PII Scanner and PII Data Discovery Software for Data Subject Requests
Most PII scanners answer a security question: where do we keep Social Security numbers and card data? A privacy request asks a narrower one: where is everything we hold about this one person? Obtainer is the PII scanner for that second question, searching your systems for a named individual and compiling what it finds into one manifest you review before anything is sent.
found
scanned
Assembling the cover letter from the template...
Helps you comply, not legal advice
In short
A PII scanner is software that searches your systems for personally identifiable information and reports where it sits. There are two kinds. Security scanners, such as Spirion, Ground Labs Enterprise Recon, Netwrix Data Discovery and Classification, Varonis and BigID, crawl file shares, databases and cloud storage for patterns like Social Security, card and passport numbers so you can lock down or delete risky data. They are priced as security platforms, and reported contracts for Varonis and BigID run to a median of roughly $88,000 and $102,000 a year.
Obtainer is the other kind. It is a PII scanner for data subject requests: you give it one verified person, it searches the systems you connect (CRM, help desk, billing, marketing and your own databases) for that person's records, and it returns a single manifest with each item tagged by source. That is the search an access, deletion or correction request under the CCPA, GDPR or a state privacy law actually needs, and it starts at $34 a month billed yearly.
If your problem is unknown sensitive data in a decade of file shares, buy a security scanner. If your problem is a request with a 45-day clock, buy a request tool. Nothing is disclosed or deleted automatically, a person on your team reviews and approves every item, and Obtainer helps you comply rather than giving legal advice.
What you get
PII scanner, built for privacy, legal, and ops teams
Searches by identity, not by pattern
A pattern scanner finds every nine-digit number that looks like an SSN. A request needs the records tied to one email, phone, customer ID or account. Obtainer searches by the identifiers you verified, so the result is about the requester and nobody else.
Reaches the SaaS tools requests actually touch
Most consumer requests land in a CRM, a help desk, a billing system and an email platform, not in a file share. Obtainer is built around those business systems and your own databases, which is where a US company's customer data lives.
Output is a draft reply, not a risk report
Located records roll into one manifest with source badges, then into a drafted response and cover letter. A security scanner hands you findings to remediate; you still have to build the disclosure package yourself.
Priced per request volume, not per employee or terabyte
Security platforms charge by users, terabytes or connectors. Obtainer plans are metered on requests per month, from 10 on Starter to 1,000 on Enterprise, so a 40-person company with a handful of requests is not buying an enterprise data security estate.
How it works
From an intake request to a ready-to-review response in four steps
Verify the requester
Confirm who is asking and collect the identifiers you will search on, such as email, phone and customer ID. Scanning before verification risks gathering data for the wrong person.
Run the person-level scan
Obtainer searches each connected system for those identifiers and lists every location where the person's data appears, tagged with its source.
Review and redact
Your team reviews the manifest, removes third-party data and anything exempt, and decides what is in scope. Nothing leaves without approval.
Send and log the response
Approve the drafted reply, deliver it inside the deadline, and keep the event log as your evidence of how the request was handled.
Reference
PII scanning tools compared by the job they are built for
The PII scanner category mixes security tools and privacy tools under one label. The useful split is what question each one answers. Cost signals are vendor pages and reported buyer data as of October 2026; none of the security vendors publishes a price list.
| Type of tool | Examples | What it finds | Reported cost signal | Answers a DSAR on its own? |
|---|---|---|---|---|
| Pattern-based PII scanner | Spirion, Ground Labs Enterprise Recon, Netwrix Data Discovery and Classification | Files, columns and mailboxes that contain SSNs, card numbers, passport numbers and similar patterns | Mostly quote-based, sized to the estate you scan | No. It finds sensitive data in general, not one person's records, and has no reply workflow |
| Data security platform (DSPM) | Varonis, BigID, Microsoft Purview | Sensitive data plus who can access it, across file shares, Microsoft 365, cloud stores and some SaaS | Varonis median about $88,044 a year (5 purchases); BigID about $101,950 (4 purchases) | Partly. Varonis and BigID offer person search or rights apps, but connectors and licensing are sold for security scope |
| Privacy management suite | OneTrust, DataGrail, TrustArc | Data maps and request workflows across connected systems | OneTrust median about $11,970 (153 buyers); DataGrail about $50,000 (73 purchases) | Yes, inside a platform contract with a reported minimum |
| Request-centered PII scanner | Obtainer | Every record tied to one verified person across your CRM, help desk, billing, marketing and databases | $408 a year on Starter, published | Yes. Search, manifest, redaction review, drafted reply and deadline tracking |
Frequently asked
Questions teams ask about PII scanners and PII data discovery
What is a PII scanner?
A PII scanner is software that searches files, databases and applications for personally identifiable information, such as names, emails, Social Security numbers and card numbers, and reports where it is stored. Security teams use them to find and protect sensitive data. Privacy teams use a request-centered scanner like Obtainer to find everything held about one person when that person files an access or deletion request.
What are the best PII scanning tools?
It depends on the job. For finding sensitive data across file shares and endpoints, Spirion, Ground Labs Enterprise Recon and Netwrix are established pattern scanners. For data security across Microsoft 365 and cloud stores, Varonis, BigID and Microsoft Purview lead. For answering privacy requests, you want a tool that searches by person and drafts the reply, which is what subject access request software such as Obtainer does.
What is PII data discovery?
PII data discovery is the process of locating personally identifiable information across an organization's systems. It can mean building an inventory of every place PII appears, which supports security and records of processing, or finding one named individual's data to answer their request. Obtainer does the second kind, as part of its personal data discovery workflow.
Can a PII scanner find all of one person's data for a DSAR?
Only if it searches by identity. A pattern scanner finds data that looks like PII, so it will flag thousands of records that have nothing to do with your requester. To answer a DSAR you need to search each system for the requester's verified identifiers and collect the matches, then review them. That person-level search is what Obtainer runs across the systems you connect.
How much does PII scanning software cost?
Security-grade PII scanners rarely publish prices. Reported buyer data puts Varonis at a median of about $88,044 a year across 5 purchases and BigID near $101,950 across 4, so treat both as small samples. Request-centered tools publish theirs: Obtainer starts at $408 a year for 10 requests a month. See the full plan list and our breakdown of Varonis pricing.
Do I need a PII scanner to comply with the CCPA?
The CCPA does not require a specific tool. It requires you to respond to verified requests to know, delete and correct within 45 days, which means finding the consumer's personal information wherever you hold it. Small companies can do that by hand for a few requests. Once requests arrive weekly or touch more than a handful of systems, a scanner that searches by person saves days. Read more on handling CCPA requests.
Is Microsoft Purview a PII scanner?
Yes, for Microsoft content. Purview classifies sensitive information types across Exchange, SharePoint, OneDrive and Teams, and since Priva Subject Rights Requests was retired in May 2026, request searches run through Purview eDiscovery Premium. It does not search a CRM, billing system or help desk outside Microsoft 365, which is the gap covered on our Microsoft Priva alternative page.
Run a data subject access request end to end
Obtainer finds where a person's data lives across your systems, compiles it into one manifest, drafts the deadline-safe response, and tracks the GDPR and CCPA clock. You review, redact, and approve what gets disclosed. Helps you comply; not legal advice.