How to anonymize data before using ChatGPT
Replace every detail that points to a person before the text goes in: names, addresses, account numbers, dates of birth, plus the quieter clues like job titles and unusual amounts. Use consistent placeholders (the same client is always Client_A), keep the mapping somewhere the chat can never see, and reread the result once before sending. That is the whole method. One caveat first, because it changes your legal position: what you are actually doing is called pseudonymization.
Placeholders are pseudonymization, not anonymization
Under GDPR, data only counts as anonymous when nobody can link it back to a person with reasonably available means. If a mapping file exists that says Client_A is a specific person, the link exists, so your masked text is pseudonymized personal data. GDPR names pseudonymization as a recognized safeguard, but the data stays personal data and your obligations stay attached to it.
That does not make the technique less useful. It changes what you can claim afterwards. So keep the claim narrow. The provider only ever saw placeholders. Processing still happened on personal data, just in masked form. Since even the masked text still reaches a provider, it also pays to pick one of the AI tools that don't train on your data.
The manual method, step by step
- List the direct identifiers. Go through the text and mark everything that names a person outright: full names, street addresses, email addresses, phone numbers, IBANs and account numbers, dates of birth, customer and case numbers.
- Then list the indirect ones. Job titles, place names, company names, dates of specific events, unique amounts. An invoice sum or a salary figure can identify a client as reliably as a name does.
- Replace consistently. The same client is always Client_A, the same bank always Bank_1, everywhere in the text. If Anna Meier is Client_A in one paragraph and Person_X in the next, the model treats them as two people and its answer degrades. Consistency is what keeps the output usable: when the reply comes back, you map Client_A back to the real name and the advice still fits.
- Keep the mapping outside the chat. A note on paper or a local file is fine, as long as it never enters the prompt. Pasting "Client_A = Anna Meier" into the same conversation undoes the entire exercise.
- Reread once before sending. Context identifies people too. "The head of surgery in a small Alpine town" contains no name and is still identifiable to anyone who knows the region. Read the masked text the way a stranger would, and check what that stranger could work out.
Where manual masking breaks down
For one email or one contract clause, this works well. At volume it stops working. Masking by hand is tedious, so under deadline pressure people skip it. It is error-prone: one IBAN missed in fifty documents is still a leak, and the failure is silent, you find out late or never.
Indirect identifiers are the hardest part. A human skims past the very detail that makes a text identifiable, because to the person doing the masking it reads as harmless background. If something has already slipped through, here is what to do when you have accidentally pasted client data into ChatGPT.
The practical rule: when masking turns from an occasional care into a routine chore, automate it. Machines are bad at judgment but good at not getting bored on document forty-seven.
How Cedreon approaches this
Cedreon, an AI workspace for sensitive data developed in Switzerland, automates exactly the workflow above. Before any text leaves for the model provider, it screens the prompt: names, IBANs, addresses and other identifiers are found through pattern matching plus layered best-effort machine detection, and replaced with placeholders. The originals stay in an encrypted vault on Cedreon's side, and the model's reply is filled back in for the signed-in user. You read the real names; the provider never sees them. Every exchange lands in an append-only, hash-chained audit log, so a firm can show afterwards exactly what left the house and what was replaced first.
The caveat from the top still applies. Detection can miss identifiers, and the masked text is still pseudonymized personal data. Both are reasons to keep the step 5 reread. Try Cedreon free to see what the masking catches on your own text.
Common questions
- Does ChatGPT Enterprise mean I don't need to mask data first?
- Under the provider's current terms, Enterprise and API prompts are generally not used for training by default, but the text still leaves your systems and reaches a provider outside your control. A no-training promise controls retention and reuse. It does not stop the names, IBANs and addresses from being sent in the first place. Masking those identifiers before the text is sent reduces what the provider ever receives, on any plan.
- Is pseudonymized data still covered by GDPR?
- Yes. Because pseudonymized data can be linked back to a person, it still counts as personal data and stays subject to the regulation. Only anonymization that is genuinely irreversible falls outside its scope, and a reversible placeholder swap is not irreversible anonymization. So keep handling masked prompts under the same rules as any other personal data.
- How do I read ChatGPT's answer if it comes back full of placeholders?
- With manual masking you get the placeholders back in the reply and have to swap each one for the real value yourself, which is slow and easy to get wrong on long answers. Keep a private mapping of each placeholder to its original so you can restore the text after the model responds, and never store that mapping next to the shared prompt. In Cedreon the reply is filled back in automatically for the signed-in user, while the provider only ever received the placeholders that Cedreon substituted for the identifiers it detected and replaced.