Sample DLP Test Data

How to Use This Data

Click "Copy Table Data" on any table above to copy all records to your clipboard. Then:

1. Go to the DLP Test Tool
2. Paste the copied data into the Text Payload area
3. Select your desired Protocol, Body Format, and MIME Type
4. Click "Post Text" and observe whether your DLP system blocks or allows the data

You can also create documents (Word, Excel, PDF, CSV) containing this data and use the File Upload feature to test file-based DLP inspection.

About This Test Data

The data on this page is entirely synthetic and does not represent real individuals. The Social Security Numbers use formats that are valid for pattern matching but are not assigned to real people. The credit card numbers are industry-standard test numbers that pass Luhn validation but cannot be used for actual transactions.

Different DLP systems have different detection thresholds. Some require a minimum number of records (e.g., 3 or more SSNs) before triggering a policy. If your DLP doesn't block the data, try adjusting your policy thresholds or testing with more records.

Understanding Each Data Category

PCI Data (Payment Card Industry)

PCI test data contains credit card numbers from multiple card brands — Visa, Mastercard, American Express, and Discover. Each card brand uses specific numeric prefixes (called BIN ranges) and fixed lengths. DLP systems identify card numbers using a combination of prefix matching, length validation, and the Luhn checksum algorithm.

Our PCI sample data includes card numbers that pass Luhn validation, making them indistinguishable from real card numbers to pattern-matching engines. This ensures your DLP policies are tested against data that closely mirrors what a real data breach would contain. The accompanying expiration dates, CVV codes, and cardholder names test whether your DLP detects these supporting elements alongside the primary account number.

GLBA Data (Gramm-Leach-Bliley Act)

GLBA sample data includes financial identifiers that banks, insurance companies, and other financial institutions are required to protect. This includes bank account numbers, ABA routing numbers, and financial account combinations. DLP policies for GLBA compliance must detect these identifiers when they appear in outbound communications or file transfers.

Routing numbers in our test data follow the real ABA format (nine digits with valid check digit) but are assigned to test ranges. When combined with account numbers, these records simulate the type of data that financial institutions process daily and must protect from unauthorized disclosure.

HIPAA Data (Health Insurance Portability and Accountability Act)

HIPAA test data combines personally identifiable information with health-related data elements to create Protected Health Information (PHI). Individual names or dates alone are not PHI — they become PHI when combined with medical information such as diagnoses, treatment records, or health insurance identifiers.

Our HIPAA sample records include realistic combinations of patient names, Social Security Numbers, dates of birth, and medical record numbers. This tests whether your DLP system recognizes the combination of identifiers as PHI rather than treating each element independently.

International Identifiers

The comprehensive "All Data Types" tab includes 49 different identifier types from countries worldwide. This is critical for organizations with global operations that need DLP policies covering multiple jurisdictions. Identifiers include India's Aadhaar number, the UK's National Insurance Number (NINO), Poland's PESEL, Brazil's CPF, Mexico's CLABE, and many more. Each follows its country-specific format and validation rules.

Tips for Effective DLP Testing

• Test across protocols: Send the same data via HTTP and HTTPS to verify SSL inspection is working correctly.
• Vary MIME types: DLP systems should detect sensitive data regardless of Content-Type headers. Test with text/plain, application/json, and multipart/form-data.
• Test file uploads: Download our sample files (DOCX, XLSX, CSV, PDF) and upload them through the DLP test tool to validate file-based inspection.
• Check thresholds: If a single record passes through, try multiple records. Many DLP policies have minimum count thresholds before triggering.
• Document results: Keep a record of which tests passed and failed for compliance audit evidence.

For a complete testing methodology, see our How to Test DLP Policies guide.