Identifier detector
Dutch BSN: format, validation and detection
Short answer
A Dutch citizen service number (BSN) has nine digits and passes the 11-test: weight the first eight digits 9 to 2, subtract the last digit, and the result must be divisible by 11.
What it is
The burgerservicenummer identifies people in dealings with Dutch government and healthcare. Maskflare's Netherlands pack covers it as a national ID, and the GDPR (EU/EEA) profile includes the pack.
In Maskflare this is the detector nl_bsn, labelled "Netherlands - Citizen service number (BSN)", category national id number, in the Netherlands pack.
Format and layout
- Nine digits, for example 111222333.
- All nine digits cannot be the same.
How the check works
Multiply the first eight digits by 9, 8, 7, 6, 5, 4, 3 and 2, add them up, then subtract the ninth digit. The result must be a multiple of 11. In effect the last digit has weight minus 1.
Worked example
- Digits 1 1 1 2 2 2 3 3 with weights 9 8 7 6 5 4 3 2 give 9, 8, 7, 12, 10, 8, 9, 6.
- The total is 69. Subtracting the ninth digit, 3, leaves 66.
- 66 is 6 times 11, so the number passes.
Valid and invalid examples
| Example | Result | Why |
|---|---|---|
111222333 | Valid | Matches the layout and passes the validator. |
111222330 | Invalid | The invalid example changes one character, the last character: 3 becomes 0. |
In running text the valid example reads, for instance, BSN 111222333. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.
Regex and validation caveats
- Nine-digit numbers are everywhere, and the 11-test passes about one in 11 of them, so the detector requires one of 16 context words before the number: BSN, burgerservicenummer, document number, id card and similar.
- The keyword is the main protection against a nine-digit document or reference number that happens to pass the 11-test.
Words that confirm it
The detector masks a match only when one of its keywords appears within 48 characters before the value. The catalogue lists 16: bsn, burgerservicenummer, citizen service, document number, id card, id no, id number, identity card, identity number, insurance number, passport, social insurance, social security, sofi, sofinummer, ssn.
How to detect it in LLM traffic
Dutch BSN values reach an LLM inside ordinary work rather than as standalone data: a pasted block of HR or payroll rows, a customer-support thread, an onboarding or identity-check form, a spreadsheet someone wants summarised, or an email they want rewritten. The model needs none of the digits for any of those jobs, so the safest place to remove them is before the request leaves the company.
Maskflare reads the whole request body, including the system prompt, earlier messages and tool arguments, so a number buried in the fourth message of a long chat is found as readily as one in the latest message. Each match is replaced with a token such as mf_mask_d7e0 before the request goes out, and with response restoration turned on the real value is put back into the answer for the person who is allowed to see it.
If you build the detection yourself
- Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
- Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter Dutch BSN candidates.
- Run the check from the section above. A failing check is almost always a typo or a made-up value; a passing one removes most look-alikes.
- Require one of the words listed above shortly before the value. Maskflare looks back 48 characters.
- Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.
How Maskflare handles it
- Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token) when Netherlands is a primary country.
- Monitor first: alert (counted, forwarded unchanged) when Netherlands is a primary country.
The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.
Compliance profiles that include it
One compliance profile includes the Netherlands pack, and applying it turns this detector on: GDPR - EU/EEA. For the GDPR (EU/EEA) profile the Netherlands pack is one of the country packs the administrator can choose from; the profile turns on the ones chosen. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.
Frequently asked questions
What is the elfproef for a BSN?
Weight the first eight digits 9 to 2 and the last digit -1, sum them, and require a multiple of 11.
Why does the BSN detector need a keyword?
Nine plain digits pass the 11-test often enough to flag many order and reference numbers, so Maskflare waits for a word such as BSN before the number.
Is the Dutch BSN detector on by default?
It depends on the organisation's primary countries. It is part of the Netherlands pack, which the default Protect now template turns on with the action mask when Netherlands is a primary country.
Does a valid Dutch BSN prove the person exists?
No. A check digit shows the value is well formed. Many valid-looking numbers have never been issued, and Maskflare masks them all the same.
Rules on this page describe what Maskflare's detectors and validators check. They are read from the detection catalogue and are not the specification of the body that issues the identifier. Examples are synthetic.