Remove personal data before your text goes to AI

What personal data should be redacted before a document goes to ChatGPT, Claude, Copilot or Gemini? Anything that leads to a person and that the task can do without. In an Irish file that means more than the name: the PPS number, the Eircode, the driver number, the IBAN, your own file reference and the combination of job, employer, town and date.

This guide is the list, category by category, with the Irish forms of each identifier and a checklist at the end. It covers what you can read on the page. A Word draft can also hold deleted wording and colleagues’ comments, so clearing a draft’s tracked changes and comments comes before any of it.

It is written for the people who open a client or employee file and then open a chatbot: solicitors, accountants, HR staff, practice managers, insurance brokers. Why it has to happen first, in law, is the subject of client data in ChatGPT and the breach question. Here the question is practical: what, exactly, comes out.

Three related jobs are dealt with elsewhere. How to take the details out of a PDF is its own guide, on redacting a PDF properly, and the same goes for a Word document and for a file’s hidden properties.

What personal data should be redacted, in one paragraph

The GDPR counts as personal data any information about a person who is identified, or who could be picked out straight away or with extra information, through a name, an identification number, location data, an online identifier or factors specific to that person. The Data Protection Act 2018 gives further effect to the Regulation in Irish law and uses the same test.

So the list is long by design, and the practical rule is short: remove every identifier the task does not use, and reduce the rest until it could describe many people. What to call the result, once you have done that, is a separate question of vocabulary, worked through in deidentified versus anonymized.

The Data Protection Commission sorts identifiers into two kinds. In its guidance on anonymisation it calls a name or an image “direct”, and it puts a phone number, an email address and any unique number assigned by an organisation among the “indirect” ones. Both kinds come out. The difference is only that an indirect identifier needs one lookup to become a name, and in a document sent to a large provider you cannot know who will do that lookup.

The data the task needs can stay

Nobody drafts a reply to a Workplace Relations claim without saying what the claim is about. The facts, the sequence of events, the amounts in dispute and the legal question are what the model is there to work on. Redaction is about the handles on a person, not the substance of the file. A useful test is to ask what the answer would lose if a detail were replaced with a marker. If the answer is nothing, it goes.

That is also what the data minimisation principle in Article 5(1)(c) of the GDPR asks for, and it is why the list below is written as categories rather than as a fixed set of words.

The Irish list in one table

The table sets out the identifiers that turn up most in Irish office documents, with where they tend to hide in the files that Irish solicitors and accountants handle every day. The first group is the numbers that belong to one person for life.

identifier	what it looks like	where it hides
PPS number	7 digits and one or two letters	tax credit notices, medical and GP visit cards, the Public Services Card
Public Services Card	card number on the back, photo, signature	copies attached to applications
Passport number	printed on the photo page	onboarding and client due diligence files
Driver number	section 4(d) of the licence or permit	motor claims, insurance files, hire forms
Individual Health Identifier	a number for life, never reissued	HSE and clinical correspondence
Hospital number (MRN)	the hospital’s own chart number	discharge letters, referral letters
Date of birth	full date	every form that asks for identity

Sources: gov.ie on the PPS number, Revenue, Citizens Information, HIQA. The rows are explained below.

The second table covers contact, financial and file details, which are identifiers too even though they change over a lifetime. They appear later in this guide, after the section on numbers issued by the State.

Numbers issued by the State

Irish public services attach a number to each person, and each of those numbers is a direct route back to one individual. Most documents carry at least one of them, often in a place nobody reads: a header, a form field or a scanned card at the back.

The PPS number also carries statutory limits on who may use it, and those are covered in the PPSN guide. This section is only about spotting it and the other State numbers in a document.

The PPS number and the cards that print it

The Department of Social Protection states that a PPS number is always seven numbers followed by one or two letters. Revenue lists where people find their own: the Public Services Card, the Drugs Payment Scheme card, the medical card, the GP visit card, the European Health Insurance Card, a tax assessment and the PAYE notice of tax credits. Each of those can end up scanned into a file.

There is an Irish detail worth knowing. Revenue explains that, historically, a wife was given her husband’s PPS number with the letter W added on marriage. A number ending in W therefore does more than identify one woman: it carries her husband’s number inside it. Search the document for the digits alone, because some systems print the number with spaces and some with the letters apart.

Citizens Information describes the Public Services Card itself: name, photograph and signature on the front, with the card expiry date, and the PPS number and a card number on the back. A photocopy attached to a grant or pension application therefore carries several identifiers at once, one of them a face, and the card number is easy to miss because it is not the PPS number.

Passport, driving licence and the driver number

Passport copies sit in any file that went through identity checks, from a conveyancing matter to a new employee’s onboarding. The passport number is an identifier in its own right, and the photo page adds a face, a signature and a date of birth. If the task is not about the passport, the copy should not be in what you send at all.

The Irish driving licence has a detail that changed recently. Since 31 March 2025, motorists must give their insurer their driver number and the driver number of any named driver when they take out cover. Citizens Information says it is found in section 4(d) of the licence or learner permit. So motor policy schedules, proposal forms and claim files now carry it, in the insurance offices that brokers across Ireland send to AI tools for summaries.

31 March 2025

On a policy schedule the driver number sits beside the name and address, and it ties that policy to one driver. Treat it exactly like the PPS number, and remember that a copy of the licence itself also shows a photo, an address and a date of birth.

The health identifier and the hospital number

According to HIQA, anyone who uses, once used or might one day use Irish health and social care services gets an Individual Health Identifier. It stays with the person for life and is never handed on to somebody else. The Health Identifiers Act 2014 created it, and the HSE operates it.

Hospital letters add a second number, the medical record number, which is the hospital’s own chart reference. It is only meaningful inside that hospital, and that is exactly why it identifies: anyone with access to the hospital’s system can go straight to the chart. Both numbers come out, and so does the ward, the consultant’s name beside a rare condition, and anything else that narrows a small list of patients.

Health details are also special category data, with extra conditions that the Article 9 guide works through. A GP practice will find the clinical side worked through in patient data and AI in Ireland.

Contact details, down to the Eircode

Contact details are the identifiers people remember to remove from the top of a letter and forget everywhere else. The DPC’s redaction note makes the point that a search can only find the exact words you give it, and contact details are typed in more forms than any other kind of data. A deck gives the search more to miss, since one person can turn up under five spellings across its slides, notes and comments.

identifier	Irish forms to search for	where it hides
Mobile and landline	08x, +353 8x, 00353, (01)	signature blocks, call notes
Email address	personal and work, including initials	headers, forwarded chains
Postal address	street, townland, town, county	letterheads, forms, footers
Eircode	three characters, a space, four more	its own line, often without a label
IBAN, or sort code and account	IBAN starts with IE; older forms show both	invoices, refunds, payroll
Card number	16 digits, often in groups of four	receipts, expense claims
File, claim and policy references	your format and each insurer’s	subject lines, headers

Sources: Eircode, Bank of Ireland, the DPC’s redaction note. Formats as printed in Irish documents.

The Eircode needs its own mention. Eircode’s own description is that “a unique Eircode is assigned to each residential and business postal address”, which is not how postcodes work in most countries. Why that makes it an identifier as strong as a name is explained in our PPSN guide; for this list the point is practical. The code is usually typed on a line of its own, so replacing the street does not remove it.

Townlands, counties and the address that is still there

Irish rural addresses are often a house name, a townland and a county, and the townland on its own may contain a handful of houses. Removing the house name leaves most of the address in place. If the task needs a location at all, a county is usually enough, and for many tasks a region such as the northwest does the same work.

Work email addresses are easy to overlook because they look corporate. An address built from a first initial and a surname at a small firm’s domain is as good as a name, and forwarded email chains repeat it in every header. The DPC lists email among the identifiers in its anonymisation guidance, without any exception for work addresses.

Bank details: IBAN, card and the old sort code

Money details come out every time. An IBAN identifies an account, and an account belongs to someone. Bank of Ireland notes that the BIC and IBAN replaced the national sort code and account number as the identifiers for SEPA payments, which in practice means Irish documents carry both: newer ones the IBAN, older statements, standing orders and forms the sort code and account number. Search for each.

A card number is covered by the same rule, and so is its expiry date. Expense claims and receipts are where full card numbers survive, sometimes with only the middle digits masked by the retailer. Partial numbers still identify when they appear beside a name and a date. In a bank statement exported as a CSV, the line for each payment often names the other party as well.

Salary, amounts and the figure that identifies

An exact salary or an exact settlement figure is not an identifier on its own, but in an HR or employment file it can single out the one person paid that amount. The figure the model needs is usually a range or the difference between two numbers.

If the exact amount is the point of the task, keep it and take extra care with everything around it. Payroll bureaus and practices see this every week, and the page for accountants looks at their side of it.

Case, claim and policy references

Reference numbers feel safe because they are internal. They are the opposite: each one was created so that someone could go straight to a person’s record. Your own file reference opens the client file. An insurer’s policy or claim number opens the policyholder’s account. A hospital number opens a chart. None of them improves a summary or a draft, so every one of them can go.

Courts and tribunals add their own. A High Court record number, a District Court case number or a tribunal reference is often printed at the top of every page, and for a file that went to a hearing it is a link to public listings. For papers that go before the High Court, the court’s own position on AI is in Practice Direction HC 142.

A WRC reference opens a named decision

The clearest Irish case is the Workplace Relations Commission. Its guidance note for adjudication hearings, dated 28 July 2021, says a written decision stating the party names is issued to the parties and uploaded to the WRC website, unless special circumstances lead the adjudication officer to publish it in anonymised form. So an ADJ number in an employment file is a key to a published document that normally names the employee and the employer.

The same logic applies to anything with a public register behind it: a planning file number, a Property Registration Authority folio, a company number for a company run by one person. If the reference leads to a register that names people, it is an identifier.

IP addresses, number plates and photographs

The Data Protection Act 2018 spells out what an online identifier can be. In the definitions for its law enforcement part, section 69 says it includes an internet protocol address, a cookie identifier or another identifier such as a radio frequency identification tag. Log extracts, security incident reports and website enquiries all carry IP addresses, often dozens of them, and they belong on the list.

Vehicle registrations matter in motor, insurance and personal injury files. Citizens Information explains that an Irish plate shows the year and half year of first registration and the licensing area, with the example of 262-D-111 for a Dublin vehicle first used in the second half of 2026. A plate beside a road and a date narrows a claim to one car and one incident, and anyone who knows the car can put a name to it.

Photos, signatures and handwriting

A photograph of a person is a direct identifier in the DPC’s own terms, and a signature does the same job. Scanned documents, a driving licence among them, carry both, and they carry them as images. The DPC’s redaction note warns that text held inside an image, a photographed certificate for example, is invisible to a search. A scanned card inside a document is best taken out of the file; a photo of the card itself can be covered in your browser with the passport and ID copy tool, and it never leaves your device. The Nonimo app can do the same on the computer itself, in its ID documents section, and gives you back a watermarked copy without the photo’s metadata.

For a PDF, the difference a scan makes is explained in the PDF guide. For this list, the rule is simple: if the file contains a picture of a card, a face or a signature, take the picture out. If the picture itself is going to a chatbot, what the assistants keep of an uploaded photo is worth reading first.

Job, employer, town and date: the indirect identifiers

This is the category the checklists tend to leave out, and in Ireland it is the one that matters most after the name. The DPC’s anonymisation guidance explains singling out as a unique combination of values that distinguishes one person, even when many others share each value on its own. Job title, employer, town and date are four ordinary facts. Put together in a small country, they often describe one person.

Our PPSN guide makes the same point about solicitors in a small county. Here is the version that turns up in an HR file.

One crane operator in a small harbour town

Take an invented sentence from an occupational health referral, set in Kilnagrosna, a harbour town we made up for this guide: “She is the only woman working as a crane operator at the harbour in Kilnagrosna and went on sick leave on 3 March 2026.”

There is no name, no number and no address. Anyone who works at the harbour, lives in the town or reads the local paper knows exactly who it is, and so would anyone who later compares the sentence with public material.

The same shape appears everywhere in Irish documents: the principal of the only Gaelscoil in a town, the one pharmacist in a village, a county councillor’s brother, a named GAA club and a player’s position, the only nurse on a ward who speaks Polish. Council records work this way constantly, as the local authorities guide shows.

Generalise rather than delete

Deleting every indirect identifier often leaves a sentence the model cannot use. The better move is to make each one broader until the combination could describe many people. Usually one change is enough, and it should be the one the task needs least. In a spreadsheet the same move is made column by column, swapping a date of birth for an age band or an Eircode for a county.

The occupational health question survives all four changes: whether a skilled operative can return to lifting work after a given absence. Nothing the model was asked to do depended on the harbour, the town or the exact day.

Dates deserve a word of their own. A full date of birth always goes. Other exact dates are worth keeping only if the task turns on them, such as a limitation period or a notice deadline. Otherwise a month, or an interval such as six weeks later, carries the meaning without giving anyone a date to match against a court list, a WRC decision or a local news report.

People on the other side, and in the background

A document about one client almost always names other people: a former employer, a witness, a tenant, a spouse, a child, a colleague who made a complaint. They are identifiable people too, and the GDPR protects each of them in the same way. Your client may have agreed to AI being used on their matter; the other people in the file have agreed to nothing.

The DPC’s redaction note is built around exactly this problem, since it was prepared with access requests in mind, where the job is to protect everyone except the person asking. One of its points carries straight over: the same person can turn up under a first name, a courtesy title, a family relationship or a set of initials, and searching for the name catches none of those.

Roles instead of names

Replace each person with a role that the model can follow: [CLIENT], [RESPONDENT], [WITNESS 1], [WITNESS 2]. Consistent labels keep the logic of the document intact, which matters when the task is a chronology or a draft letter. A letter of engagement can provide for AI use, but only the client signs it; the engagement letter guide explains where that stops.

Children need particular care. A child is often identified by a school, a class, a club or a parent’s name rather than by their own, and those details belong on the indirect list above.

What can stay: the facts the model needs

A redacted document still has to be useful, or people will stop redacting. Most of the value in a file sits in the facts, and facts are rarely identifiers on their own. The sequence of events, the legal issue, the type of contract, the nature of an injury, a range of figures and the outcome someone wants are what the model works with.

The line is drawn by the task. A summary of a lease dispute needs the terms of the lease and what went wrong, not the tenant’s name or the Eircode of the flat. A draft reply to a Revenue query needs the tax point at issue, not the PPS number. When in doubt, replace the detail with a clearly labelled marker and see whether the output suffers. It usually does not.

When the details are the point

Some tasks do depend on an identifier: checking a PPS number against a form, reconciling an IBAN, matching a claim number. Those tasks belong in systems built for them, not in a general chatbot. If an AI tool must see the real data, the question moves from redaction to whether that tool is suitable for client work at all, which the assistant by assistant comparison takes up.

Removing the identifiers does not make the result anonymous in law while the original sits in your files; the guide on pseudonymised data explains why. What it does is cut what the provider receives to what the task needs, and the Tusla decision, covered in our Word guide, shows the DPC fining a body for sharing documents that still held other people’s details.

Nonimo on an occupational health referral

The Nonimo app works on your own machine, and what you give it stays there. Paste text into the app or drop a file on it, and it returns the text with every detail replaced by a marker, ready for the AI, along with a covered copy of the file. It pseudonymises: once the AI’s answer is pasted back into the app, the real details go back in. Put the same note into the tool above this guide instead and it comes back masked, ready to copy, and the text is discarded as soon as you have it.

We put an invented Irish referral note through the Nonimo app.

in the note	what the model would see
Employee: Gráinne Mac Suibhne	Employee: [PERSON_1]
PPS number: 0000000W	PPS number: [REFERENCE_1]
Address: 1 Ascaill an tSampla, Letterkenny, Co. Donegal A00 0000	Address: [RECORD_FIELD_1]
Passport number: PX0000000	Passport number: [REFERENCE_2]
Driver number: 000000000	Driver number: [REFERENCE_3]
Salary account: IE29AIBK93115212345678	Salary account: [IBAN_1]
Gráinne is the only woman working as a crane operator at the harbour in Kilnagrosna	[PERSON_2] is the only woman working as a crane operator at the harbour in Kilnagrosna

Invented data, with numbers chosen so they cannot belong to anyone; the IBAN is the sample account published in the IBAN registry. Run in the Nonimo app on 28 September 2026.

It also covered the date of birth, mobile, email, a test card number and the policy and hospital numbers. The job, the place and the date are yours to generalise, as this guide shows, so the facts the task needs stay in.

What personal data should be redacted: a checklist for Irish documents

The list below puts the quick wins first. It assumes you are working on a copy, the first of the general principles in the DPC’s redaction note. Write it into your office’s AI policy, whose structure is set out in our AI policy template, so that it does not depend on memory.

1. Names and roles. Every person, in every form: first name, surname, Irish and English forms, initials, titles and relationships. Replace each with a consistent role.
2. State numbers. PPS number, Public Services Card number, passport number, driver number, IHI and hospital number. Search for the digits alone.
3. Contact details. Phone numbers in every Irish format, email addresses, postal addresses with townland and county, and the Eircode on its own line.
4. Money. IBAN, sort code and account number, card number and expiry, and any exact figure that identifies.
5. References. Your own file number, insurer policy and claim numbers, court record numbers, WRC and other tribunal references, register numbers.
6. Online and visual. IP addresses, vehicle registrations, photographs, signatures and scanned cards.
7. The combination. Read what is left as someone who knows the town. Generalise the job, the employer, the place or the date until it could be many people.
8. The rest of the file. Headers, footers, comments and properties, which the guides on Word and metadata take in turn.

Step seven takes the longest and cannot be automated, because it depends on knowing who might read the document. In an Irish practice, that reader is closer than a checklist written for a larger country assumes. Offices that send files to AI tools every week will find the professional side for solicitors and for healthcare practices on their own pages, and the provider side in our guide on what OpenAI keeps from a chat.

Sources

• Department of Social Protection (gov.ie), Get a Personal Public Service (PPS) Number. A PPS number is always seven numbers followed by either one or two letters. gov.ie
• Revenue, Personal Public Service Number (PPSN). The cards and documents on which a PPS number is printed; the historical W numbers assigned to wives on marriage. revenue.ie
• Citizens Information, Public Services Card. Name, photograph, signature and expiry date on the front; PPS number and card number on the back. citizensinformation.ie
• Citizens Information, Motor insurance driver number (4 April 2025). Since 31 March 2025 the driver number of each named driver is needed for motor insurance; it is in section 4(d) of the licence or learner permit. citizensinformation.ie
• HIQA, National Register of Individual Health Identifiers. The IHI uniquely identifies each person using health or social care services, lasts for life and is never reissued; the Health Identifiers Act 2014 and the HSE’s role. hiqa.ie
• Eircode, What is Eircode? Unlike postcodes that cover a group of addresses, each residential and business postal address has its own Eircode. eircode.ie
• Bank of Ireland, IBAN/SWIFT/BIC Explained. BIC and IBAN replaced the national sort code and account number as the identifiers for SEPA payments. bankofireland.com
• Workplace Relations Commission, Guidance Note for a WRC Adjudication Hearing (28 July 2021). Decisions stating party names are uploaded to the WRC website; anonymisation only in special circumstances. workplacerelations.ie
• Citizens Information, Vehicle registration plates. An Irish plate shows the year and half year of first registration and the licensing area, with the example 262-D-111. citizensinformation.ie
• Data Protection Act 2018, long title and section 69. The Act gives further effect to the GDPR; an online identifier includes an IP address, a cookie identifier or an RFID tag. irishstatutebook.ie
• Data Protection Commission, Guidance on Anonymisation and Pseudonymisation (June 2019). The GDPR definition of an identifiable person; direct identifiers such as a name or image and indirect ones such as a phone number, email address or assigned number; singling out by a unique combination of values. dataprotection.ie
• GDPR, Article 5. Personal data must be adequate, relevant and limited to what is necessary for the purpose: data minimisation, Article 5(1)(c). gdpr-info.eu
• Data Protection Commission, Redacting Documents and Records (August 2021). Work on a copy; searches find only what they are told to look for and cannot read text in images; one person referred to in several ways. dataprotection.ie