Redact your text: remove personal data before AI sees it

Before a contract, a complaint or a case note goes into ChatGPT, Claude or Copilot, somebody has to decide which details come out. Leave too much in and a client’s name ends up in a provider’s records, which raises the question of whether that paste was a breach.

The box above redacts text you paste. Below is the sorting list for everything else: what to remove, what to blur and what to leave alone. I’d put more care into the blurring than the removals, since software handles fixed-format numbers well; our overview of redaction products for AI work compares the options.

What counts as personal data? Four definitions, one test

Article 4(1) of the GDPR is the definition most organisations meet first: any information relating to an identified or identifiable person. It names the handles that do the identifying, such as a name, an identification number, location data, an online identifier, or factors specific to someone’s physical, economic, cultural or social identity.

NIST’s guide to PII, written for US federal agencies, splits it in two: details that distinguish or trace a person, such as a name or Social Security number, and details linked or linkable to them. California’s CCPA reaches further: anything that could reasonably be linked with a consumer, or even a household.

The wording differs; the working test hardly does. Could someone holding this text, plus what they could reasonably find, tell who it is about? I trust that question more than any list. A label in place of a name doesn’t end it, as our page on de-identified and anonymous data explains.

Direct identifiers: one name, many disguises

A direct identifier points to someone without help: a name, a face, a signature, a personal email address or mobile number. NIST’s examples of PII include full name, maiden name and alias, street and email addresses, and personal characteristics such as a photograph, fingerprints or handwriting.

Names are slippery, because files rarely call a person the same thing twice. Ireland’s Data Protection Commission warns that a search finds only what you type, and one person may appear as a first name, a title, a relationship or initials. Decks make it worse: see the spellings a name picks up across slides.

Faces and signatures arrive as images, which text search cannot read. If a scanned card or a signed letter sits inside the file, I’d lift the picture out rather than cover it. A photo uploaded to a chatbot raises its own retention question: what happens to images you give an assistant.

ID numbers, bank details and card numbers

Numbers issued to one person are the easy call: they go every time. NIST’s list includes Social Security, passport, driver’s licence and taxpayer identification numbers, plus financial account and card numbers. Every country has its own national number, with its own rules on who may use it.

A photocopy of an ID brings the number plus a face, a signature and a date of birth. Unless the task concerns the document, my advice is to leave it out. When a copy must go to a person, a watermark naming the recipient limits reuse, as with stamping an Irish passport card copy.

Money follows the same logic. An IBAN or account number belongs to someone, and a bank export names the other party on every line, which is why masking a CSV statement goes column by column. Keep an amount only when the sum is the question.

Fixed formats are what software spots best. The box below checks an invented signature block in your browser; edit it or paste your own. Look at what it lists and at what it passes over: the first line, which identifies her better than anything else, goes unflagged.

Quasi-identifiers: when ordinary details add up to one person

Some details identify nobody alone and almost anybody together. NIST gives ZIP codes and dates of birth as data that can indirectly identify people or sharply narrow a dataset, and cites an MIT study in which 97% of names and addresses on a voting list were identifiable from ZIP code and date of birth.

Rulebooks answer by generalising. HIPAA’s Safe Harbor method keeps only the year of dates tied to a patient, and the first three ZIP digits only where that area holds more than 20,000 people. Spreadsheets need the same move per column: banding ages and postcodes in Excel.

In prose the trap reads “the only woman driving a forklift at the Saltrey depot”: no name, one person. I prefer to generalise the one detail the task needs least, since blurring all three wrecks the prompt. Small places shrink the crowd fastest, which our page for Irish council staff keeps in view.

Sensitive information: special categories and their equivalents

Every regime marks some data as more harmful to expose. GDPR Article 9 lists racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify someone, health, and sex life or sexual orientation. Criminal convictions sit apart, in Article 10.

Australia’s Privacy Act calls it sensitive information, and the OAIC’s list adds criminal record. The US has no single list: health records fall under HIPAA, and NIST rates Social Security numbers, medical history and account data as more sensitive fields. Our Irish page on Article 9 data traces the categories through office paperwork.

Here the sensitive detail is often why you are writing the prompt: a return-to-work letter needs the injury. I’m comfortable leaving a diagnosis in once nothing around it points back to the patient. General practice lives with this on every referral, the subject of patient data and AI in an Irish practice.

Third parties: witnesses, relatives and colleagues in the text

A file about one client names plenty of other people: a former employer, a witness, a partner, a child, a colleague who complained. Each is protected in their own right, and none agreed to anything. Even the AI clause an Irish firm puts in its engagement letter speaks only for the client who signed it.

Rulebooks expect this. HIPAA’s Safe Harbor list covers identifiers of the patient’s relatives, employers and household members as well as the patient’s own. Under GDPR Article 15(4), giving someone a copy of their data must not adversely affect others, and that is the case the DPC’s redaction note was written for.

Roles beat blanks. [CLAIMANT], [WITNESS 1] and [MANAGER] keep a chronology readable. Fix the labels once per matter so every paste uses the same ones; that consistency matters more to me than the labels you pick. Court papers bring duties of their own, such as the Irish High Court’s AI declaration.

Where personal details hide in everyday files

Reference numbers feel internal, which is exactly the risk. The EDPB’s guide for small businesses counts a client number or a booking reference as personal data, and a claim or case number exists to open one person’s record. None of them improves a summary, so they go.

IP addresses belong here too. The GDPR’s Recital 30 names them, with cookie identifiers, among online identifiers that can be used to profile and identify people. A pasted server log hands over every one, and what OpenAI does with the text you type depends on the account.

Pick your kind of file below. The entries I’d test first are reference numbers: they survive quick redaction passes because nobody reads them as personal.

Metadata, comments and the data you can’t see on screen

A file carries more than its visible text. The DPC’s note lists hidden columns and worksheets, revision histories and comments, file properties holding the author’s name and dates, and email metadata showing sender, recipients, times and even the sender’s IP address. Stripping author names and dates from PDF and Word covers the properties.

Photos add a layer: the same note mentions phones and cameras recording the date, time, place and the username of whoever took the picture. Pasting plain text sidesteps most of this; uploading the file brings it along. Settle tracked changes and comments in Word before anything else.

Recolouring text is not redaction either. The DPC warns that text hidden by highlighting or a change of colour can still be copied out as plain text, even after export to PDF. I’d insist on a select-all and paste into a blank file before trusting any redaction; the PDF redaction steps include that test.

What can stay, and why over-redacting backfires

Data minimisation cuts both ways. GDPR Article 5(1)(c) asks for data that is adequate, relevant and limited to what is necessary. Adequate matters: strip a lease dispute of its dates, sums and clauses and the model has nothing left to work on.

Over-redaction has a second cost. A page of black bars teaches staff that the safe version is useless, so next time they paste the original. For me, a labelled document with its facts intact beats a perfect blackout nobody uses. Where a file carries legal risk, have someone qualified read the redacted version first.

Some tasks need the identifier itself, such as reconciling an account number. Those belong in systems built for the job, or on a model running on your own hardware.

Tools that keep originals to restore them later deserve a question about where those copies sit, as with the vault LLM Guard used.

Choosing the assistant is a separate decision from cleaning the text; for firms in Ireland, an assistant-by-assistant GDPR comparison takes it up.

Putting the list to work on your next paste

A list helps only if it runs every time, so write it down in a template for your office’s AI rules. For text you have now, the box at the top of this page covers names, ID numbers, addresses and contact details, then hands back a redacted copy. We don’t keep it.

For daily work, the Nonimo app on a Mac or Windows PC swaps those details for labels on your own computer before ChatGPT, Claude or Copilot sees them, then restores them in the answer. The Nonimo home page has the download; the next file headed for an AI tool makes a fair first test.

We ran an invented Irish occupational health referral through the app on 6 October 2026. It labelled the name, PPS number, address with Eircode, passport and driver numbers, IBAN and hospital number. Job, workplace and date were left for a person to judge, which I think is the right split.

Teams sending documents through the OpenAI API can mask them before the request leaves their network.

Sources

• GDPR, Regulation (EU) 2016/679 (EUR-Lex): Article 4(1) definition, Article 5(1)(c) data minimisation, Articles 9 and 10, Article 15(4), Recitals 26 and 30 on identifiability and IP addresses.
• NIST SP 800-122, Guide to Protecting the Confidentiality of PII: PII definition, linked and linkable information, ZIP code and date of birth, the 97% voting-list study.
• California Consumer Privacy Act, as posted by the CPPA (PDF), effective 1 January 2025: Civil Code 1798.140(v), the definition of personal information, including households and AI systems.
• EDPB, Data protection basics for SMEs: examples of personal data, including reference numbers and photos; special categories.
• OAIC, What is personal information?: reasonably identifiable test; IP addresses; the sensitive information list, including criminal record.
• 45 CFR 164.514, HIPAA de-identification (eCFR): Safe Harbor identifiers, including those of relatives, employers and household members; year-only dates; three-digit ZIP rule.
• Data Protection Commission (Ireland), Redacting documents and records: search limits, one person named several ways, hidden content and metadata, recoloured text, work on a copy.

Accessed 10 November 2026.