Can you ask an AI to anonymize a document?

What happens to a document sent to an AI for anonymization?

It reaches the provider as is; the provider receives it, processes it and keeps it for a while. Asking “replace every name with a pseudonym” changes nothing about what was sent: the instruction runs on the provider’s servers, after the transfer. Under the GDPR, you have disclosed personal data to a third party; under professional secrecy rules, you have handed the file to someone who is not bound by them.

What the provider does next depends on the plan. At OpenAI, according to its help pages as checked on October 20, 2026:

• a saved conversation stays in the account until deleted; once deleted, it is scheduled for permanent deletion within 30 days, unless it was already de-identified or security or legal obligations require keeping it longer;
• a temporary chat does not appear in your history, but OpenAI may keep a copy for up to 30 days for safety purposes;
• on individual plans (Free, Plus, Pro), content may be used to train models unless “Improve the model for everyone” is turned off, and a thumbs up or down makes the whole conversation usable for training, even after opting out;
• on ChatGPT Business, Enterprise, Edu and the API, inputs and outputs are not used for training by default.

Those commitments concern reuse, not transmission. The CNIL is clear about consumer services: users should never share confidential information such as personal data. The French national bar council (CNB) recommends limiting what you give the tool to the data strictly necessary for the task. A document sent to be anonymized contains, by definition, every piece of data that had to come out. Plan by plan: ChatGPT and GDPR: can you put client data into it?

Does an AI find every name?

Nothing guarantees it. A language model generates text probabilistically; the CNIL notes in its Q&A on generative AI that these systems can produce inaccurate results that nonetheless look plausible. For anonymization, the risk takes several forms:

• Silent misses. A capitalized name in a header, an initial (“Ms. V.”), an address in a footnote, a number in a table: nothing tells you it was left in.
• Inconsistent substitutes. “Claire Vasseur” becomes “Person A” on page 2 and “Ms. X” on page 9, or two people get the same pseudonym. The AI’s answer becomes ambiguous, and the real names can no longer be restored without errors.
• Rewritten text. The AI returns new text, not your edited file: it may rephrase a sentence, round a figure or drop a paragraph. You then have to compare it line by line with the original.
• No evidence. You have no list of what was replaced and nothing to show a client, a DPO or an auditor.

Then there are indirect identifiers: a unique job title, a date and a place, an amount to the cent. Even perfect name detection does not remove them; review does. More on this: re-identification risk.

Who keeps the mapping between real names and substitutes?

What people usually want from “anonymization” before AI is actually pseudonymization: replace “Claire Vasseur” with [PERSONNE_1] so the AI can work, then put the real name back into its answer. That requires a mapping table. The GDPR requires this “additional information” to be kept separately and protected (Article 4(5)), and the European Data Protection Board (EDPB) states that lookup tables are themselves personal data, since they allow people to be identified, and must be protected against unauthorized access and use (Guidelines 01/2025, paragraph 93).

When the AI does the substitution, that table lives in the conversation, next to the original, with the provider: precisely the party that was not supposed to be able to make the link. And to restore the real names in a later answer, you either send the table back or do the replacements by hand. The whole point of pseudonymization, keeping the key apart from the data, is lost. The principle and good practice: the pseudonymization mapping table.

What about a model installed on your computer?

The question changes, and this is the right direction. A language model running on your machine or on in-house servers sends nothing to a third party. The CNIL considers on-premises solutions generally more appropriate and more secure when client or staff data is involved, and the CNB guide lists, among confidentiality measures, prior anonymization or pseudonymization of the data and installing the model on the firm’s own information systems.

But a local model is still a generative model: the same possible misses, the same inconsistent substitutes, the same rewritten text. You also have to install it, give it a powerful enough machine, convert PDFs and scans to text, and manage the mapping table yourself. It solves sending, not completeness or traceability. Used on its own, it does not spare you a review of every document.

Online AI, local model or local anonymizer: which to choose?

The last column describes what AnonymFiles does; other local tools exist, and our comparison of anonymization software reviews them. Generative AI keeps its full role after this step: it is the tool you give the copy to for summarizing, rewording or comparing.

Which method should you use?

1. Decide what needs to go. To summarize a contract or reword a letter, the AI needs no names: that is the data minimization principle (Article 5(1)(c) GDPR).
2. Replace identifiers on your computer. Names, organizations, addresses, emails, phone numbers, IBANs, ID numbers, with stable labels rather than made-up names: [PERSONNE_1] is easy to spot and replace without ambiguity.
3. Review next to the original. Look for indirect identifiers: an amount, a job title, a case reference.
4. Send the copy, and only the copy. Preferably on a business plan, to limit reuse.
5. Check the answer. Figures, dates and references need checking.
6. Put the real names back on your computer. The mapping table never leaves; the final answer, with names, exists only on your side.

An illustrated walkthrough: pseudonymize a document for AI, then restore the real names and anonymize a document before ChatGPT.

How does AnonymFiles do it?

AnonymFiles is a local anonymizer, not an AI assistant: it calls no AI service and sends no document. Detection relies on two detection models running on the computer (OpenAI Privacy Filter and a multilingual named-entity recognition model), backed by rules for emails, phone numbers, IBANs and French identifiers. These models find and classify passages; they do not generate text and do not rewrite the document.

• A whole folder, every format: Word, text or scanned PDFs (local OCR), emails with their attachments, spreadsheets, presentations.
• One person, one label: “Mme Vasseur,” “C. Vasseur” and “Claire Vasseur” become the same [PERSONNE_1] across all documents, and the label can be renamed ([CLIENT_1], [PERSONNE_JACK]).
• Mandatory review: the copy is shown next to the original, nothing is exported until each document is approved, and an indicator flags re-identification risks.
• A mapping that stays put: the table is encrypted (AES-256-GCM) on the computer and appears in no export. “Copy for the AI” puts the copy on the clipboard; the AI’s answer, pasted back into the app, gets its real names back, as text, Word or PDF.
• A connector for local assistants: off by default, it lets Claude Desktop, Claude Code, Cursor or other MCP clients read a file on the computer, but only in redacted or pseudonymized form, with each request subject to your approval. See the MCP connector.

Like any automatic detection, it can miss something: that is why review is mandatory, not optional. To check the offline behavior yourself: detection benchmark and offline test; what the app does on the network: security; uses by profession: use cases.