Anonymize a CV, a SIRET number or an interview transcript before using AI

Why anonymize a CV, a SIRET number or a transcript before using AI?

Because each of these documents identifies someone in its own way, and none of them says so up front. A CV is a full identity sheet: name, address, phone, photo, age, career. An invoice or quote from a French sole trader carries a SIRET number that leads back to a natural person. An interview or meeting transcript attributes every sentence to a named participant and often reports what was said about people who weren't there.

The risky move is an ordinary one: pasting the document into an AI assistant to summarize a CV, compare applications or draft minutes. The company then hands personal data to a provider, and remains the controller under the GDPR (on plans and contracts: ChatGPT and GDPR). The question here: what should you remove, document by document, so the AI can work without knowing anyone?

What does the French Labour Code say about information requested from candidates?

Four articles in the "Recruitment" section of the Code du travail govern what a recruiter may collect and how candidates are assessed. They apply whatever the tool, AI included.

A word on the EU timeline: the Artificial Intelligence Act (Regulation 2024/1689) classifies AI systems intended for recruiting and selecting candidates as high-risk (Annex III, point 4). Regulation 2026/1744, the "Digital Omnibus on AI", pushed the application of the related obligations back to December 2, 2027 (Recital 40). Until then, the Labour Code and the GDPR are enough to call for caution.

What does the CNIL recommend for recruitment?

On January 30, 2023, the CNIL published a comprehensive recruitment guide in nineteen fact sheets (in French). Four points bear directly on AI use:

• Minimization. Only adequate, relevant and necessary information may be collected. The guide lists examples of what may not be asked: parents, siblings, political opinions, health, plans to have children or trade union membership. Asking for a candidate's place of residence is not lawful, except for on-call positions (sheet no. 1, p. 5).
• Automated decisions. Tools that sort, rank or assess applications may amount to a "fully automated decision", and the CNIL notes that such processes are in principle prohibited by the GDPR. A ranking tool whose top results are the only ones the recruiter reads may, in some cases, fall into that category (sheet no. 13, pp. 69-70).
• Transparency. Test and assessment results are themselves personal data, and "surprise" assessments do not comply (sheet no. 11, p. 61).
• Retention. Keeping CVs in a talent pool for five years is in principle excessive; the CNIL recommends no more than two years from the last contact (sheet no. 1, p. 5). A copy sent to an AI assistant that keeps its history escapes that schedule: one more reason to include no names.

In practice: an AI can help summarize a career, rephrase a job ad or prepare an interview grid. It must not decide on its own, and it never needs to know who the candidate is.

What should you remove from a CV before giving it to an AI?

Direct identifiers, obviously, but also whatever lets someone recognize the person by cross-referencing. A CFO position at a named company between two precise dates is often enough to find someone on a professional network.

Keep what serves the task: skills, the nature of assignments, durations, the type of employer ("an audit firm", "an industrial SME"). If you compare several candidates, consistent labels matter: [PERSONNE_1] must stay [PERSONNE_1] in the CV, the cover letter and the interview grid, or the AI will mix up profiles.

Is a SIRET number personal data?

It depends on whom it identifies. The SIRET is the 14-digit number INSEE (the French statistics office) assigns to each business establishment: the company's 9-digit SIREN followed by a 5-digit internal sequence number (the NIC).

• A company's SIRET is not personal data. The CNIL says so about e-invoicing: an invoice containing only company data (company name, address, switchboard number, generic contact email, SIREN or SIRET numbers) is not subject to the GDPR.
• A sole trader's SIRET is. In the same text, the CNIL specifies that information about natural persons who trade in their own name (sole traders, micro-entrepreneurs and self-employed professionals) is protected, and lists among it their name, first name, named work email, SIRET, SIREN, and business address if it is their home.

The difference is not theoretical: the number leads to the trader's name. The CNIL also notes that a sole trader can ask INSEE not to make their data in the Sirene register public. Many company documents carry these numbers: freelancers' invoices and quotes, service contracts, fee notes, supplier records, expense claims, subcontracting files.

Rule of thumb: mask every SIRET, SIREN or EU VAT number in a document meant for an AI by default. A large company's number almost never helps the analysis, and a self-employed person's is personal data. For professions bound by secrecy, a client company's name is covered anyway: see AI and professional secrecy.

How do you anonymize a meeting or interview transcript?

A transcript is the densest personal-data document you can give an AI. Each turn starts with the speaker's name; participants talk about absent colleagues, clients and personal situations. An annual review, a disciplinary meeting, an internal investigation or a meeting with occupational health can contain health data.

In Microsoft Teams, the meeting organizer and co-organizers can by default download the transcript as a .docx or .vtt file. Take the .docx: it's a format the local anonymizer handles, like .txt, Markdown or PDF. You can also paste the text straight into the app. Audio is not processed: transcribe first.

Five things to check when reviewing a transcript:

1. Speakers' names. They come back on every line. AnonymFiles links "Claire Vasseur", "Mme Vasseur", "VASSEUR Claire" and "Claire" alone to the same label when that is unambiguous.
2. Misspelled names. Speech recognition sometimes writes the same name three ways. A wrong spelling is a different string: check that each one is masked, and rename or merge labels if needed.
3. Third parties mentioned. The colleague being discussed, the client brought up, the doctor named.
4. Health data and personal situations. Sick leave, a disabled-worker status (RQTH in France), a family situation: the re-identification risk indicator flags them when they remain readable.
5. Telling details. A unique job title ("the head of the Lyon site"), a precise date, a small town: see re-identification risk.

Once the copy is approved, ask the AI for the summary, the list of decisions or draft minutes, then restore its answer: the real names come back on your computer.

What about HR spreadsheets: payroll, headcount, applicant tracking?

A payroll export or an applicant-tracking sheet is a file of people in columns. AnonymFiles recognizes columns by their header and masks them entirely. Name headers are matched in French and in English:

Outside columns, an announced employee number ("matricule : 4521") and a French social security number are masked by rule. The spreadsheet comes out in its own format: Excel stays Excel, CSV stays CSV. Amounts are not masked automatically: a salary to the cent can help identify someone, so select it if the analysis does not need it. Details: anonymize an Excel file.

How do you do it, step by step, with a local anonymizer?

1. Check the use is allowed. Internal AI policy, AI plan approved by the company, candidates informed if the AI takes part in assessment (Article L1221-8).
2. Drop in the documents. CVs, cover letters, interview grids, transcript, spreadsheet: the whole recruitment file at once, so labels stay consistent from one document to the next.
3. Let detection run on the computer. Names, organizations, addresses, emails, phone numbers, IBANs, dates of birth, labeled SIRET numbers, employee IDs and spreadsheet columns are found with no connection.
4. Review side by side. Original on the left, copy on the right; "What remains readable" flags anything that could still point to someone. Mask a photo, a profile link, a telling detail. Nothing is exported without your approval.
5. Send the copy to the AI. "Copy for the AI" puts the approved documents on the clipboard with a short instruction asking the AI to keep the labels.
6. Restore the answer. Paste the AI's answer: the real names replace the labels, as text, Word or PDF, on your computer. Then review what the AI wrote: it can be wrong.

What AnonymFiles does for HR teams

AnonymFiles is a local anonymizer: all processing happens on the computer, with no account, no telemetry and no call to any AI. It reads PDFs (scans included, through local OCR), Word, .eml and .msg emails with their attachments, Excel and CSV, PowerPoint, images and text. The mapping table linking [PERSONNE_1] to the real name is encrypted (AES-256-GCM) and never leaves the machine. To send a document rather than work with an AI, the "To send to someone" export produces redacted PDFs and Word files with the same layout and no software name on the files. The interface is available in English and French.

For HR-specific cases (recruitment, payroll, reviews, internal investigations), see AnonymFiles for HR. Pricing: €290 excl. VAT per seat per year, with a 14-day trial (pricing). How it works in detail: how it works and what the app does on the network.