How to redact a TFN before you put a document into AI
· Written and maintained by Nonimo
To redact a TFN before a document goes into an AI tool, take out every digit and leave a label in their place, so the sentence still reads and the number no longer exists in the text:
TFN: 000 000 000 → TFN: [TFN_1]Australian privacy law already allows for this. The OAIC’s page on your tax file number tells individuals that if a document they have been asked to supply includes their TFN, they are allowed to cross out or remove it before handing the document over, even when the person asking is allowed to collect TFNs.
The ATO goes one step further for AI tools in particular. Its page on misinformation and disinformation, updated on 1 June 2026, has a short section on using AI for tax and super information, and the instruction under Protect your information is plain: do not share your personal information with AI. The first examples it lists are your name and your tax file number.
So the question is not whether the TFN should come out. It is how to take it out properly, in every place it hides, without wrecking the document you wanted help with. That is what this guide covers, along with what the TFN Rule and the Tax Practitioners Board ask of an office that holds other people’s numbers. For the full list of what else comes out of a file, start with the personal identifiers to remove before AI.
How to redact a TFN: the number, the label and the line it sits on
A tax file number, in the ATO’s words, is your personal reference number in the tax and superannuation systems. It is unique, usually nine digits, and yours for life: you keep it if you change jobs or name, move interstate or go overseas. That last point is why a leaked TFN matters more than a leaked password. You can change a password tonight. A TFN stays.
Redacting it well takes three decisions. What goes in place of the digits, where else the number appears in the same file, and whether the text still makes sense once the number has gone.
Why a label beats a blank or a black box
Deleting the digits leaves a sentence that reads oddly and confuses the model. Typing XXX over them works for one number and fails for two, because the AI can no longer tell which employee was which. A label such as [TFN_1] does both jobs: the number is gone, and each number keeps a label of its own, so a question about two new starters still makes sense.
The black box is the trap. A rectangle drawn over a TFN in a PDF is usually a drawing sitting on top of the text, and the digits underneath come back the moment someone selects and copies the page. A chatbot that reads the file reads the text layer, not the picture. Our guide to redacting a PDF so the number is really gone tested exactly this on a tax letter.
Spaced, unspaced and hyphenated
The same TFN can sit in one file in three shapes: 000 000 000 on a letter, 000000000 in a payroll export, and 000-000-000 in an email someone typed out themselves. A search for one shape will not find the others, so a tool has to know all three. Here is each one, run through Nonimo on its own:
TFN 000 000 000 → TFN [TFN_1]
TFN 000000000 → TFN [TFN_1]
TFN: 000-000-000 → TFN: [TFN_1]In Word, a wildcard pattern can look for the spaced shape, and the Word guide sets out the patterns for the other identifiers that travel with it.
Before you search, check where the number is likely to be. A TFN rarely sits in the body of a letter. It sits in a header, a reference line, a table cell or a scanned attachment.
| Document | Where the TFN usually sits |
|---|---|
| Notice of assessment | the top of the first page, beside the name |
| ATO letter or statement of account | the reference block |
| Income statement or payment summary | the employee details |
| Super account statement | the member details |
| TFN declaration | its own boxed field |
| Payroll export | a column of its own, often unspaced |
Where the ATO says you can find your TFN, plus the declaration and the payroll file.
The documents in the first four rows come straight from the ATO’s own list of places to find your TFN. That list doubles as a list of documents people paste into chatbots at tax time, which is why the number turns up in prompts far more often than anyone intends.
What the ATO says about TFNs and AI tools
The ATO’s advice on AI is short, and worth reading in its own terms. Its page on misinformation says AI tools can generate inaccurate information and expose you to privacy and security risks, and it gives two instructions: check with a trusted source, and protect your information.
Do not share your personal information with AI.
Name, tax file number, bank details, phone number and address.
The same reasoning runs through the ATO’s page on what a TFN is. Someone only needs basic details, it says, such as your name, date of birth, address, myGov details or TFN, to commit identity fraud or scams. Only disclose your TFN to people and organisations that require it for legitimate reasons, such as the ATO, your employer, your bank, your super fund, a government agency paying a benefit, your university.
A chatbot is not on that list, and nothing about a tax question requires it to be. The useful part of a prompt is the rule, the rate or the deduction. The TFN adds nothing to the answer. The same goes for the Copilot built into the office suite, which works on the documents you open with it.
If a TFN has already gone into a chatbot
It happens, usually because a whole notice of assessment went in when one figure was needed. The ATO’s page on lost or stolen TFNs says that if an unauthorised third party has access to your TFN, you should tell the ATO as soon as possible, through its Client Identity Support Centre on 1800 467 033, between 8:00 am and 6:00 pm, Monday to Friday.
The centre can give advice and may apply security measures that monitor the account for unusual or suspicious activity. If the number belonged to a client or an employee rather than to you, that call is theirs to make, and your first job is to tell them. What a provider then keeps of the conversation is set out in how long OpenAI keeps what you paste.
The TFN Rule: what it asks of anyone who holds a TFN
The Privacy (Tax File Number) Rule 2015 is short, legally binding and in force since March 2015. The Privacy Commissioner made it under section 17 of the Privacy Act, and it regulates the collection, storage, use, disclosure, security and disposal of individuals’ TFN information. TFN information means a TFN linked to the person it belongs to, such as a record with a name, a date of birth and the number.
It binds every TFN recipient. Section 11(1) of the Privacy Act says that anyone in possession or control of a record containing tax file number information, lawfully or unlawfully, is a file number recipient. Section 11(2) adds that when an employee holds that record in the course of their job, the recipient is the employer.
Four rules that decide what happens before an AI prompt
Several of the Rule’s sections are written for the ATO, APRA and the agencies that pay benefits. Four speak directly to an office holding client or staff TFNs.
| Section of the Rule | What it asks | Before an AI prompt |
|---|---|---|
| 10, use or disclosure | only for a purpose under taxation, personal assistance or superannuation law | the prompt rarely needs the number |
| 11(1), security | reasonable steps against misuse, loss and unauthorised disclosure, and access limited to those who need it | the number stays on the practice computer |
| 11(2), disposal | securely destroy it, or cut its link to the person for good, once it is no longer required | old exports are deleted, not uploaded |
| 12, staff training | staff know the limits on use and disclosure | the habit is written down |
Privacy (Tax File Number) Rule 2015, sections 10 to 12.
The second row is the one that turns into a habit. Keeping the TFN on the computer it already lives on is a reasonable step that costs nothing in the quality of the answer, because the answer never depended on the number.
Every recipient, whatever its turnover
Section 18 of the Privacy Act says that a file number recipient shall not do an act or engage in a practice that breaches a rule issued under section 17. There is no turnover test in it. A business that sits outside most of the Act under the small business exemption is still bound for the TFNs it holds, and running payroll is enough to hold some.
A breach of the Rule is an interference with privacy under section 13(4), and section 26WE(1)(d) brings TFN information into the notifiable data breaches scheme. How that plays out for a firm that thought the Act did not reach it is set out in the TFN section of our Privacy Act guide.
The Rule already allows the number to come out
Section 9 of the Rule deals with TFNs provided incidentally: a document handed over for a purpose that has nothing to do with tax, personal assistance or super, which happens to carry a TFN. The person providing it may remove the TFN, the Rule says, and if they do not, the recipient must not use or disclose it.
Section 8WA(2) of the Taxation Administration Act 1953 makes the same assumption from the other side. Asking for a copy of a document that has someone’s TFN on it is not an offence, as long as the person is not prevented from removing the TFN. Both texts picture the same thing: a document travelling with the number taken out. Redacting before a prompt is that idea applied to a new kind of recipient.
The offence that sits beside the Rule
The Taxation Administration Act carries the criminal side. Section 8WB(1) says a person must not record another person’s TFN, use it in a way that connects it with their identity, or divulge or communicate it to a third person, unless an exception applies, such as acting on that person’s behalf in their affairs or complying with a taxation law.
Nobody needs to be frightened into redacting a number that the answer does not use. But it is worth knowing that the TFN carries a criminal offence of its own, which is one more reason the label is the simplest choice on the page.
Tax agents and BAS agents: the TPB on AI and client TFNs
On 22 July 2026 the Tax Practitioners Board issued TPB(GS) 55/2026, its guidance statement on the use of artificial intelligence and the Code of Professional Conduct. The confidentiality section is the part that matters here, and it starts from Code item 6: unless there is a legal duty to do so, a practitioner must not disclose information relating to a client’s affairs to a third party without the client’s permission.
For the Tax Agent Services Act, the guidance says, a third party is any entity other than the client and the tax practitioner. It then applies that to AI directly: practitioners must obtain permission from each client before divulging client information to a third party, which can include entering client information into AI models and tools, depending on how those tools are configured and used.
No disclosure of a client's affairs to a third party without the client's permission, unless there is a legal duty.
Entering client information can be a disclosure to a third party, depending on how the tool is configured and used.
On TFNs the statement is explicit: where the client information involves tax file numbers, additional obligations under the TFN Rule apply. The TPB accepts a signed letter of engagement as one way to give that permission, which is what the engagement letter’s AI clause is for, and the TFN belongs out of the prompt.
What the Board already said about email and the cloud
The TPB had covered the same ground for older tools. In the questions and answers from its webinar on protecting clients’ TFNs, issued on 13 May 2025 and last modified on 6 February 2026, it says it does not recommend sending or receiving TFNs by email, because email is not considered a secure method of transmission.
Asked about lodgement software that emails draft returns with the TFN, it suggests redacting the TFN or sending an encrypted or password protected attachment. Asked whether cloud storage counts as disclosure, it answers yes: a third party is any entity other than the client and the practitioner, and that includes a cloud storage provider. A chat history is held by a third party in the same way, and clearing your ChatGPT history runs on OpenAI’s timetable, not yours.
When the TFN never reaches the third party
Put those answers together and the simplest arrangement is obvious. If the TFN is replaced on the practice computer, before any text leaves it, the AI provider receives [TFN_1] and never the digits. The client permission conversation still happens, for everything else in the prompt, but the number with its own Rule and its own offence is no longer part of it.
That is how an accounting practice using AI on client files can keep the time savings and drop the one identifier that carries the most rules. The same applies to a bookkeeper running payroll and to a law firm handling an estate, and our page for law firms shows how it fits a legal practice.
What else to take out of a tax document before AI
The TFN is the identifier with the strictest rules, not the only one on the page. A notice of assessment or a payslip carries several others, and the OAIC’s guidance on commercially available AI products asks organisations to take steps to minimise the amount of personal information that goes into an AI system in the first place.
| On the document | Why it comes out too |
|---|---|
| Name and address | the identity the TFN was attached to |
| Date of birth | with a name or suburb it singles a person out |
| BSB and account number | where the refund goes, one account holder |
| A sole trader’s ABN | anyone can look up the owner in ABN Lookup |
| Medicare number | often a whole household on one card |
| Super fund member number | one member of one fund |
| Employer and job title | in a small town, as good as a name |
Our list for tax paperwork. The detail on each is in our guide to personal identifiers.
None of these changes the answer to a question about a deduction or a withholding rate. A question about withholding needs the rate, the income and the dates, and nothing in the table above. If the document carries a diagnosis, a union deduction or a criminal history check, those are sensitive information under the Privacy Act, with stricter rules again.
The detail that names nobody and still points to one person
The harder part is the text around the numbers. The OAIC’s guidance on de-identification names significant dates, profession and income as examples of details that can identify a person in combination. A salary, an occupation and a town of four thousand people will do it on their own, with no TFN in sight.
So after the numbers come out, read the text once more as someone who knows the client would read it. Round the income if the question allows it, swap the employer for an industry, and keep the year rather than the exact date.
In a rental application, where a notice of assessment sometimes travels as proof of income, the same reading applies, and the OAIC’s TFN page adds that nobody may use your TFN to confirm your identity when you rent a flat. Our page for real estate agents shows what an application carries.
Why redacting matters more than it looks: the breach numbers
The OAIC’s notifiable data breaches report for July to December 2024 counted 595 notifications. Of the notifications it attributed to human error, 170 in total, the single largest cause was personal information emailed to the wrong recipient.
The report also keeps a category of its own for failure to redact, defined as failing to effectively remove or de-identify personal information from a record before disclosing it. It is a small number next to the misaddressed emails, but it is there, counted, and it is the exact mistake a hurried prompt makes.
Legal, accounting and management services made up 36 of the 595 notifications, among the five sectors that reported the most. Accounting practices, which handle other people’s TFNs every day, sit in that group. Whether a prompt with a client’s TFN in it counts as a notifiable breach is its own question, worked through in our guide on client data and chatbots.
A payroll question, before and after
Here is the kind of message that goes to a chatbot at the end of a busy week. Every detail is invented: the depot is in Yarrabool, a town we made up, the TFN is all zeros, the placeholder our PDF guide also uses, the mobile is one ACMA lists for use in creative works, and the email uses a reserved domain.
BEFORE Can you check the PAYG withholding for two new starters at the Yarrabool depot?
Starter 1: TFN 000 000 000, full time from 3 March, no study loan.
Starter 2: TFN declaration to follow, casual, born 14/03/1979, mobile 0491 570 110.
Both declarations were emailed from payroll@example.com on Friday.
AFTER Can you check the PAYG withholding for two new starters at the Yarrabool depot?
Starter 1: TFN [TFN_1], full time from 3 March, no study loan.
Starter 2: TFN declaration to follow, casual, born [BIRTH_DATE_1], mobile [PHONE_1].
Both declarations were emailed from [EMAIL_1] on Friday.That is Nonimo’s output on 1 October 2026, exactly as it came. The TFN became [TFN_1], and the second starter, whose declaration has not arrived, stays recognisable as Starter 2, so the AI can still answer for each one separately. The date of birth, the mobile and the email went too, and the facts the question depends on stayed: full time or casual, the start date, the study loan.
What the answer looks like when it comes back
The chatbot answers in terms of Starter 1 and Starter 2, and wherever it repeats a label, the label is all it has. When the answer comes back into the Nonimo app, the real values are put back on your screen, so the reply reads as if it had been written about the actual employees. The model never saw the digits, and you never had to retype them. Our page for accountants shows the same routine on a rental schedule.
Redacting a TFN in Word, Excel, PowerPoint and PDF
Every format hides the number somewhere different, and each of our format guides has a section on it. The short version follows.
Headers, footers, comments, hidden text, speaker notes and hidden slides.
A TFN column on a hidden sheet, an unspaced export, digits under a drawn box.
Word and PowerPoint
In a Word file, check the header, the footer, the comments and any text formatted as hidden. The test file for our Word guide had a TFN formatted as hidden text, invisible on screen and printed by both converters we tried. Slide decks hide it in speaker notes and hidden slides, and the PowerPoint guide shows where to look. Then clear the file’s properties, which can carry the author’s name and more, as the metadata guide explains.
Excel and CSV
A payroll workbook usually gives TFNs a column of their own, sometimes on a hidden sheet. Unhide every sheet, row and column first, as the Excel guide sets out, then delete the TFN column from the copy you send. If the AI needs to tell rows apart, a column of labels does that job better than any digits. For a plain export, the CSV guide covers the same step.
PDF and scans
For a PDF, redact the text itself rather than drawing over it, or copy the text out and paste only what the question needs. A scanned notice of assessment is a picture, and a picture of a TFN is still a TFN: crop the image or leave it out of the upload altogether. A photo that does go in can stay longer than the chat, as our guide to what AI tools keep from your photos explains. On a Mac, the Nonimo app reads a fully scanned PDF on the computer and gives you its text with the TFN covered.
Pseudonymised, not anonymous, and why that is the useful version
When [TFN_1] stands where the number was and you keep the key that turns it back, the text is pseudonymised. It still relates to a real person, and the TFN Rule’s duties around that person still apply to you. Section 11(2) of the Rule asks recipients to securely destroy or “permanently de-identify” TFN information once it is no longer needed, which is a different, final step.
That is not a weakness of the label. It is the reason it works. A fully anonymous reply about “a starter” would be useless the moment you had to act on it for a named employee. The label keeps the link on your side and keeps the number off theirs. Our guide on de-identified versus pseudonymised data explains where the line between them sits, and why the Act names only the first.
Redacting TFNs every day: the app on your own computer
For one message, the box on our guide to personal identifiers does the job in seconds. For a practice that handles TFNs every working day, the Nonimo app for Mac and Windows does the same on the practice computer itself: select the text, press one key, and the TFN, the name and the date of birth become labels before the text goes anywhere.
Nonimo is software that replaces TFNs, Medicare numbers and names with labels before the text reaches ChatGPT, Claude or Copilot, and it shows each change on screen so you can see what was replaced. The map back to the real values stays encrypted on your computer, as our security page sets out. It works the same way with whichever assistant the practice already uses, including Claude and Gemini.
What it recognises in an Australian tax file
Beyond the TFN, it covers the identifiers that sit next to it on Australian paperwork: names, dates of birth, addresses, phone numbers and emails, the ABN, the BSB and account number, the Medicare number, the Centrelink CRN and card numbers. A nine digit TFN written with its label, whether TFN or tax file number, becomes [TFN_1] in a form field, mid sentence, spaced, unspaced or hyphenated.
The result is a prompt that keeps everything the question needs and nothing the TFN Rule protects. The same works on an NDIS provider’s case notes, as the NDIS page shows, and on a broker’s claim files, as the page for insurance brokers shows.
Sources
Each source below was checked on 1 October 2026. Pages on ato.gov.au, tpb.gov.au and acma.gov.au refuse automated requests, so their text was read from the Internet Archive’s copies of the same pages, dated below.
- OAIC, Your tax file number. That a person may cross out or remove their TFN from a document they have been asked to supply, even where the requester may collect TFNs; that a TFN cannot be used to confirm identity when renting a flat. oaic.gov.au
- ATO, Protect yourself from misinformation and disinformation (last updated 1 June 2026, QC 105074, archived 7 June 2026). The section on using AI for tax and super information: do not share your personal information with AI, with the name, tax file number, bank details, phone number and address listed. ato.gov.au
- ATO, What is a tax file number? (last updated 22 June 2026, QC 70350, archived 18 September 2026). The TFN as a personal reference number, usually nine digits and yours for life; where to find it; the basic details that enable identity fraud; who to disclose it to. ato.gov.au
- ATO, Lost or stolen TFN (last updated 22 June 2026, QC 22601, archived 18 September 2026). Where to find a TFN, including letters such as a statement of account; the Client Identity Support Centre on 1800 467 033, its hours, and the security measures it may apply. ato.gov.au
- Privacy (Tax File Number) Rule 2015 (F2015L00249, as made, not amended). Its making under section 17; that it is legally binding and a breach is an interference with privacy; sections 9, 10, 11 and 12. legislation.gov.au
- OAIC, The Privacy (Tax File Number) Rule 2015 and the protection of tax file number information. Who is a TFN recipient, and the limits on recording, collection, use and disclosure. oaic.gov.au
- Privacy Act 1988 (Compilation No. 104, 4 June 2026). Section 11 on file number recipients, section 13(4) on interference with privacy, section 18 on compliance with the Rule, section 26WE(1)(d) on eligible data breaches. legislation.gov.au
- Taxation Administration Act 1953 (Compilation No. 226, 27 August 2026). Section 8WA(2) on documents from which the TFN may be removed, and section 8WB on unauthorised recording, use or disclosure, with its penalty. legislation.gov.au
- Tax Practitioners Board, TPB(GS) 55/2026 The use of Artificial Intelligence and the Code of Professional Conduct (issued 22 July 2026, archived 5 September 2026). Code item 6, the definition of a third party, permission before entering client information into AI tools, and the TFN Rule’s additional obligations. tpb.gov.au
- Tax Practitioners Board, Protecting your clients’ TFNs (webinar questions and answers, issued 13 May 2025, last modified 6 February 2026, archived 14 April 2026). Email not considered secure for TFNs, redaction as a precaution, and cloud storage providers as third parties. tpb.gov.au
- OAIC, Guidance on privacy and the use of commercially available AI products. Taking steps to minimise the personal information put into an AI system. oaic.gov.au
- OAIC, De-identification and the Privacy Act. Significant dates, profession and income as examples of details that identify in combination. oaic.gov.au
- OAIC, Notifiable data breaches report, July to December 2024 (13 May 2025). The 595 notifications, the human error breakdown and its total of 170, the definition of failure to redact, and the 36 notifications from legal, accounting and management services. oaic.gov.au
- ACMA, Phone numbers for use in TV shows, films and creative works (archived 14 September 2026). The mobile 0491 570 110 in its list of numbers for creative works. acma.gov.au
- Our check. Every line in this guide that shows Nonimo’s output was run through its engine on 1 October 2026, block by block and line by line. The only TFN shown is 000 000 000, all zeros, the same placeholder used in our PDF guide; the email uses the reserved example.com domain.
Common questions
How do I redact a tax file number?
Replace every digit with a label such as [TFN_1], in every form the number takes: spaced, unspaced, hyphenated and inside tables. A black box drawn over a PDF is not enough, because the digits usually stay in the text underneath and come back with copy and paste.
Am I allowed to cross out my TFN on a document I have to hand over?
Yes. The OAIC says that if a document you have been asked to supply includes your TFN, you may cross out or remove the TFN before you hand it over, even when the person asking for the document is allowed to collect TFNs.
Should I give my tax file number to ChatGPT?
No. The ATO's advice on using AI for tax and super information says not to share your personal information with AI, and its list names the tax file number alongside your name, bank details, phone number and address. A question about tax rarely needs the number at all.
Does the TFN Rule apply to a small business?
It applies to every file number recipient, which section 11 of the Privacy Act defines as anyone in possession or control of a record containing tax file number information, lawfully or not. Section 18 binds them to the Rule without any turnover test, so running payroll is enough.
Can a tax agent put client information into an AI tool?
With the client's permission, says the TPB. Its guidance statement TPB(GS) 55/2026 treats entering client information into AI tools as a possible disclosure to a third party, depending on how the tool is set up, and notes that the TFN Rule adds its own obligations.
What do I do if a TFN has been lost or misused?
Tell the ATO as soon as possible. Its Client Identity Support Centre is on 1800 467 033, from 8:00 am to 6:00 pm Monday to Friday, and it can apply security measures that watch the account for unusual or suspicious activity.
Does replacing a TFN with a label make the text anonymous?
It makes it pseudonymised. The number is gone from the text, and you keep the key that turns [TFN_1] back into the digits on your own screen. That key is what lets the AI's answer come back usable, matched to the right client.
Which TFN formats does Nonimo cover?
In our check on 1 October 2026, a nine digit TFN labelled TFN or tax file number became [TFN_1] whether it was spaced, unspaced or hyphenated, in a form field or mid sentence. The date of birth, mobile and email around it were replaced in the same pass.