Pseudonymize a document for AI, then put the real names back into the answer

Pseudonymize, anonymize, redact: what is the difference?

Pseudonymizing means replacing what identifies a person with a substitute, while keeping elsewhere the means to trace back to them. Under the GDPR (Article 4(5)), the data can then no longer be attributed to a specific person “without the use of additional information”, which must be “kept separately” and protected: here, the mapping table. The CNIL (the French data protection authority) adds that the operation “is also reversible, unlike anonymization”, and that the data “therefore remains personal data” (our translation). A pseudonymized copy is still subject to the GDPR.

Anonymizing means removing that way back: for the CNIL, making any identification impossible in practice, “by any means whatsoever and irreversibly” (our translation). No more table, so no more real names to put back into an answer.

Redacting means removing a passage without replacing it: it disappears from the copy or leaves a black block. Done properly, the text is deleted from the file, not covered (see redacting a PDF properly). The AI loses the information, and nothing allows it to be restored.

To get the names back after the AI, you therefore need to pseudonymize. The full comparison is in anonymization vs. pseudonymization: the difference under the GDPR.

Why use stable placeholders for AI?

Replacing every name with “XXX” protects people, but the AI no longer knows who ordered, who promised, who has to pay. A numbered, typed placeholder keeps these relationships: [PERSONNE_1] remains a person, [ORGANISATION_2] a company, each with its role from one sentence to the next. The AI can reason about who does what without knowing who is who.

The rule: the same person keeps the same placeholder in every document in the file. If Élise Garnier becomes [PERSONNE_1] in an email and [PERSONNE_3] in the contract, the AI reads two people. Variants follow the same rule: “Garnier”, “E. Garnier” and “GARNIER” must all become [PERSONNE_1].

A placeholder can also carry a role: [PERSONNE_CLIENTE] or [ORGANISATION_FOURNISSEUR] help the AI follow the file. Do not put initials or part of a name in it: the placeholder leaves with the copy. In AnonymFiles, placeholders are stable across the whole file; when a short name and a full name seem to refer to the same person, the app offers to merge their placeholders, and one click renames one. What to replace before sending is detailed in anonymize a document before sending it to ChatGPT.

What is reversible pseudonymization? The table stays with you

The mapping table links each placeholder to its real value: [PERSONNE_1] = Élise Garnier. It is what makes pseudonymization reversible, and it is as sensitive as the originals: it gathers all the names.

• It never leaves with the copy: not in the conversation, not as an attachment, not in the folder given to the AI. That is the condition set by the GDPR definition: information kept separately.
• Protect it like the original: on your computer, outside shared or synced folders, on an encrypted disk.
• Keep it as long as an answer has to come back: without it, there is no way to put the names back.

In AnonymFiles, the table stays in the app’s private space, on the computer, and is never included in the export. It is encrypted at rest (AES-256-GCM, with the key protected by the system keychain in the packaged app); also turn on disk encryption (FileVault on a Mac, BitLocker on Windows). Deleting the workspace also deletes the table, and re-injection then becomes impossible. See where your data stays and what the app does not send.

How do you pseudonymize a document by hand?

For a short document, a word processor (Find and Replace) and a mapping table kept separately are enough.

1. Work on a copy, never on the original.
2. Fill in the table before replacing: one row per person, company, address, email address, phone number or number, with its placeholder and all its spellings (initials, capitals, name without accents).
3. Replace the longest form first: “Élise Garnier” before “Garnier”. In the reverse order, you get “Élise [PERSONNE_1]”, and the first name stays visible.
4. Search for each name one last time, then review headers, footers, notes and signatures. The pitfalls specific to Word are in anonymize a Word document without putting it online.
5. On the way back, do the reverse: replace each placeholder in the answer with its value, searching for it with its brackets. Without brackets, “PERSONNE_1” also catches [PERSONNE_10].

On a whole file, three limits appear: variants (a spelling missing from the table leaves a name visible), oversights (a signature, an email address that contains the name) and re-injection (dozens of placeholders to replace one by one). And a placeholder altered by the AI, such as “Personne 1”, slips past the search without warning.

AnonymFiles, French document anonymization software (see our comparison of anonymization software), is a desktop app coming soon for Apple silicon Macs and Windows. It does this work on an entire folder of text or scanned PDFs, Word .docx files, emails, spreadsheets, presentations, images, .txt and .md files. It detects names of people, organizations, addresses, email addresses, French-format phone numbers, IBANs from nine European countries, private dates and ID numbers, and replaces them with stable placeholders. The copy of a Word document is a redacted .docx that keeps its layout; scans are read by local OCR. On a Mac, the models are included, with no connection at all; on Windows, they are downloaded once, at the first processing run, without any document text.

Which instruction keeps ChatGPT from changing the placeholders?

Without an instruction, nothing forces the AI to keep [PERSONNE_1] intact. Paste an instruction at the start of the conversation, before the documents. For example:

The reference avoids mixing up tables: from one file to another, [PERSONNE_1] does not refer to the same person. If you work by hand, make one up that says nothing about the client. Whether the instruction is followed depends on the tool: check the answer.

After the export, AnonymFiles provides a ready-made instruction: the “Copier la consigne IA” (copy the AI instruction) button copies the instructions to paste into the conversation, with the export reference, in the form [DOSSIER_…]. Examples of requests in a law firm are in ChatGPT and lawyers’ professional secrecy.

How do you put the real names back into ChatGPT’s answer?

To put the real names back into ChatGPT’s answer, replace each placeholder in the answer with the matching value from your table, on your computer: this is re-injection. That is the whole point of pseudonymization: the AI worked on placeholders, and you get back a text with the real names, which it never saw.

In AnonymFiles, “Réinjecter un résultat” (re-inject a result) accepts the AI’s answer pasted as is, or a .txt or .md file. The [DOSSIER_…] reference finds the right export’s table, even after a restart, without reopening the original folder. A preview shows the text with the real names; you then save it to a new file, on the computer. The replacement uses no model and no connection.

The limits to know:

• The font in a PDF. In a restored PDF, the value is rewritten in Helvetica, not in the original font; a Word document gets its style back.
• A single representative form. Each placeholder comes back as a single form of the name: “Garnier” and “Élise Garnier”, grouped under [PERSONNE_1], both come back as “Élise Garnier”, for example.
• Grammar is not adjusted. If the AI writes “a [ORGANISATION_1] representative”, the result says “a Atelier Boréal representative”. Articles and agreement are corrected during review.
• Checks, not a guarantee. A missing or unknown reference, or one that mixes several exports, blocks processing. An unknown placeholder, or a modified form recognized as “[PERSONNE 1]”, is flagged without the app guessing its content. But these checks catch neither every rewording nor a placeholder assigned to the wrong person: review the preview.

The full process is described in how AnonymFiles puts the real names back, step by step.

A full example, from the original to the answer

A fictitious two-document file, to prepare a formal notice; everything in it is made up.

1. The original

2. The pseudonymized copy

“Garnier” alone received the placeholder of “Élise Garnier”: the AI knows that the client and the recipient of the email are one and the same. The order number is masked: it would link the copy to a specific file at the supplier.

3. The request to the AI

After the instruction and the two documents:

4. The AI’s answer

5. After re-injection

The [DOSSIER_…] line was used to find the table, then disappeared from the result. All the placeholders came back, order number included. What remains is to correct “a Atelier Boréal team” to “an Atelier Boréal team”, and to check that the AI mixed up neither the people nor the companies: re-injection does not check that.

Are placeholders enough? Indirect re-identification

A placeholder hides a name, not a context. The GDPR treats as identifiable a person who can be identified “directly or indirectly” (Article 4(1)). And for the CNIL, even after pseudonymization, it is “very often possible to recover the identity” of the people through third-party data (our translation).

Before sending, look for what points to the matter without naming it:

• Numbers: file, court docket, order, contract, lot.
• Places: a small town, a site address, a shop sign.
• Precise dates: that of an accident, a hearing, a sale.
• Unique positions and amounts: “the finance director” of a small business, damages to the cent.

Review the copy as someone who knows the matter would: if they recognize it, mask what gives it away. In AnonymFiles, each document is reviewed side by side with the original, and a selected passage is masked in one click for the whole file, amounts included: they are not detected automatically. No detection is perfect, and nothing is exported without your approval. The details to watch are listed for law firms (court docket number, hearing date) and notary offices (land registry reference, lot number).