Remove personal identifiers before sending to AI

Personal identifiers are the details in a document that point to one person, and before a file goes to ChatGPT, Copilot or Claude, most of them should come out.

In an Australian office that means the name in every form it takes, the signature, the address and contact details, the date of birth, and the numbers that government and business hand out: a TFN, a Medicare card number, a Centrelink CRN, an IHI, the driver licence and passport numbers, the BSB and account, the card, and your own matter or claim reference.

That is the easy half. The harder half is the detail that names nobody and still leaves one candidate: a job title, an employer, a small town, a date. Those need a person’s judgement, and this page gives both halves a table and a checklist.

The reason to care is written into the OAIC’s guidance on commercially available AI products: once personal information goes into an AI system, APP 6 applies, and the information can then go only to uses that match the reason it was first collected, unless an exception fits. How long each provider keeps what you send is set out in our comparison of ChatGPT, Claude, Gemini and Copilot against the APPs.

Personal identifiers in Australia, sorted into five groups

A list of fifty items is hard to use at a desk. Grouping helps, because each group hides in a different part of a document and fails in a different way.

Group	What it covers	Where it hides in a document
People and contact	names, signatures, addresses, phones, emails, dates of birth	letterhead, salutation, signature block, footer
Government numbers	TFN, Medicare, CRN, IHI, licence, passport, NDIS number	forms, attachments, scanned cards
Money	BSB and account, card, a sole trader’s ABN, super member number	remittances, invoices, payslips
File and case numbers	matter, policy, claim, medical record, employee and customer numbers	reference line, subject line, headers
Quasi-identifiers	job title, employer, suburb or town, exact dates, rare events	the narrative itself

The first four groups have shapes. A Medicare number always looks like a Medicare number, and a person or a program can find it by its pattern. The fifth group follows no pattern, and that is how a file emptied of every number still ends up pointing at a single client.

A one page letter can hold all five groups, yet most people check only the body text before an upload. For a scanned letter or a PDF, the way to remove what you find is set out in how to redact a PDF; for a Word file, how to redact in Word walks through the places a name survives.

Personal information examples the OAIC gives, and where they sit in a file

The definition is in the Privacy Act 1988, at section 6(1): personal information is “information or an opinion about an identified individual, or an individual who is reasonably identifiable”. It does not matter whether the information is true, and it does not matter whether it is recorded. A wrong date of birth in a draft is still personal information about the person it is attached to.

The OAIC’s guide What is personal information?, published on 5 May 2017, gives a list of common examples: a person’s name, signature, home address, email address, telephone number, date of birth, medical records, bank account details and employment details. Every item on that list has an obvious home in an ordinary office file, which is why the list works as a first pass over any document.

The OAIC's examples

Name, signature, home address, email, phone, date of birth, medical records, bank details, employment details.

Where they turn up

A letter's address block, a signed form, a payslip, a referral, a staff file, a remittance advice.

Opinions and AI output count too

Two parts of the definition catch people out. An opinion about someone is personal information, so a manager’s note that a staff member “seems distracted since the separation” is about that staff member even if it is unfair. A reviewer’s remark left in the margin of a Word draft is the same kind of opinion, which is why clearing tracked changes and comments for good belongs before any upload.

The second catches people who use AI tools. The OAIC’s AI guidance says personal information “includes inferred, incorrect or artificially generated information produced by AI models (such as hallucinations and deepfakes), where it is about an identified or reasonably identifiable individual”. A chatbot’s summary of a client file is not neutral exhaust: it can be a fresh record about the same client.

Business details that are really about a person

Information that is only about a company is generally not personal information. The OAIC’s guide makes an exception, though, where details about a business are so bound up with an individual that they become information about that person. For a sole trader, a family trust or a two person partnership, that is the normal case, not the edge case.

The ABN question is covered in the Word guide above; the practical rule is to treat the business name as a name when it contains one.

Some of what the list catches is also sensitive information, such as health details, union membership or criminal records, and that carries stricter rules on consent and use. Those categories are mapped in the page on health, union and criminal record details in office files, and this page does not repeat them.

Government numbers: TFN, Medicare, CRN, IHI, licence and passport

Government issued numbers are the most recognisable personal identifiers in an Australian document, and they carry the most specific rules. Most of them fall under APP 9, which restricts how a private organisation adopts, uses or discloses a government related identifier. Paragraph 9.8 of the OAIC’s APP guidelines gives four examples: Medicare numbers, Centrelink Reference numbers, driver licence numbers issued by state and territory authorities, and Australian passport numbers.

Number	Issued by	How it looks on paper	Rule on top of the APPs
Tax file number	ATO	nine digits, usually spaced in threes	Privacy (Tax File Number) Rule 2015
Medicare number	Services Australia	ten digits, plus a reference number from 1 to 9 beside each name	APP 9
Centrelink CRN	Services Australia	nine numbers ending in a letter	APP 9
Individual healthcare identifier	Healthcare Identifiers Service	16 digits	Healthcare Identifiers Act 2010
Driver licence	state and territory authorities	a licence number and a separate card number	APP 9
Passport number	Australian Passport Office	letters and digits on the photo page	APP 9

The shapes come from the issuers’ own descriptions: Services Australia for the CRN and the Medicare card, the OAIC for the IHI. None of the numbers above should go to a public AI tool, and none of them is ever needed for the kind of question people ask one: a summary, a tone check, a rewrite.

The TFN has a rule of its own

The tax file number sits outside APP 9’s day to day scheme, because paragraph 9.9 of the APP guidelines points to other laws that restrict particular identifiers, and the TFN is the clearest example. The Privacy (Tax File Number) Rule 2015 binds anyone who holds TFN information, and the OAIC’s guidance on the Rule spells out when a TFN may be used or disclosed.

For a practice that exempts itself from most of the Privacy Act on turnover, this is the rule that still applies, as our Privacy Act guide explains in its section on the TFN.

Look for TFNs in places other than the tax return: a TFN declaration on a new starter’s file, a super choice form, an ATO letter scanned into a client folder, a payroll export. A TFN also turns up unspaced, as nine digits in a row, which a search for the spaced form will miss. Payroll exports usually give TFNs a column of their own, and a CSV headed for a chatbot rarely needs that column.

Medicare numbers and healthcare identifiers

A Medicare card shows a ten digit number, and each person on the card has an individual reference number from 1 to 9 beside their name. Services Australia’s operational guidance explains that the card number and the reference number together identify each customer, and that one card can list up to nine people. A Medicare number in a document is therefore often about a whole household.

10digits in the Medicare card number

1 to 9the reference number beside each name

9people at most on one card

The individual healthcare identifier is a 16 digit number the My Health Record system uses. The OAIC says the Healthcare Identifiers Act 2010 requires a provider’s security and procedures to protect it against misuse and unauthorised disclosure. Both numbers appear in referrals, discharge summaries and NDIS paperwork, and the Ahpra guide to patient data and AI covers what a clinic should keep back.

A licence now carries two numbers

A driver licence has a licence number that stays with the driver and a card number that belongs to the physical card. According to Equifax’s submission to a Senate committee, the national Document Verification Service began requiring the card number in 2022, going live on 1 September in NSW, the ACT, SA, Tasmania, the NT and WA, and later in Queensland and Victoria. A copy of a licence therefore has two numbers to remove, not one.

Licences and passports usually arrive as scans or photographs attached to an application, card number showing on a NSW licence. Delete the image from the copy you send; blurring the number in a picture is a different job from removing text.

Migration and employment files add numbers of their own. A visa grant number, an ImmiAccount reference or a VEVO check printed for a new starter identifies the holder as surely as a passport number does, and it usually sits in the same attachment. Treat any number a government agency gave a person as belonging on this list, whether or not it appears in the table.

Contact details, signatures and the letterhead

Names are the obvious identifier and the one most often left behind, because a document writes the same person several ways. The client in the address block reappears in the salutation, as a first name in the body, as initials in a reference, and as the account name in a payment table. Search for each form separately, including the surname alone.

The people around the client count as well. A letter about one person usually names others: a spouse, an employer, a treating doctor, a case worker, your own staff. Each is an individual with their own claim to privacy, and the same test applies to them. A tenancy application is the densest example most offices handle, and our page for real estate agents shows what one carries.

Addresses need the same care in all their forms: the residential address, a postal address or PO box, a delivery note (“leave at the side gate of the corner house”), a property address in a lease or a contract of sale. In a regional town the street name alone may be enough.

Phone numbers and emails follow the pattern of names: they sit in the signature block, the letterhead, a forwarded email chain at the bottom of the file, and a column in any attached spreadsheet. In a workbook that column may be hidden, or sit on a sheet Excel does not show, so unhiding every column, row and sheet comes before any deletion.

Signatures deserve their own mention because they are usually pictures, as on a NSW driver licence. A scanned signature, or a signed form saved as an image inside a PDF, is not text, and a find and replace will never reach it. Dates of birth are the last of this group: on their own they are common, but paired with a name or a suburb they single a person out quickly.

A file also says things about its authors that the page does not show, such as the name of whoever created it and who saved it last. That is a separate subject, and it deserves its own pass through the file’s properties before an upload.

Money: BSB, account number, card and a sole trader’s ABN

Financial details matter twice: they identify the person, and they are what a fraudster wants. An Australian document usually carries them in a small number of predictable places.

Detail	Where you will find it	Why it points to a person
BSB and account number	refund forms, remittances, payroll files, direct debit requests	together they name one account holder
Card number	receipts, booking confirmations, payment disputes	one card, one cardholder
A sole trader’s ABN	invoices, contracts, supplier lists	the business is the person
Super fund member number	payslips, rollover forms, new starter packs	one member, one fund
Invoice and customer numbers	statements, overdue notices	a key into your own records

The BSB is the least personal of these: it identifies a bank and branch. Its first digits are allocated by Australian Payments Network, whose public directory lists every BSB in use. Next to an account number, though, it becomes one person’s account, and the account number is the part a person can be traced by. Take out both.

Payslips deserve a slower read than their size suggests. A single page can hold the employee’s name, the employer’s ABN, the pay rate and hours, the super fund and contributions, leave balances, deductions, and often the account the pay went into. If the question is about an award rate, the figure and the classification are enough; everything above the line can go.

There is rarely a good reason for a full card number to sit in a letter or a file note at all. If one is there, remove it, and ask how it got there.

A sole trader’s ABN sits in a slightly odd place. It is not a government related identifier under APP 9, which excludes an individual’s ABN from its definition, but it can still be personal information, and anyone can type it into ABN Lookup and read the owner’s name. Our page for accountants looks at how client ABNs and TFNs travel through a tax practice’s paperwork.

File numbers: matter, policy, claim and medical record

Your own reference numbers are the identifiers people most often leave in, because they do not look personal. A matter number, a policy number, a claim number or a medical record number means nothing to the company that runs the chatbot. To anyone inside your practice, the insurer or the hospital, it is a direct key to a named person’s file.

To the AI provider

A string of letters and digits with no meaning attached.

To anyone with your systems

A lookup that opens the client's full file in seconds.

The test is who could reasonably read the output and match it. The AI answer may be pasted back into an email, saved to the client file, or shown to a colleague, and each of those readers has access to the system the reference belongs to. Replace the reference with a neutral label and keep your own key, so the answer can be matched back later.

The same goes for employee numbers, customer numbers, patient IDs, NDIS participant numbers, vehicle registration numbers and Medicare provider numbers on a referral, which identify the doctor. Our page for insurance brokers sets out how policy and claim references sit in a broker’s files.

A vehicle registration plate belongs here too. In a motor claim, a fleet report or a parking dispute, the plate is often the only identifier left once the driver’s name is gone, and a state registration check links it to a person. Replace it along with the claim number.

Quasi-identifiers: job title, employer, suburb and date

Take every name and number out of a document, and it can still describe one person. The OAIC’s guide De-identification and the Privacy Act, published on 21 March 2018, calls these details quasi-identifiers. Among its techniques it lists “removing quasi-identifiers (for example, significant dates, profession, income) that are unique to an individual, or which in combination with other information are reasonably likely to identify an individual”.

That guide was written for datasets, and a document is harder, because the quasi-identifiers are sentences, not columns. A job title in one paragraph, an employer in the next and a date in a heading combine on the page just as they would in a table.

A job, an employer, a town and a date

Here is an invented example, set in a town we made up for this page, Yarrabool, in regional Victoria. A payroll query to an AI tool reads: the head brewer at the Yarrabool brewery returned from parental leave on 3 February and wants to change her hours. There is no name, no TFN and no address in it.

Anyone in that town knows who it is, and so does anyone who has ever bought a beer there. The fix is not software. It is rewriting the question so that it keeps what the answer needs and drops what it does not: “a salaried employee returning from parental leave wants to change her hours” gets the same answer about the award and the Fair Work rules.

Rare events work the same way. A workplace injury that made the local paper, a flood claim from the one street that went under, a complaint about a named school: the event itself points to the person, however carefully the names were removed. If the question does not depend on the event, describe it in general terms.

The four details worth checking in every document are the ones in that example. A job title, especially a senior or unusual one. An employer or a site. A place smaller than a capital city. An exact date that attaches to an event in the person’s life. For progress notes, where the small town problem is sharpest, the NDIS guide applies this reading step by step.

Seven cards in 15.1 million

Australia already has a worked example, and it came from a regulator. In 2018 Public Transport Victoria released 1.8 billion records of touch on and touch off events from 15.1 million myki cards for the Melbourne Datathon. The card numbers had been replaced with derived identifiers, and there were no names.

7

University of Melbourne researchers re-identified their own trips, and then a fellow passenger from a single shared journey, using what they knew about that person’s home and work. The released data also recorded each card’s type, and some types were tiny: the federal parliamentarian type had only seven registered cards.

The Office of the Victorian Information Commissioner’s investigation report of 15 August 2019 found that the dataset was personal information and that PTV had breached IPP 2.1 and IPP 4.1 of Victoria’s Privacy and Data Protection Act 2014.

A card type is a job title by another name. A document that says “one of our clients, a federal MP” has done what the myki release did, with no card number in sight. Whether a document with the names swapped out counts as de-identified or merely pseudonymised is another matter, and the guide that sets the two Privacy Act words side by side deals with it.

Before the upload: a checklist for the document

The list above becomes a routine if it is run in the same order every time. Work on a copy, and do the mechanical steps before the judgement ones, so that you read a cleaner text when it counts. On a slide deck, that means going through the notes, hidden slides and comments behind each slide as well as the slides themselves.

The numbered steps follow that order. Steps 4 to 9 are the kind a colleague can check against the list; step 10 is the one only the person who knows the file can do.

Before you open the file

1. Ask what the AI tool actually needs. A question about tone, structure or the law rarely needs anyone’s details.
2. Make a copy and work only on the copy. Keep the original in the client file.
3. Check the attachments and embedded pictures: scanned cards, signatures and screenshots are images, and a text search will not see them. A photo uploaded on its own is no safer, because ChatGPT can keep a photo after the chat is deleted.

On the page

4. Names in every form: full name, surname alone, first name, initials, business names built on a surname, and the other people in the file.
5. Government numbers: TFN, Medicare with its reference number, CRN, IHI, licence and card number, passport, NDIS number, spaced and unspaced.
6. Contact details: street, postal and property addresses, phones, emails, and the signature block.
7. Money: BSB with account, card numbers, super member numbers, a sole trader’s ABN.
8. Your own references: matter, policy, claim, medical record, employee and customer numbers.
9. Dates of birth, and any exact date the question does not need.

The last read

10. Read what is left through the eyes of whoever would spot the client fastest: a neighbour, a colleague, a relative. Remove or generalise job titles, employers, small places and dates until nobody is left in focus.
11. Record what you sent, where, from which account, and when. If the wrong version goes, that note is what the person who handles privacy will need first.

Each step can go wrong in a PDF or a Word file for reasons unrelated to the list, which is what the two redaction guides are for. For the categories that should not go into a public chatbot in any form, the list is in the section on what should never go in.

Nonimo on an invented intake form

Drop a file into the Nonimo app’s window and two things come back: text in which the details have become labels, ready to paste into the chatbot, plus a copy of the file with those details covered. Pictures have their own route: a NSW licence photo is covered in the browser.

Five invented lines went through Nonimo on 28 September 2026, and this is its output as it came:

BEFORE  Client: Ms Maree Quintrell, 0 Banksia Rise, Yarrabool VIC 3999
        Born 14/03/1979. Mobile 0491 570 110, email m.quintrell@example.com
        Sole trader, ABN 51 824 753 556. Refund to BSB 000-000, account number 000123456
        Card on file 4242 4242 4242 4242. Insurer's claim number CLM0000000
        Head brewer at the only brewery in Yarrabool, back from leave on 3 February.

AFTER   Client: [PERSON_1], [ADDRESS_1], [ADDRESS_2]
        Born [BIRTH_DATE_1]. Mobile [PHONE_1], email [EMAIL_1]
        Sole trader, ABN [ABN_1]. Refund to BSB [BSB_1], account number [REFERENCE_1]
        Card on file [CARD_1]. Insurer's claim number [REFERENCE_2]
        Head brewer at the only brewery in Yarrabool, back from leave on 3 February.

The last line is context, and yours to judge. When the answer returns with labels, the app brings the real names and numbers back on your screen; the security page says what it stores where. Text pasted into the box above this guide is covered and discarded as soon as you get the result.

Sources

• Privacy Act 1988 (Cth), section 6(1). The definition of personal information: information or an opinion about an identified or reasonably identifiable individual, true or not, recorded or not. legislation.gov.au
• OAIC, What is personal information? (5 May 2017). The list of common examples, and business information that is really about an individual. oaic.gov.au
• OAIC, De-identification and the Privacy Act (21 March 2018). Quasi-identifiers, with significant dates, profession and income as examples. oaic.gov.au
• OAIC, Guidance on privacy and the use of commercially available AI products. APP 6 applies to information put into an AI system; AI generated information about an identifiable person is personal information. oaic.gov.au
• OAIC, APP guidelines, Chapter 9: APP 9. Paragraph 9.8 examples of government related identifiers; 9.9 on identifiers regulated by other laws; 9.6 on the ABN. oaic.gov.au
• OAIC, The Privacy (Tax File Number) Rule 2015 and the protection of tax file number information. Who the Rule binds and when TFN information may be used or disclosed. oaic.gov.au
• OAIC, What is an individual healthcare identifier? The IHI is a 16 digit number; the Healthcare Identifiers Act 2010 requires providers to protect it. oaic.gov.au
• Services Australia, Centrelink Customer Reference Number (CRN). Nine numbers ending in a letter, with the specimen 123 456 789A. servicesaustralia.gov.au
• Services Australia, Operational Blueprint, Medicare cards (011-44150000). Ten digit card number, card issue number running 1 to 9, and an individual reference number from 1 to 9 for each person on the card. operational.servicesaustralia.gov.au
• Australian Business Register, Format of the ABN. The check digit method, worked on 51 824 753 556. abr.business.gov.au
• Equifax, submission on driver licence card numbers (published by the Parliament of Australia). Licence number and card number, and the 2022 go live dates for the card number check. aph.gov.au
• Office of the Victorian Information Commissioner, Disclosure of myki travel information (15 August 2019). 1.8 billion records from 15.1 million cards, re-identification by researchers, seven parliamentarian cards, breaches of IPP 2.1 and 4.1. ovic.vic.gov.au
• Australian Payments Network, BSB directory. The public list of BSBs in use; no BSB beginning 00 was allocated on 28 September 2026. auspaynet.com.au
• ACMA, Phone numbers for use in TV shows, films and creative works. Reserved numbers that do not belong to people or businesses, including 0491 570 110. acma.gov.au
• Our test. Invented lines run through Nonimo on 28 September 2026. The ABN is the issuer’s own example, the card is Stripe’s published test number and the email uses the reserved example.com domain.