Finnish HETU: format, validation and detection

What it is

The HETU identifies people in Finland. Maskflare's Finland pack covers it as a national ID, and the GDPR (EU/EEA) profile includes the pack.

In Maskflare this is the detector fi_hetu, labelled "Finland - Personal identity code (HETU)", category national id number, in the Finland pack.

Format and layout

• 11 characters: six date digits, one century sign, three digits and a check character, for example 131052-308T. The pattern accepts these century signs: - + A B C D E F U V W X Y.
• The date must be valid.
• The final character is a digit or one of the letters A to F, H, J to N, P, R to Y (not G, I, O, Q or Z).

How the check works

Join the six date digits and the three individual digits into a nine-digit number, divide it by 31, and use the remainder as a zero-based index into the string 0123456789ABCDEFHJKLMNPRSTUVWXY.

Worked example

1. The nine digits are 131052308.
2. 131052308 divided by 31 leaves 25.
3. Position 25 in the string (counting from 0) is T, the last character of the example.

Valid and invalid examples

In running text the valid example reads, for instance, HETU 131052-308T. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.

Regex and validation caveats

• The validator reads the character as upper case, so a lower-case final letter is accepted.
• One in 31 random combinations passes the check character; with the date rule the combined filter is stronger.
• No context words are needed; the century sign and the check letter make the shape specific.

How to detect it in LLM traffic

Finnish HETU values reach an LLM inside ordinary work rather than as standalone data: a pasted block of HR or payroll rows, a customer-support thread, an onboarding or identity-check form, a spreadsheet someone wants summarised, or an email they want rewritten. The model needs none of the digits for any of those jobs, so the safest place to remove them is before the request leaves the company.

Maskflare reads the whole request body, including the system prompt, earlier messages and tool arguments, so a number buried in the fourth message of a long chat is found as readily as one in the latest message. Each match is replaced with a token such as mf_mask_d7e0 before the request goes out, and with response restoration turned on the real value is put back into the answer for the person who is allowed to see it.

If you build the detection yourself

1. Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
2. Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter Finnish HETU candidates.
3. Run the check from the section above. A failing check is almost always a typo or a made-up value; a passing one removes most look-alikes.
4. Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.

How Maskflare handles it

• Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token) when Finland is a primary country.
• Monitor first: alert (counted, forwarded unchanged) when Finland is a primary country.

The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.

Compliance profiles that include it

One compliance profile includes the Finland pack, and applying it turns this detector on: GDPR - EU/EEA. For the GDPR (EU/EEA) profile the Finland pack is one of the country packs the administrator can choose from; the profile turns on the ones chosen. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.