What to mask before you paste a document into an AI

Before a client document goes into a chatbot, seven things have to come out of it, and six of them a machine can do for you. The seventh is the one that decides whether any of it worked.

Behind that job are three words. They are not three grades of the same thing, and only one of them takes your data out of the law. Anonymization is the endpoint: reach it and data protection law stops applying. Pseudonymization and masking are both reversible, which means the file you cleaned up is still personal data and still yours to answer for.

That matters most at the moment you are about to paste something into a chatbot. You cover the national ID number, the name looks generic enough, the file seems safe. Whether you call the result deidentified or anonymized, what decides it is not how much you took out but whether anyone could put it back.

Deidentified vs anonymized: the two words are not two grades of the same thing

Start with the one that has a legal definition, because it is the only one that changes your obligations.

Under the GDPR and the UK GDPR, information is anonymous when a person can no longer be identified by any means reasonably likely to be used. Get there and the material falls outside the regime completely. Article 4(5) of the GDPR, which is Article 4(1)(5) in the UK GDPR, defines pseudonymization as the opposite case: the data can no longer be attributed to a person without additional information, and that additional information is kept separately.

The link still exists. Someone holds it. That someone is usually you, which is the detail that decides most of what follows in this guide and in our guide on whether pasting client data into ChatGPT is a breach.

18

So the two words sit at opposite ends. Anonymization is a destination you either reached or did not. Pseudonymization is a filing system with the index kept in another drawer.

“Deidentified” is the odd one out, and this is where the confusion starts. In the United States it is a defined standard. Everywhere else it is a description that sounds like one.

The test is “reasonably likely”, not “impossible”

The European standard is often misread as demanding that identification be impossible, which would make anonymization unreachable for almost any real document. It does not. It asks about the means reasonably likely to be used, taking account of cost, time and available technology.

That is a practical test, and it cuts both ways. It means you do not have to defend against an adversary with unlimited resources. It also means you cannot wave away a link that anyone in your own office could make in ten seconds.

In the United States it is a standard with a test attached

The HIPAA Privacy Rule gives covered entities two routes. Expert determination, where a qualified person documents that the risk of identification is very small. Or Safe Harbor, which lists 18 identifiers and requires all of them to go.

2routes to the standard

18identifiers Safe Harbor removes

1further condition people forget

The list runs from the obvious to the easily missed: names, geography below state level, dates tied to an individual, telephone and fax numbers, email addresses, Social Security numbers, medical record and account numbers, device serial numbers, URLs, IP addresses, biometric identifiers, full-face photographs, and a catchall for any other unique identifying number, characteristic or code.

Read the list by kind rather than in order and something useful falls out. Seven of the 18 are reference numbers, five are contact details, and two are biometric or photographic. That is 14 of the 18 that have a fixed shape.

Reference numbers7

Contact details5

Biometric or photographic2

That is the shape of the problem in miniature. Most of the list is mechanical, and what is not, a name in a narrative and the story around it, occupies two entries out of the 18.

There is a second condition that gets forgotten, and it does most of the work. Even with all 18 gone, the entity must not have actual knowledge that what remains could be used, alone or with other information, to identify someone. The list is the floor, not the ceiling. Our guide to HIPAA compliance for AI tools covers what that means once a vendor is in the picture.

What the UK regulator says about the word deidentified

The regulator’s position surprises people, and it is worth quoting rather than paraphrasing. The ICO’s anonymisation guidance addresses the term directly and declines to adopt it.

“While the term ‘de-identified’ is widely used, we do not encourage it as a synonym for anonymous information or pseudonymous data. This is because UK data protection law doesn’t define the term, so using it can lead to confusion.”

The regulator then explains where the phrase does appear in UK law, and it is not a reassuring place. It uses the term only in connection with Section 171 of the Data Protection Act 2018, the provision that makes reversing the process on “de-identified personal data” a criminal offense.

171

So in the United Kingdom the word shows up in the statute book mainly to describe what somebody must not undo. That is a strange foundation for a reassuring label on your own working file, and a good reason to say what you actually did instead of reaching for a word that sounds official. On a file holding health or union details the label matters more, since for whoever masked it the special category stays attached.

The same guidance settles the question underneath it

The ICO is equally direct about status: pseudonymous information is still personal data. Not a lighter category, not a partial exemption. Personal data, with the whole regime attached, which is the premise our guide to GDPR compliance for AI tools works from.

The Court of Justice of the European Union reached the matching conclusion in EDPS v SRB on 4 September 2025, in case C-413/23 P. The party that carried out the pseudonymization normally holds the additional information that restores the link, so for that party the material stays personal. If you did the masking, you are almost certainly that party. So a British firm that masks before it pastes still needs its lawful basis, contract and records.

One word, three regimes, three different answers

where	what “deidentified” means there
United States	a defined standard, with two routes and a test
United Kingdom	undefined, and discouraged by the regulator
European Union	not a legal category; the law speaks of pseudonymization

Source: 45 CFR 164.514, ICO anonymisation guidance and Article 4(5) GDPR.

Those are three answers to one question, which is why three competent advisers can describe the same document in three different ways. It is also why the safest habit is to describe the operation rather than claim the category. Teams working across borders hit this constantly, which is the same shape of problem our guide on whether the EU AI Act applies outside the EU deals with.

Masking, redaction and pseudonymization: three jobs, not three words

People use these interchangeably and then argue about conclusions that were decided by the choice of word. It is worth slowing down on them once, because the rest of this guide, and most of what our guide on pasting client data into ChatGPT says about consequences, rests on the distinction.

what you did	what you kept	where it leaves you
Redaction	nothing of the value	removed, if the tool truly removes it
Masking	part of the value, hidden	reversible from context or from the remainder
Pseudonymization	a stable substitute plus the key	personal data, for whoever holds the key
Anonymization	nothing that can restore the link	outside data protection law

Source: Article 4(1)(5) UK GDPR and the ICO anonymisation guidance, read together.

Two practical notes follow from that table and are not in it.

The first is that hiding a value in a document you keep is not the same as never having written it down. A national ID number shown as four digits still narrows the field, and if the surrounding text names an employer and a month, four digits can be plenty.

The second is that redaction only counts if the tool removes the underlying content. A black rectangle drawn over text in a PDF is a graphic layer, and the text sits underneath it, available to anyone who copies and pastes. Use the editor’s redaction function, or export to plain text and clean it there.

What PII masking is, and what it is for

Masking in the narrow sense is a display technique. A number is stored in full and shown in part, so a reader sees the last four digits and the rest is stars. It is genuinely useful: it limits what someone looking over your shoulder, or a screenshot, can see, and it lets support staff confirm a record without reading the whole value.

What it is not is a change of legal status. The record still holds the number, your systems still resolve it, and the masked view changes what the screen shows, not what the data is. Treat it as reducing exposure, not as reaching a category.

The word you reach for is the claim you are making

If you tell a client that their file was anonymized, you have said something with a legal meaning: that nobody can get back to the person by any means reasonably likely to be used.

If what you did was replace names with labels and keep the original, that statement is wrong, and it is wrong in a way a regulator can check. The gap between the two is where complaints are won.

The 18 identifiers in the United States, and the rule that free text gets no exemption

The HIPAA list is the most concrete inventory any regulator publishes, and it is useful well beyond healthcare, because it is a checklist of what tends to identify people in ordinary paperwork. An employer’s own leave file is a good test, since an FMLA note held by HR sits outside HIPAA altogether and still needs the same identifiers out.

Two of its provisions deserve attention from anyone who works in prose rather than in databases.

3ZIP digits you may keep

20,000people that area must exceed

89age above which the year goes too

The geography rule keeps only the first three digits of a ZIP code, and only when the area they describe holds more than 20,000 people. Below that threshold the digits become zeros. The date rule strips everything finer than the year for dates tied to an individual, and for anyone over 89 it takes the year as well.

Both rules exist because small numbers identify. A rare condition in a small town needs no name at all, and the same arithmetic applies to a small employer, a small department or a single production line. Teams in the public sector meet this constantly, and our guide on AI and public records in local government works through what it does to a disclosure decision.

Free text is covered, and HHS says so in as many words

This is the sentence to remember when you are about to paste a paragraph rather than a spreadsheet. The guidance states that the de-identification standard makes no distinction between data entered into standardized fields and information entered as free text, and that an identifier on the list must be removed regardless of its location in a record if it is recognizable as an identifier.

There is no narrative exemption. The email address inside a quoted message counts. The account number someone typed into a note counts. A structured field is easier to spot, not more regulated, and the difference between the two is a problem for your process rather than for the rule.

What still identifies when the number is gone

Here the American regulator makes the argument better than any vendor could, and it is the single most useful line in the guidance for our purposes. HHS observes that clinical narratives, where a physician documents the history or lifestyle of a patient, are rich in information and may provide context that readily allows for patient identification.

Swap “clinical narrative” for “case note”, “file summary” or “the email you are about to paste” and the point survives intact.

Consider what is left after a careful pass that removes every name and number:

• a job title, in a company small enough that the title belongs to one person
• a date of an incident that was discussed in a meeting
• an amount, unusual enough to be memorable
• a sequence of events that the people involved lived through

None of that is on any identifier list. Together it can single out one individual for anyone who was in the room. Identifiability is a relationship between the data and the person reading it, not a property the file carries around. That is also why the answer changes with the recipient.

The motivated intruder, and why the UK regulator asks the right question

The ICO frames the test as whether a motivated intruder, someone reasonably competent with access to public resources and no specialist skills, could work out who this is. That is a more honest question than “did I remove the identifiers”, because it puts a reader in the picture.

Ask it about the specific text in front of you, with the specific recipient in mind. A summary that is genuinely unidentifiable to a stranger on the internet may be transparent to a colleague, and the colleague is often who ends up reading it. The answer changes again when the recipient is an AI vendor, and our guide on what ChatGPT does with your data in the UK looks at it from that side.

The test also has a date attached, which people miss. A file that was unidentifiable when you wrote it can become identifiable later, because something else got published. That is not a reason for paralysis, but it is a reason to treat the judgment as made on a given day with given facts, and to write down which day.

The national ID number is the easy part

Every market has one, and it is the piece everyone thinks of first. That is exactly why it deserves the least of your attention.

market	the number people think of first
United States	Social Security number
United Kingdom	National Insurance number
Ireland	PPS number
Australia	Tax File Number, and Medicare
Spain	DNI or NIE
Germany	Steuer-ID

These are the identifiers that behave well. They have a fixed shape, they are easy to find, they are easy to replace, and several carry a check digit that makes them easy to validate.

If your process only catches these, it is catching the easy part and missing the real risk. What gets missed is everything with no fixed shape: the company name, the street, the unusual job title, the date, the relationship between two people that exists only in this file.

The national rules that attach to all of it diverge by market, and the reporting duties diverge most of all, which is why our guide on whether client data in ChatGPT is a breach takes each jurisdiction separately rather than in one answer.

What to mask before you paste, in order

This is the order that catches the most in the least time. It assumes you are handling a document about someone else, which is the case that carries the liability.

Six of the seven steps are mechanical: they operate on values, and a machine does them faster and more consistently than you will at five in the afternoon. The seventh is not, and it is the one that decides the answer.

7steps before you paste

6a machine can do

1that stays with you

The six mechanical steps

1. The people. Names of the client, of their family, of the counterparty, and of any professional named in the file. Include the ones in signature blocks and quoted emails, which is where they hide.
2. The organizations. An employer is an identifier when it is small. A named company plus a job title is frequently one person.
3. The numbers with a fixed shape. National ID number, tax number, account, policy, case reference, medical record number, license plate. These are the ones a tool should never miss.
4. The places. Street address first, then anything finer than a city. A postal code narrows things down more than people expect.
5. The dates. Anything tied to the individual rather than to the calendar. Birth dates, admission dates, the date of the incident.
6. The contact details. Email addresses, phone numbers, handles. They are identifiers and they are also a route to the person.

Step seven is the one that decides it

7. The story. Read what is left as if you were the motivated intruder. This is the step no tool can do for you.

The first six operate on values with a shape, and the right answer is to automate them. The seventh operates on meaning, and it stays with you. Writing down which of the two you rely on, and when, is most of what a usable AI policy contains.

What a cleaned paragraph actually looks like

The value of doing this on the text rather than on a form is easiest to see side by side, with the substitutions lined up against what they replaced.

BEFORE  Maria Okonjo, employee number 4471, of Harlow Fabrications
        (12 Mill Road, Harlow), signed off sick on 14 March 2026
        after an incident with the press on line two.

AFTER   [PERSON_1], employee number [ID_1], of [ORG_1]
        ([ADDRESS_1]), signed off sick in [DATE_1]
        after an incident with the press on line two.

STILL   one company, one production line, one machine, one absence.
THERE   If the reader knows the site, the labels change nothing.

The mechanical pass did its job, and it did it well: every value with a shape is gone. The last two lines are the reason step seven exists, and no amount of pattern matching would have produced them.

step	what comes out	in the Harlow paragraph	who does it
1. The people	names	Maria Okonjo → [PERSON_1]	a machine
2. The organizations	employers, companies	Harlow Fabrications → [ORG_1]	a machine
3. Numbers with a fixed shape	IDs, accounts, references	employee number 4471 → [ID_1]	a machine
4. The places	street, anything finer than a city	12 Mill Road, Harlow → [ADDRESS_1]	a machine
5. The dates	dates tied to the person	14 March 2026 → [DATE_1]	a machine
6. The contact details	email, phone, handles	none in this paragraph	a machine
7. The story	what makes the situation recognizable	one production line, one machine, one absence	you

The seven steps applied to the Harlow paragraph above.

The same paragraph, with only the number masked

Most tools, and most people in a hurry, do step three and stop. Lined up against the full pass, the difference is not subtle.

ONLY THE   Maria Okonjo, employee number [ID_1], of Harlow
NUMBER     Fabrications (12 Mill Road, Harlow), signed off sick
           on 14 March 2026.

FULL PASS  [PERSON_1], employee number [ID_1], of [ORG_1]
           ([ADDRESS_1]), signed off sick in [DATE_1].

The first line still carries a name, an employer, a street and an exact date. It is the version that feels safe because something visibly changed, and it is the version that gives away everything the number never did.

Where masking stops being enough

Masking is a control on the content. It does nothing about three other things, and it is worth being clear about which problem you are solving.

It does not change where the text goes. The paragraph still leaves your machine, still reaches a third party, and still lands in a history somewhere. If the material is covered by a professional duty of confidence, the duty attaches to the disclosure, not only to the names in it.

It does not change who is responsible. When you process a client’s data on their behalf, the obligations that come with that role stay where they are. Nothing about substituting labels moves them, and the same holds for the duties you take on by deploying a system at all, which our guide on what a deployer owes under the EU AI Act works through.

Evidence is a separate product from protection

If someone asks in six months whether the control was applied on a given day, “we were careful” is not an answer, and neither is a screenshot.

Teams usually discover this late, when an insurer asks. The AI questions on cyber insurance questionnaires are worth reading before you need them, because several of them ask what you can show rather than what you do.

The disclosure question is separate from the identification question

These get merged and they should not be. “Can the recipient tell who this is” and “was I allowed to send this at all” are two different questions with two different answers, and a clean masking pass only ever addresses the first.

PII scrubbing: what the engineering phrase means, and where it stops

If you work anywhere near a data team you will hear this one. It is worth knowing because it describes a real technique, and because it is frequently offered as an answer to a question it does not answer.

Scrubbing means stripping personal data out of text or logs before they move on, usually inside a pipeline and usually at volume. It is good engineering practice and it belongs where engineers put it: logs, telemetry, training corpora, support tickets on their way to storage.

What it is not is a legal status. Scrubbed output is pseudonymous unless the link is genuinely and irreversibly gone, which in a pipeline it usually is not, because pipelines are built to be debugged. The word describes where the work happens, not what the work achieved, and the same caution applies to anything a vendor calls safe by default, because what left the office is a disclosure either way.

The claim you must not make about your own work

There is a temptation, once you have a tool, to tell clients their files are anonymized. Resist it, for a reason that has nothing to do with modesty.

Anonymization is a term of art, and claiming it is a statement about a legal status. If the link can be restored, and with a substitution system it generally can, the statement is false and falsifiable by anyone who looks.

Saying “we pseudonymize before anything leaves the office” is both accurate and more impressive, because it shows you know the difference. The same applies if you say deidentified instead of anonymized: in the United States it means something specific with a test attached, and in the United Kingdom the regulator will not use it as a synonym for anything. Our AI policy template uses the narrower wording throughout for exactly this reason.

What Nonimo does here, and what it does not

Nonimo replaces identifying values with stable labels before text reaches an AI tool. The same value becomes the same label every time, so the text stays readable, and the cleaning happens on the machine before anything leaves it.

6

What it covers is that mechanical part, steps one to six, against the identifiers that actually appear on office paperwork in each market it supports, checked against real documents with their provenance recorded rather than against a generic list.

The mapping is reversible by design, because you need the answer to come back in terms you can use, so the output is pseudonymous rather than anonymous, and pseudonymous data is personal data. Whether you were allowed to send the text at all is for your professional rules and your client’s instructions, and our AI policy template is the scaffold for writing that line down.

What the app keeps on your disk, encrypted, is set out on Nonimo’s security page.

The question to ask before you paste

Not “did I take out the name”. The useful question has two halves, and both need a yes.

Could someone who might read this put the person back, using what they already know? And was I allowed to send this text to this recipient in the first place?

The first is about identifiability, and a good masking pass gets you most of the way there. The second is about disclosure, and no tool touches it. Most of the trouble in this area comes from answering the first question well and never asking the second, which is where our guide on pasting client data into ChatGPT picks the story up.

Sources

• HHS, Guidance Regarding Methods for De-identification of Protected Health Information (hhs.gov). The two routes, the eighteen identifiers listed A to R, the actual knowledge condition, the ZIP rule that keeps three digits only above twenty thousand people, the rule for ages over 89, the statement that free text gets no exemption, and the observation that clinical narratives are rich enough in information to allow identification.
• ICO, Anonymisation guidance (ico.org.uk). That pseudonymous information is still personal data, the motivated intruder test, and the quoted passage declining to use “de-identified” as a synonym, together with its only use in connection with Section 171 of the Data Protection Act 2018.
• Regulation (EU) 2016/679, Article 4(5) and Recital 26 (eur-lex.europa.eu). The definition of pseudonymization as requiring separately held additional information, and the means reasonably likely to be used test that anonymous information must pass.
• Court of Justice of the European Union, C-413/23 P, EDPS v SRB, judgment of 4 September 2025 (curia.europa.eu). That the party which pseudonymized normally holds the additional information, so the data remains personal for that party.
• NIST SP 800-188, De-Identifying Government Datasets (nvlpubs.nist.gov). Background on identifiability as a property of the data together with its context rather than of the fields alone.