Identifier detector
Spanish NIE: format, validation and detection
Short answer
A Spanish NIE is a leading X, Y or Z, seven digits and a check letter. Replace X, Y or Z with 0, 1 or 2, divide by 23, and look up the remainder in the same table as the DNI.
What it is
The NIE (Número de Identidad de Extranjero) is the identification number for foreigners in Spain. Maskflare covers it in the Spain pack, and the GDPR (EU/EEA) profile includes the pack.
In Maskflare this is the detector es_nie, labelled "Spain - NIE (foreigner ID)", category national id number, in the Spain pack.
Format and layout
- One letter X, Y or Z, seven digits, one letter: X1234567L.
- Spaces and hyphens are ignored by the validator.
How the check works
Swap the first letter for a digit (X = 0, Y = 1, Z = 2) and join it to the seven digits, then divide by 23. The remainder picks the check letter from TRWAGMYFPDXBNJZSQVHLCKE.
Worked example
- X becomes 0, so the number is 01234567, which is 1234567.
- 1234567 divided by 23 leaves 19.
- Position 19 in the table (counting from 0) is L, the last letter of the example.
Valid and invalid examples
| Example | Result | Why |
|---|---|---|
X1234567L | Valid | Matches the layout and passes the validator. |
X1234567A | Invalid | The invalid example changes one character, the last character: L becomes A. |
In running text the valid example reads, for instance, NIE X1234567L. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.
Regex and validation caveats
- As with the DNI, a random check letter is right one time in 23.
- The leading letters X, Y and Z narrow the shape, which keeps accidental matches down in free text.
- No context words are needed or used.
How to detect it in LLM traffic
Spanish NIE values reach an LLM inside ordinary work rather than as standalone data: a pasted block of HR or payroll rows, a customer-support thread, an onboarding or identity-check form, a spreadsheet someone wants summarised, or an email they want rewritten. The model needs none of the digits for any of those jobs, so the safest place to remove them is before the request leaves the company.
Maskflare reads the whole request body, including the system prompt, earlier messages and tool arguments, so a number buried in the fourth message of a long chat is found as readily as one in the latest message. Each match is replaced with a token such as mf_mask_d7e0 before the request goes out, and with response restoration turned on the real value is put back into the answer for the person who is allowed to see it.
If you build the detection yourself
- Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
- Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter Spanish NIE candidates.
- Run the check from the section above. A failing check is almost always a typo or a made-up value; a passing one removes most look-alikes.
- Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.
How Maskflare handles it
- Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token) when Spain is a primary country.
- Monitor first: alert (counted, forwarded unchanged) when Spain is a primary country.
The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.
Compliance profiles that include it
One compliance profile includes the Spain pack, and applying it turns this detector on: GDPR - EU/EEA. For the GDPR (EU/EEA) profile the Spain pack is one of the country packs the administrator can choose from; the profile turns on the ones chosen. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.
Frequently asked questions
What do X, Y and Z mean in a NIE?
For the check, they stand for 0, 1 and 2. Maskflare uses them only to compute the check letter.
Do DNI and NIE share a detector?
No. They are separate detectors with separate patterns, both in the Spain pack.
Is the Spanish NIE detector on by default?
It depends on the organisation's primary countries. It is part of the Spain pack, which the default Protect now template turns on with the action mask when Spain is a primary country.
Does a valid Spanish NIE prove the person exists?
No. A check digit shows the value is well formed. Many valid-looking numbers have never been issued, and Maskflare masks them all the same.
Rules on this page describe what Maskflare's detectors and validators check. They are read from the detection catalogue and are not the specification of the body that issues the identifier. Examples are synthetic.