\/\\\/datatrue.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/datatrue.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/datatrue.com\\\/en\\\/#organization\",\"name\":\"DataTrue\",\"url\":\"https:\\\/\\\/datatrue.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/datatrue.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/datatrue.com\\\/wp-content\\\/uploads\\\/2022\\\/04\\\/New-DT-Logo.png\",\"contentUrl\":\"https:\\\/\\\/datatrue.com\\\/wp-content\\\/uploads\\\/2022\\\/04\\\/New-DT-Logo.png\",\"width\":1328,\"height\":208,\"caption\":\"DataTrue\"},\"image\":{\"@id\":\"https:\\\/\\\/datatrue.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/datatruedigital\\\/\",\"https:\\\/\\\/x.com\\\/data_true\",\"https:\\\/\\\/www.youtube.com\\\/c\\\/Datatrue\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What Is PII Scanning? Tools & Methods | DataTrue","description":"PII scanning is the process of finding where your business is collecting and storing personal data, including the personal data your website tags and cookies send to third parties. What it is, when to run it, and a 6-step checklist.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/datatrue.com\/en\/resources\/privacy-compliance\/pii-scanning\/","og_locale":"en_US","og_type":"article","og_title":"What Is PII Scanning? Tools & Methods | DataTrue","og_description":"PII scanning is the process of finding where your business is collecting and storing personal data, including the personal data your website tags and cookies send to third parties. What it is, when to run it, and a 6-step checklist.","og_url":"https:\/\/datatrue.com\/en\/resources\/privacy-compliance\/pii-scanning\/","og_site_name":"DataTrue","article_publisher":"https:\/\/www.facebook.com\/datatruedigital\/","og_image":[{"width":1328,"height":208,"url":"https:\/\/datatrue.com\/wp-content\/uploads\/2022\/04\/New-DT-Logo.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_site":"@data_true","twitter_misc":{"Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/datatrue.com\/en\/resources\/privacy-compliance\/pii-scanning\/","url":"https:\/\/datatrue.com\/en\/resources\/privacy-compliance\/pii-scanning\/","name":"What Is PII Scanning? Tools & Methods | DataTrue","isPartOf":{"@id":"https:\/\/datatrue.com\/en\/#website"},"datePublished":"2026-10-06T15:59:23+00:00","description":"PII scanning is the process of finding where your business is collecting and storing personal data, including the personal data your website tags and cookies send to third parties. What it is, when to run it, and a 6-step checklist.","breadcrumb":{"@id":"https:\/\/datatrue.com\/en\/resources\/privacy-compliance\/pii-scanning\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/datatrue.com\/en\/resources\/privacy-compliance\/pii-scanning\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/datatrue.com\/en\/resources\/privacy-compliance\/pii-scanning\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/datatrue.com\/en\/datatrue-home-2026\/"},{"@type":"ListItem","position":2,"name":"Resources","item":"https:\/\/datatrue.com\/en\/resources\/"},{"@type":"ListItem","position":3,"name":"Privacy &amp; Compliance","item":"https:\/\/datatrue.com\/en\/resources\/privacy-compliance\/"},{"@type":"ListItem","position":4,"name":"PII Scanning"}]},{"@type":"WebSite","@id":"https:\/\/datatrue.com\/en\/#website","url":"https:\/\/datatrue.com\/en\/","name":"DataTrue","description":"Web Analytics Quality Assurance","publisher":{"@id":"https:\/\/datatrue.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/datatrue.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/datatrue.com\/en\/#organization","name":"DataTrue","url":"https:\/\/datatrue.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/datatrue.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/datatrue.com\/wp-content\/uploads\/2022\/04\/New-DT-Logo.png","contentUrl":"https:\/\/datatrue.com\/wp-content\/uploads\/2022\/04\/New-DT-Logo.png","width":1328,"height":208,"caption":"DataTrue"},"image":{"@id":"https:\/\/datatrue.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/datatruedigital\/","https:\/\/x.com\/data_true","https:\/\/www.youtube.com\/c\/Datatrue"]}]}},"_links":{"self":[{"href":"https:\/\/datatrue.com\/en\/wp-json\/wp\/v2\/pages\/227673","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/datatrue.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/datatrue.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/datatrue.com\/en\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/datatrue.com\/en\/wp-json\/wp\/v2\/comments?post=227673"}],"version-history":[{"count":3,"href":"https:\/\/datatrue.com\/en\/wp-json\/wp\/v2\/pages\/227673\/revisions"}],"predecessor-version":[{"id":227853,"href":"https:\/\/datatrue.com\/en\/wp-json\/wp\/v2\/pages\/227673\/revisions\/227853"}],"up":[{"embeddable":true,"href":"https:\/\/datatrue.com\/en\/wp-json\/wp\/v2\/pages\/227593"}],"wp:attachment":[{"href":"https:\/\/datatrue.com\/en\/wp-json\/wp\/v2\/media?parent=227673"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}