Log Every PII-Pattern Match for a DSAR Register
Different purpose from a general compliance audit log: this register exists specifically so that if a data subject later files an access/deletion request, there's a searchable record of every tool call that touched PII-shaped data, independent of the broader change-control trail.
1. Save this as the hook script
#!/usr/bin/env python3
"""PostToolUse hook — logs PII-pattern matches to a dedicated DSAR
register. Wire with matcher "*"."""
import json, re, sys, datetime
from pathlib import Path
data = json.load(sys.stdin)
blob = json.dumps(data.get("tool_input", {}))
if not re.search(r"\b\d{3}-\d{2}-\d{4}\b", blob):
sys.exit(0)
log_path = Path(data.get("cwd", ".")) / ".claude" / "dsar_register.jsonl"
log_path.parent.mkdir(parents=True, exist_ok=True)
entry = {"ts": datetime.datetime.utcnow().isoformat() + "Z",
"tool_name": data.get("tool_name"), "session_id": data.get("session_id")}
with open(log_path, "a") as f:
f.write(json.dumps(entry) + "\n")
sys.exit(0)
Save to a path inside your project, e.g. .claude/hooks/log-pii-matches-dsar-register.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"PostToolUse": [
{
"matcher": "*",
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/log-pii-matches-dsar-register.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks