How to remove a BSN from text before using AI

A BSN (Burgerservicenummer) is the Dutch citizen service number, and it is one of the most sensitive identifiers a document can contain. If a file with a BSN ends up in an AI prompt, you have handed a national identifier to a third party. Here is why that matters and how to remove a BSN reliably before the text reaches an AI.

Why a BSN is so sensitive

A BSN links directly to a person's dealings with government, tax and healthcare. Dutch law restricts who may use it and for what, and it is a prime target for identity fraud. Under the GDPR it is a national identification number, a category with extra protection. In short, a BSN should almost never appear in text you send to an external service.

How a BSN is structured

A BSN is nine digits, validated with the eleven-test (elfproef): each digit is multiplied by a weight and the weighted sum must be divisible by eleven. So not every nine-digit number is a valid BSN, which is useful for detection: a good tool can tell a real BSN from a random nine-digit order number. It also means you should not rely on "nine digits" alone, because you will either miss real ones or mask harmless numbers.

Why manual removal fails

Find-and-replace and highlighter passes miss BSNs constantly, because they appear in many shapes:

• With or without spaces and dots
• Next to labels like "BSN", "burgerservicenummer" or "sofinummer"
• Buried inside a longer line with an address and a date

Miss one and the whole document is compromised. This is exactly the kind of pattern a purpose-built detector handles far better than a human skimming under time pressure.

How to remove a BSN before AI, step by step

1. Run the text through a local anonymiser that recognises Dutch identifiers.
2. Confirm each detected BSN (a good tool validates the eleven-test, so it will not flag every nine-digit string).
3. Replace it with a placeholder such as [BSN#1].
4. Send the placeholdered text to the AI, then restore the real value in the reply if you need it back.

Because it runs locally, the BSN is removed before anything is transmitted. Redacto detects the BSN along with names, addresses, IBANs, postcodes, kentekens and rijbewijs numbers, so the rest of the record is covered in the same pass. For the wider workflow, see anonymising personal data before you use AI.

In short

A BSN is national-identifier level sensitive, so it should never reach an AI you do not control. Detect it locally with a tool that understands the eleven-test, replace it with a placeholder, and your documents stay safe while you still get the AI's help.