Spanish DNI: format, validation and detection

What it is

The DNI (Documento Nacional de Identidad) is the Spanish national identity number. Maskflare lists it in the Spain pack as a national ID, and the GDPR (EU/EEA) profile includes the pack.

In Maskflare this is the detector es_dni, labelled "Spain - DNI", category national id number, in the Spain pack.

Format and layout

• Eight digits followed by one letter, such as 12345678Z. Spaces and hyphens inside the value are ignored by the validator.
• The letter is the check character.

How the check works

Divide the eight-digit number by 23. The remainder, from 0 to 22, selects a letter from the string T R W A G M Y F P D X B N J Z S Q V H L C K E, counting from zero.

Worked example

1. 12345678 divided by 23 leaves 14.
2. Position 14 in the table (counting from 0) is Z, the letter of the example.

Valid and invalid examples

In running text the valid example reads, for instance, DNI 12345678Z. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.

Regex and validation caveats

• Only 23 letters are used, so a random letter matches the check one time in 23.
• The detector has no context words, so eight digits plus a letter are enough.
• The check shows form only; a DNI that passes may never have been issued.

How to detect it in LLM traffic

Spanish DNI values reach an LLM inside ordinary work rather than as standalone data: a pasted block of HR or payroll rows, a customer-support thread, an onboarding or identity-check form, a spreadsheet someone wants summarised, or an email they want rewritten. The model needs none of the digits for any of those jobs, so the safest place to remove them is before the request leaves the company.

Maskflare reads the whole request body, including the system prompt, earlier messages and tool arguments, so a number buried in the fourth message of a long chat is found as readily as one in the latest message. Each match is replaced with a token such as mf_mask_d7e0 before the request goes out, and with response restoration turned on the real value is put back into the answer for the person who is allowed to see it.

If you build the detection yourself

1. Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
2. Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter Spanish DNI candidates.
3. Run the check from the section above. A failing check is almost always a typo or a made-up value; a passing one removes most look-alikes.
4. Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.

How Maskflare handles it

• Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token) when Spain is a primary country.
• Monitor first: alert (counted, forwarded unchanged) when Spain is a primary country.

The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.

Compliance profiles that include it

One compliance profile includes the Spain pack, and applying it turns this detector on: GDPR - EU/EEA. For the GDPR (EU/EEA) profile the Spain pack is one of the country packs the administrator can choose from; the profile turns on the ones chosen. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.