How to Anonymize Data Before Sending It to ChatGPT or Claude
Short answer
To anonymize data before sending it to ChatGPT or Claude, remove or replace direct identifiers (names, emails, phone numbers, IDs) and indirect ones (rare job titles, exact dates, locations) locally, before the text leaves your device, then check the result before pasting. Replacing identifiers with consistent placeholders such as [PERSON_1] keeps the text useful for the model.
Pasting a customer email, a contract or an HR note into ChatGPT or Claude is fast and often genuinely useful. It is also one of the most common ways personal data ends up with a third party without a documented legal basis. The fix is not to ban AI tools but to make anonymization a normal step before the paste. This guide shows what to remove, which methods work and how to turn it into a habit for a whole team.
Anonymization vs. pseudonymization: why the difference matters
Anonymization means a person can no longer be identified by any means reasonably likely to be used. Truly anonymized data falls outside the GDPR. Pseudonymization replaces identifiers with placeholders but keeps a key that allows re-identification; the data stays personal data under the GDPR, although the risk drops considerably.
For prompts, a practical approach is to pseudonymize locally (keeping the key on your own device), send only the placeholder version to the model, and re-insert real names into the answer afterwards. The model provider never sees the key.
What counts as identifying in a prompt
Most people remember names and email addresses. These are easier to miss:
| Type | Examples | Why it identifies |
|---|---|---|
| Direct identifiers | Names, emails, phone numbers, addresses, IBANs, customer and employee numbers, license plates | Point to one person on their own |
| Online identifiers | Usernames, IP addresses, device IDs, profile URLs | Can be linked to a person with other data |
| Quasi-identifiers | Exact birth dates, rare job titles, small towns, unusual events ("the only female site manager in the Berlin branch") | Identify in combination, especially in small groups |
| Special categories | Health details, religion, union membership, sexual orientation | Highly sensitive even when the person is only indirectly identifiable |
| Third parties in the text | Colleagues, family members, signatures, CC lines | Often overlooked because they are not the "subject" of the document |
Five methods compared
| Method | Strengths | Weaknesses | Good for |
|---|---|---|---|
| Manual redaction | No tools needed, human judgment for context | Slow, inconsistent, misses things when people are tired | Occasional single documents |
| Find-and-replace / regex | Reliable for structured patterns like emails, IBANs, phone numbers | Does not catch names or context-dependent identifiers | A first pass in scripts and pipelines |
| Named entity recognition (NER) libraries | Detects names, organizations, locations automatically | Quality varies by language and domain; needs developer setup | Engineering teams building pipelines |
| Cloud anonymization APIs | Easy to integrate, broad entity coverage | Sends raw data to yet another third party first | Cases where that provider is already approved |
| Local AI anonymization | Context-aware detection, raw data never leaves the device | Depends on local hardware; output still needs a quick check | Everyday use by non-technical staff |
Local, context-aware tools are the most practical option for knowledge workers. Textwash Pro, for example, runs fully offline on the device, was built with researchers from UCL, and can also act as a privacy layer in front of ChatGPT, Claude and similar tools.
A repeatable workflow in six steps
- Ask whether the task needs the real data at all. To rewrite a complaint politely, the model does not need the customer's name or order number.
- Copy only the relevant part. Remove signatures, email threads, headers and attachments that are not needed for the task.
- Run anonymization locally. Use a tool or script on your own machine, not a web form.
- Use consistent placeholders. Replace "Anna Becker" with [PERSON_1] everywhere, and her manager with [PERSON_2]. Consistency lets the model follow who did what; random blacking-out destroys meaning.
- Read the result once. Check specifically for quasi-identifiers and third parties. Generalize where needed: "a city in southern Germany" instead of a village name, "in her forties" instead of a birth date.
- Re-identify only locally. Put the real names back into the model's answer on your own device, if needed at all.
Common mistakes
- Trusting "we turned off training." Disabling model training in a chat tool is useful, but it does not remove the need for a legal basis, nor does it mean the provider stores nothing.
- Forgetting file uploads. PDFs and spreadsheets uploaded to a chat contain the same personal data, plus metadata such as author names.
- Anonymizing the question but not the context. Custom instructions, project knowledge and long-term memory features can hold personal data too.
- Over-redacting. If you remove every noun, the model cannot help. Replace with meaningful placeholders instead.
- No team rule. One careful employee does not make an organization compliant. Write a one-page policy: which tools are approved, which data classes may never be pasted, and which anonymization step is mandatory.
For developers: putting anonymization into the pipeline
If your product sends user data to an LLM API, build anonymization into the request path rather than relying on users. Typical design: a pre-processing service detects and replaces entities, stores the mapping in your own database with a short retention period, sends the placeholder text to the model and re-inserts entities in the response. Log the placeholder version, not the raw input. Our GDPR checklist for AI product teams covers the surrounding obligations, and security risks of agentic coding explains why source code and secrets deserve the same care when coding agents are involved.
For training a team on safe everyday AI use, workshops from neooutput cover data handling alongside prompting. To discuss a privacy layer for your own setup, you can book a free intro call.
Frequently asked questions
Is it enough to delete names before using ChatGPT?
Usually not. Emails, phone numbers, customer IDs, exact dates, rare job titles and locations can still identify a person, especially in combination. Check for indirect identifiers and third parties as well.
Does ChatGPT or Claude anonymize my data automatically?
No. These tools process what you send them. Some business plans exclude training on your data and offer retention controls, but removing personal data before sending is your responsibility.
Is pseudonymized data still covered by the GDPR?
Yes. As long as a key exists that allows re-identification, the data remains personal data. Keeping that key only on your own device still substantially reduces what the model provider receives.
Can I anonymize data without sending it to another cloud service?
Yes. Regex scripts, local NER libraries and offline tools run entirely on your own machine, so raw data never leaves your environment before anonymization.
Want a second opinion on your project?
Book a free 30-minute call with our team. We look at your idea, prototype or app and tell you honestly which route makes sense – whether you work with us or not.
Book a free call or write to [email protected]