PII masking tools for AI chats: five approaches compared, with a buyer's checklist and a ten-sentence test

Which approaches exist for masking data before an AI chat?

Five categories cover most of what is on offer. All of them replace details in the text before it leaves your computer or your company network. Most keep the mapping so the answer can be swapped back, which makes them pseudonymising tools only: the data stays personal data for the key holder, as explained in pseudonymisation vs anonymisation.^[6] This comparison rates no products and quotes no detection rates. It shows the criteria by which you can examine any tool. The GDPR names pseudonymisation as an example of a security measure that must be appropriate to the risk (Art. 32(1)(a)).^[5]

The table describes typical properties of a category, not of any one product. Individual products can differ. Put the questions below to every vendor.

What is Microsoft Presidio, and who is it for?

Presidio is an open-source project. Its README describes it as a context-aware, pluggable and customisable PII de-identification service for text and images, with modules for detecting and replacing details such as credit card numbers and names, and it is released under the MIT licence.^[1] It is aimed at developers who build detection into their own systems. The README itself warns that, because detection is automated, Presidio cannot be relied on to find all sensitive information, and recommends additional systems and protections.^[1] That caution applies to every method of this kind. If you do not plan to build anything, you need a finished solution; if you do, libraries like this are a foundation. For the technical side, see PII redaction for LLM prompts.

When does a gateway or proxy make sense?

When many applications or automations talk to AI services through one central point. The gateway replaces details in each request before it reaches the provider. Detection runs on a server, so the plain text leaves the browser or application. That is less of a problem if the server is under your control. If you commission a service provider, it will generally act as a processor, and you need the Art. 28 GDPR contract, which among other things regulates processing only on documented instructions.^[4] For individual employees working in the browser a gateway is usually too heavy.

What do browser extensions and enterprise DLP offer?

Browser extensions work directly in the chat window. That is convenient, but to do it the extension reads page content, so examine permissions and data flow closely. One example of this category is Ainym, a browser extension in closed beta with pilot teams that detects on the user's own device and shows each match for confirmation before anything is sent; the same criteria apply to it as to any other.

Enterprise DLP (data loss prevention) monitors data outflows according to rules. It is strong with identification numbers and fixed patterns and presupposes a central policy. It often blocks or redacts rather than pseudonymising and restoring. That protects, but it takes the context away from the AI. Whether that is enough for your tasks is what the self-test below shows.

Why does masking before sending matter at all?

Because it is the only step in the chain you control with your own means. After a prompt has been sent, you cannot observe where the provider processes or stores it. You have its documentation and contract, those commitments come with documented exceptions, and a processor may engage further processors, so you deal with a chain rather than one company.^[4] What has been sent cannot be recalled. Masking tools differ in many ways, but they all act at this one point: they reduce what leaves the device, in line with data minimisation^[7] and with pseudonymisation as a named security measure^[5].

That gives you a sober way to judge a tool. Ask what it removes before sending, not what it promises afterwards, and whether you can see each replacement. A masking tool does not replace the contract with the AI provider, the legal basis or the human check, and none finds everything. For the provider side, see where your data goes when you use an AI assistant.

What should be on a buyer's checklist?

The German supervisory authorities advise giving staff business accounts and choosing settings so that inputs are not used for training.^[2][3] A masking tool complements this; it does not replace it. For the plan and contract side of ChatGPT see Is ChatGPT GDPR compliant?

How do I test a tool with ten sentences of my own?

Write ten invented sentences that are typical of your work, using only made-up people. Mix easy and hard cases:

1. Simple details. One sentence with a name, an e-mail address and a phone number.
2. Identifiers. One sentence with a fictitious IBAN such as "DE89 3704 0044 0532 0130 00", a tax number and a customer number.
3. Names in running text. One sentence with a surname that is also a word (such as "Ms Winter" or "Mr Hill") and a short form ("Mr F.").
4. Local quirks. Umlauts, double-barrelled names, noble titles, "Dr Meier-Schulte".
5. Addresses. Street with house number, postcode and town, also abbreviated ("High St. 5").
6. Companies and roles. One sentence with a fictitious company and a rare job title.
7. Dates and amounts. One sentence with a date of birth, an invoice date and an odd amount.
8. Special categories. One sentence about an illness of an invented person.
9. False positives. One sentence with no personal reference but words such as "Rose", "Berlin" or "Nelson".
10. A file. The same details in a Word or PDF file, including header and comment.

For each sentence count three things: what was not detected, what was replaced unnecessarily, and whether the answer came back with the right real values. Use a simple score sheet and note the date:

Repeat the test when the version changes. The result holds for your sentences and does not tell you how the tool performs on other texts.

Which mistakes happen when choosing a tool?

• Asking about the promise instead of the data flow. Statements like "everything stays local" are vendor claims. Check them in your browser's network traffic or have your IT check where data goes.
• Testing only on identifiers. IBANs and card numbers follow fixed patterns and are easy to find. Names in running text, addresses and job titles are harder.
• Forgetting the restore step. A tool that only redacts often makes the answer unusable. Check whether that is enough for your tasks.
• Forgetting files. A solution that works in the chat box says nothing about Word, PDF or spreadsheets.
• No visual review. A tool that replaces without asking allows no correction. Mistakes go unnoticed.
• Never re-testing. Models and rules change with updates. Repeat the test with every major version.

How do I roll a tool out in a team?

Start with a small group and clear rules. Define which tasks the tool is for, who may manage the mapping tables, and what must never go into a chat even with the tool, such as special categories under Art. 9 GDPR without sign-off from the data protection officer. Involve the works council or staff representatives early if employees will use the tool; the German supervisory authorities recommend clear rules for this, in some cases with co-determination.^[2] After four weeks collect the cases where the tool missed something or replaced too much, and adjust your rules. Document your tests, because as controller you must be able to demonstrate compliance with the data protection principles (Art. 5(2) GDPR).^[7]

What is the next step?

Write down your requirements before you talk to vendors: local or server, files yes or no, restore yes or no. Practise the basic method in the step-by-step guide, so you know what a tool is supposed to take off your hands. If you want written rules for the team as well, use the AI acceptable use policy template. This text is general information, not legal advice.

This article is general information and not legal advice. It does not replace an assessment of your own case by your data protection officer or a lawyer. Last updated: 13 November 2026.