How to anonymise data before ChatGPT (and why you are really pseudonymising)

Can you really anonymise data before ChatGPT?

Usually not, and what you do instead is pseudonymisation. Many people search for "anonymise data before ChatGPT", but the practical method replaces every detail that points to a particular person with a placeholder and keeps the mapping separately. The GDPR describes that as processing in which the data can no longer be attributed to a data subject without additional information that is kept separately (Art. 4(5)).^[1] The text leaving your computer contains "[PERSON_1]" instead of a name. The list saying who "[PERSON_1]" is stays with you.

Why bother? The data minimisation principle requires that you process only data that is adequate, relevant and limited to what is necessary for the purpose (Art. 5(1)(c)).^[6] For most tasks, such as drafting a reply or summarising a contract, the AI does not need the name. The Hamburg data protection authority advises against entering personal data where the provider may use inputs for its own purposes.^[4] Which plans that concerns is covered in Is ChatGPT GDPR compliant?

Where does the prompt go, and why does the moment before sending matter?

When you press send, the text leaves your computer for the provider’s servers, possibly passing further processors, and possibly a country other than your own. You cannot observe where it is processed or stored afterwards. What you have is the provider’s documentation and, on business plans, a contract. Those commitments come with documented exceptions, for example that data residency is storage at rest for eligible customers and not a promise about every processing step. And what has been sent cannot be recalled: deleting a chat or switching a setting off acts on the future, not on the text already transmitted.

That is why the method on this page comes before sending, not after. It is the one point at which you decide with your own means what the provider receives. Replace what the task does not need, and the question where the rest ends up matters less, because less is exposed to it. It does not make the question disappear: contract, legal basis and plan still have to be right. The wider picture is in where your data goes when you use an AI assistant.

How do you pseudonymise a prompt in six steps?

The method works by hand with a text editor. It pays off for short texts; for many or long documents it is error-prone. For software support see the comparison of approaches.

1. Clarify the purpose. What should the AI do? Note which details it really needs. Delete everything else rather than replacing it.
2. Mark everything identifying. Go through the text with the table further down: direct identifiers and quasi-identifiers.
3. Assign placeholders. One numbered placeholder per person, organisation and identifier, the same one everywhere. If the same person gets two placeholders, the connection breaks.
4. Store the mapping table locally. Placeholders and real values in a file that never reaches the chat, ideally in a folder with restricted access. This is the "key".
5. Check and send. Read the swapped text once in full, using the checklist below. Use your editor's search for name parts, place names and numbers.
6. Swap the answer back. Replace every placeholder in the reply with the real value and read the result before you pass it on.

What does it look like on a worked example?

The example is invented. A customer service employee wants a polite reply to a complaint drafted.

1. Original prompt (do not send it like this)

Write a friendly reply to Clara Whitfield (clara.whitfield@example.com). She has been head of group audit at Brandt Drive Systems GmbH in Wuppertal since 2019 and on 14 March 2026 disputed invoice INV-2026-0417 for EUR 48,350.00 because two deliveries are missing. The credit note goes to account DE89 3704 0044 0532 0130 00. Signed: Tom Fielding, customer service.

2. Pseudonymised prompt (send this)

Write a friendly reply to [PERSON_1] ([EMAIL_1]). She heads a department at [COMPANY_1] and in mid-[MONTH_1] disputed an invoice ([INVOICE_1]) for a five-figure amount because two deliveries are missing. The credit note goes to account [IBAN_1]. Signed: [PERSON_2], customer service.

Note what was deleted or made coarser: the place is gone, the job title is more general, the date is a month, the amount an order of magnitude. The AI can still write the reply.

3. The AI's answer, restored

AI answer (with placeholders): "Dear [PERSON_1], thank you for your message about [INVOICE_1]. We are sorry that two deliveries are missing and will issue the credit note to account [IBAN_1]. Kind regards, [PERSON_2]"

After swapping back: "Dear Clara Whitfield, thank you for your message about INV-2026-0417. We are sorry that two deliveries are missing and will issue the credit note to account DE89 3704 0044 0532 0130 00. Kind regards, Tom Fielding"

Watch salutation and grammar when you swap back: a placeholder knows nothing about gender, title or case. "Dear Clara Whitfield" is what the swap produces; "Dear Ms Whitfield" and the right form of address are yours to add.

Why is replacing names often not enough?

Because combinations of details can identify a person even without a name. The German Data Protection Conference (DSK) states that removing names and addresses regularly does not suffice, because the context can still make the person identifiable.^[3] The Hamburg authority also points out that leaving out names is not always enough.^[4] The yardstick is whether a person can be identified by means reasonably likely to be used.^[2]

These quasi-identifiers are the ones that slip through most often in daily work:

Which checklist do you use before sending?

For its own profession the German Federal Chamber of Tax Advisers advises making sure, before an upload, that no page of a document still shows name, address or tax number.^[5] The same applies, by analogy, to every file.

Placeholders or realistic substitute names: which is better?

Both work, with different drawbacks. Square-bracket placeholders such as "[PERSON_1]" are unambiguous, easy to find when you swap back, and nobody mistakes them for real names. The AI sometimes treats them as foreign bodies, though: it drops them, pluralises them or fails to inflect them. Invented, realistic names ("Maria Kessler" instead of "[PERSON_1]") read more naturally and keep the grammar intact. In return you must make sure the substitute is not by chance the name of a real person in your circle, and you must keep the mapping even more carefully.

For manual work, placeholders are the better choice. Pick labels that show the role (PERSON, COMPANY, IBAN) so the AI knows what it is dealing with, and number them. Add a sentence to the task such as "Please keep the placeholders in square brackets unchanged." That reduces failures but does not prevent them.

What should you check in the restored answer?

An answer is not correct just because it looks clean. Check three things before you use it:

• Missing or altered placeholders. Search for square brackets. If a placeholder is gone or spelled differently, it was altered and the automatic swap does not catch it.
• Invented details. Language models like to add details. An invented deadline or name will look like a real one after the swap.
• Salutation. Gender, title and case are yours to add.

The same holds for files the AI returns (Word, PDF, spreadsheets), only harder: placeholders can sit in headers, table cells or text boxes and be missed during the swap. Open the finished file and search for leftovers.

What are the limits of this method?

What is the next step?

Practise the method first on ten invented texts and have a second person read them. If you need it often, software that shows its matches and lets you confirm each replacement can help. Which approaches exist and how to test them is in the comparison of approaches; the technical background is in PII redaction for LLM prompts. Ainym is a browser extension in closed beta with pilot teams that detects on the user's own device and shows each match for confirmation before sending. If your team also needs written rules, start with the AI acceptable use policy template.

This article is general information and not legal advice. It does not replace an assessment of your own case by your data protection officer or a lawyer. Last updated: 13 November 2026.