Identifier detector
Irish PPS number (PPSN): format, validation and detection
Short answer
An Irish PPS number is seven digits and one or two letters. The first letter is a check character from the digits weighted 8 to 2, taken modulo 23 and looked up in the string WABCDEFGHIJKLMNOPQRSTUV.
What it is
The Personal Public Service Number identifies people dealing with Irish public services. Maskflare's Ireland pack covers it as a national ID, and the GDPR (EU/EEA) profile includes the pack.
In Maskflare this is the detector ie_ppsn, labelled "Ireland - Personal public service number (PPSN)", category national id number, in the Ireland pack.
Format and layout
- Seven digits then one letter, optionally followed by a second letter from A, B, H, W, T or X, for example 1234567T.
- Total length is 8 or 9 characters.
How the check works
Multiply the seven digits by 8, 7, 6, 5, 4, 3 and 2 and add them. If a ninth character is present, add its value times 9 (W counts as 0, other letters as their alphabet position). Divide by 23; the remainder indexes the string WABCDEFGHIJKLMNOPQRSTUV, and that letter must be the eighth character.
Worked example
- Digits 1 2 3 4 5 6 7 with weights 8 7 6 5 4 3 2 give 8, 14, 18, 20, 20, 18, 14.
- The total is 112, and 112 divided by 23 leaves 20.
- Position 20 in WABCDEFGHIJKLMNOPQRSTUV (counting from 0) is T, the letter of the example.
Valid and invalid examples
| Example | Result | Why |
|---|---|---|
1234567T | Valid | Matches the layout and passes the validator. |
1234567A | Invalid | The invalid example changes one character, the last character: T becomes A. |
In running text the valid example reads, for instance, PPSN 1234567T. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.
Regex and validation caveats
- The check letter is one of 23, so a wrong letter passes one time in 23.
- Seven digits and a letter is a plain shape and the detector uses no keyword, so the check letter is the only filter.
- Both the 8-character and 9-character forms are handled.
How to detect it in LLM traffic
Irish PPS number (PPSN) values reach an LLM inside ordinary work rather than as standalone data: a pasted block of HR or payroll rows, a customer-support thread, an onboarding or identity-check form, a spreadsheet someone wants summarised, or an email they want rewritten. The model needs none of the digits for any of those jobs, so the safest place to remove them is before the request leaves the company.
Maskflare reads the whole request body, including the system prompt, earlier messages and tool arguments, so a number buried in the fourth message of a long chat is found as readily as one in the latest message. Each match is replaced with a token such as mf_mask_d7e0 before the request goes out, and with response restoration turned on the real value is put back into the answer for the person who is allowed to see it.
If you build the detection yourself
- Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
- Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter Irish PPS number (PPSN) candidates.
- Run the check from the section above. A failing check is almost always a typo or a made-up value; a passing one removes most look-alikes.
- Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.
How Maskflare handles it
- Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token) when Ireland is a primary country.
- Monitor first: alert (counted, forwarded unchanged) when Ireland is a primary country.
The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.
Compliance profiles that include it
One compliance profile includes the Ireland pack, and applying it turns this detector on: GDPR - EU/EEA. For the GDPR (EU/EEA) profile the Ireland pack is one of the country packs the administrator can choose from; the profile turns on the ones chosen. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.
Frequently asked questions
How is the PPSN check letter worked out?
Weight the seven digits 8 to 2, add 9 times the value of any second letter, divide by 23, and look up the remainder in WABCDEFGHIJKLMNOPQRSTUV.
What does a second letter on a PPSN mean?
Maskflare uses it as an extra input to the check calculation, counting W as zero. It does not interpret what the letter means.
Is the Irish PPS number (PPSN) detector on by default?
It depends on the organisation's primary countries. It is part of the Ireland pack, which the default Protect now template turns on with the action mask when Ireland is a primary country.
Does a valid Irish PPS number (PPSN) prove the person exists?
No. A check digit shows the value is well formed. Many valid-looking numbers have never been issued, and Maskflare masks them all the same.
Rules on this page describe what Maskflare's detectors and validators check. They are read from the detection catalogue and are not the specification of the body that issues the identifier. Examples are synthetic.