TL;DR
Built a Danish NER model to detect and mask PII in unstructured text. Combined rules + BERT, annotated 9K+ samples, and enabled automated data extraction for RPA workflows. The system handles messy real-world text and achieved f1 greater than 85%.
A large volume of sensitive personal data was buried within unstructured text from emails, customer inquiries, and applications. This posed compliance risks and made it difficult to automate workflows, as manual redaction and information extraction were both time-consuming and error-prone.
I was responsible for developing a system to automatically detect, mask, and extract sensitive information (PII) from messy Danish text—enabling both data privacy compliance and downstream automation. This was built in 2020, well before the GPT wave transformed NLP, when custom models were the primary approach for specialized language tasks. The solution needed to handle real-world formatting inconsistencies and be accurate enough to integrate with RPA processes.
I built a hybrid system combining rule-based detection with a fine-tuned Danish BERT model for named entity recognition. To train the model, I manually annotated 9,000+ text samples from various sources, and used data augmentation techniques to expand the training set and improve generalization. The system detects 14 different PII categories including key ones like names, addresses, phone numbers, SSNs, email addresses, and monetary amounts, and provides three operational modes: visual highlighting for review, secure masking for compliance, and structured extraction for automation workflows.
The final model achieved an f1-score above 85%, delivering both high recall and precision. It successfully handles messy, real-world Danish text and provides flexible output formats—turning unstructured data from a compliance burden into a source of automated insights for business processes. While today’s LLMs offer impressive out-of-the-box capabilities, this approach remains highly relevant for PII-sensitive data that organizations cannot send to external cloud providers due to privacy and compliance requirements.