Synthetic PII for DLP testing
Synthetic personal and payment data for US/EU/APAC DLP checks: ready tables, document images, and a checksum-aware generator. Take an SSN, IBAN, passport, or card and see whether the system catches the leak channel — without exporting real registries.
Pick data below, then run it through a transfer-channel test. Most teams start with the web form test. Values are synthetic and for testing only; any resemblance to real people is coincidence.
CSVXLSXPDF
OpenSample documentsPassport, license, medical docs, invoices, and cards on photo — when your DLP has OCR.
JPGPNG
OpenGeneratorYour own columns and row count: SSN, IBAN, cards, bank, and more — with valid checksums.Open
FAQ
How is the library different from the generator?
Why do I need sample documents, like a passport scan?
Stronger DLP products read text in images via OCR. To validate those rules you need to send scanned documents as image files.
Is this real personal data?
No. Field values are generated for testing. Do not use them in applications or production databases.
How do I send data into a leak-channel test?
Download or generate a file, then open the test you need. Most teams start with the web traffic filter check; next, by scenario — FTP, cloud upload, email intercept, or clipboard.
Will this work with any DLP?
Yes. Packs target international formats (SSN, IBAN, Visa/MC, and others), not a single vendor. Your product still needs to cover the channel and data types you are testing.
Do I need clean samples without sensitive data?
Yes. After a hit, send a file or string the policy should ignore to check for false positives. Ordinary text without PII is fine to type yourself.
Can I cite these datasets in a pilot report?
Yes. Name the downloaded file, link to dlpbench.com, and attach a DLP console log or screenshot.
What data should I use for DLP testing?
Use synthetic values that pass the same format checks as production rules: SSN check digits, Luhn for cards, IBAN MOD-97, TFN/NRIC/Aadhaar. Random digit strings are often discarded by engines — which can falsely suggest the channel is uncontrolled.
For a pilot, a typical set is: name + SSN + passport; name + phone + email; Visa/Mastercard with a valid check digit; ABA/IBAN; plus dictionary or fingerprint samples when your policies need them.
Sources: this page, the file library, sample documents (including OCR), the generator, and format templates in the regex library.
Do not paste live exports from Excel, ERP, CRM, or HR systems. That is real personal data — and if the channel is open, you leak a registry, not a test. How the bench accepts and stores content is in the security policy.
How do I test exact data match and document fingerprints?
EDM: index a small synthetic table from the generator — never a production registry. Send a document with fields from that table. Hits should track your threshold (field/row count). Also check near-miss: some fields present, threshold not met — no rule fire.
Fingerprints / IDM: index a reference you control; send a full copy, a fragment, and a reformatted variant. Match thresholds should behave predictably.
Verify index refresh: a stale index creates false confidence. Sample documents on this site work as controlled references when those are the files you fingerprinted.
Move on to leak-channel tests
Take a ready pack or generate your own, then run it through an online test to see whether the policy fires.