Belgian national register number: format, validation and detection

What it is

The rijksregisternummer (French: numéro de registre national) identifies people in Belgium. Maskflare's Belgium pack covers it as a national ID, also described as social security, and the GDPR (EU/EEA) profile includes the pack.

In Maskflare this is the detector be_national_number, labelled "Belgium - National register number (also social security)", category national id number, in the Belgium pack.

Format and layout

• 11 digits, usually printed YY.MM.DD-XXX.CC, for example 85.07.30-033.28.
• Dots, hyphens and spaces are accepted by the pattern.

How the check works

Take the first nine digits as a number and compute 97 minus its remainder modulo 97. If that equals the last two digits, the number is valid for someone born before 2000. If not, put a 2 in front of the nine digits and try again; a match means a person born in 2000 or later.

Worked example

1. The first nine digits are 850730033.
2. 850730033 divided by 97 leaves 69, and 97 minus 69 is 28.
3. 28 equals the last two digits, so the number passes as a pre-2000 birth.

Valid and invalid examples

In running text the valid example reads, for instance, rijksregisternummer 85.07.30-033.28. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.

Regex and validation caveats

• The validator accepts either century rule, so a number can pass if it matches either calculation.
• A mod 97 check passes about two in 97 random numbers because of the two tries.
• The separators are optional, so an unseparated 11-digit run is masked unless a word like order or invoice sits closer to it than one of the detector's keywords.

Words that confirm it

The formatted shape is masked without a keyword. For a run with no separators, these words count as the detector's own keywords when a word like order, invoice or phone is also close: id no, id number, identity number, insz, national id, national number, national register, niss, nn, numero national, numéro national, personal id, personal number, registre national, rijksregister, rijksregisternummer, social insurance, social security, ssn. The nearer word wins.

How to detect it in LLM traffic

Belgian national register number values reach an LLM inside ordinary work rather than as standalone data: a pasted block of HR or payroll rows, a customer-support thread, an onboarding or identity-check form, a spreadsheet someone wants summarised, or an email they want rewritten. The model needs none of the digits for any of those jobs, so the safest place to remove them is before the request leaves the company.

Maskflare reads the whole request body, including the system prompt, earlier messages and tool arguments, so a number buried in the fourth message of a long chat is found as readily as one in the latest message. Each match is replaced with a token such as mf_mask_d7e0 before the request goes out, and with response restoration turned on the real value is put back into the answer for the person who is allowed to see it.

If you build the detection yourself

1. Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
2. Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter Belgian national register number candidates.
3. Run the check from the section above. A failing check is almost always a typo or a made-up value; a passing one removes most look-alikes.
4. Treat a run with no separators more carefully than a formatted one: reject it when a word such as order, invoice, phone or reference is nearer to it than one of the identifier's own keywords.
5. Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.

How Maskflare handles it

• Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token) when Belgium is a primary country.
• Monitor first: alert (counted, forwarded unchanged) when Belgium is a primary country.

The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.

Compliance profiles that include it

One compliance profile includes the Belgium pack, and applying it turns this detector on: GDPR - EU/EEA. For the GDPR (EU/EEA) profile the Belgium pack is one of the country packs the administrator can choose from; the profile turns on the ones chosen. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.