Clean Sensitive Data Before You Upload It to AI

To prepare data for an AI tool, make a separate copy, keep only the information the task needs, remove direct and contextual identifiers, and inspect the exact file you plan to send. Changing names to labels such as “Person 1” can help, but it does not establish that the data is anonymous. If you cannot confirm that the material may be shared with the tool, keep it out of the upload.

This is a practical way to reduce exposure in an ordinary document, spreadsheet or PDF. It is not a certification of anonymity or a substitute for your organization’s data rules. NIST’s guide to de-identification says that removing identifying information can reduce privacy risk, while some de-identified data can still be re-identified. The useful question is therefore narrower than “Did I delete the names?”: could the remaining details, alone or alongside other information, point to a person or disclose something you were not allowed to share?

Decide what the AI task needs

Write down the output you want before opening the file. For a request to summarize customer complaints, the AI may need the complaint themes and broad dates. It probably does not need customer names, email addresses, order IDs, full transcripts or staff notes. For a request to improve the wording of a letter, one invented sample paragraph may be enough.

Use the smallest input that can answer the question. If a few invented rows will let you test a prompt, start there. If real records are necessary, confirm that your organization permits this use, which tool or account is approved, and where the input will be processed. Redacting a file on an unknown website is itself a disclosure to that website. Read its terms and your own policy before uploading an original there.

Save an untouched original in its approved location. Make a working copy with a new name, such as complaint-themes-for-ai.csv. This makes it easier to inspect what will leave your control and prevents a cleanup step from changing the source record. Microsoft likewise recommends using a copy when running its Document Inspector, because some removed information cannot be restored.

Find identifiers in the words and the context

Start with obvious identifiers: names, personal email addresses, phone numbers, account numbers, street addresses, exact locations, usernames, IDs and links to private records. Then read the surrounding sentences. A job title, small team, unusual incident and exact date may identify someone together even if no name remains. NIST notes that de-identification has to balance usefulness against identification risk; it does not promise that stripping one field settles the question.

Choose a treatment for each detail according to the task:

Consistent labels can preserve who said what. If you keep a separate list that maps Customer A back to a real person, the result is still linkable by someone with that list. Do not call the file anonymous solely because the names have been replaced. The risk also depends on what a recipient could infer from the remaining data, as NIST’s re-identification warning makes clear.

Prepare a copy for the file format

The visible page is only one part of some files. Review the content and the container you will actually submit.

Plain text and prompts

Copy only the passages needed into a new plain-text file or prompt. Read from the first character to the last. Look for signatures, quoted email chains, document titles, URLs, file paths and pasted headers. If a long transcript is needed, replace speaker names consistently and inspect each reference to a person elsewhere in the conversation. A find command for known names is useful, but it will not detect an indirect clue you did not search for.

CSV files and spreadsheets

Create a new CSV containing only the rows and columns required for the task. Open the saved CSV in a text editor as well as a spreadsheet viewer: check its header, first and last rows, free-text cells and any fields that were transformed. A CSV has a simpler structure than a workbook, but that is no reason to assume the exported copy is safe. A leftover column or note can still reveal a person.

If you intend to share a Word or Excel file rather than a fresh CSV, inspect comments, tracked changes, hidden sheets or rows, properties and embedded objects. Microsoft’s Document Inspector guidance lists these categories and warns that its inspector cannot remove every kind of hidden information. Review its findings yourself; do not treat “inspection complete” as proof that the content is appropriate to send.

PDFs

Putting an opaque shape over text is a visual edit, not a verified removal. In a PDF tool with a real redaction feature, mark the content, apply the redactions, and remove hidden information where the tool supports it. Adobe’s Acrobat redaction instructions distinguish marking content from applying redaction and include a sanitizing step for comments, metadata and hidden layers. The described feature is available in the Acrobat editions named on Adobe’s page; other tools need their own verified procedure.

Save a new PDF. Reopen that new file, search for the removed terms, try selecting or copying text around the redaction, and inspect its document properties. Look at every page, including attachments and notes if your PDF workflow includes them. These checks catch common mistakes; they do not prove that no recipient could identify someone from the remaining context.

A fictional before-and-after example

The following example is invented to show a decision, not a file we tested or a real person’s information. Suppose you want an AI tool to group support complaints by theme. The original note reads:

On 14 May, Mara Ellis at the two-person North Pier branch emailed [email protected] about order NP-4821. The new checkout form froze after she selected delivery. Call her at 555-0102 before Friday.

If the task is only to categorize problems, a working copy could say:

In May, a customer reported that the checkout form froze after delivery was selected. Theme to classify: checkout failure.

The shorter version drops the name, contact details, order ID, exact day, call instruction and distinctive branch description. It retains the sequence needed to classify the problem. If the month is irrelevant, remove it too. If the branch is essential to a permitted analysis, a broader region might preserve some utility, but review whether the combination of region and incident still narrows the person down.

The same rule applies to a table. An illustrative source row might have columns customer_name, email, branch, complaint, order_id; the prepared CSV might contain only case_label, complaint_theme, product_area. A row such as Case A, checkout froze after delivery selection, checkout can support theme grouping without carrying the original identity fields. Do not place a label mapping in the same CSV, a second tab or an attached prompt. Keep it separately under your organization’s controls if you truly need it.

Inspect the exact file before sending

The final check is on the exported copy, not on the editable source or a preview. Reopen the file from the path you will upload. If you make one more edit, export again and repeat the check.

1. Confirm the filename and count the pages, rows or passages you expect. Make sure you did not select an older export.
2. Search for every known name, email, number and distinctive phrase removed from the source. Also scan for variants, abbreviations and references such as “her manager.”
3. Read the remaining text for combinations of job, place, timing and event that could identify someone. This needs a person who understands the context.
4. Inspect format-specific leftovers: comments and properties in office files; text beneath redactions and document properties in PDFs; unexpected columns or rows in CSVs.
5. Check that the information left is enough for the AI task. If removing one more detail would make the answer useless, reconsider the task or the processing route instead of quietly restoring sensitive fields.
6. Have a second authorized person review the submitted copy when the stakes or sensitivity warrant it. Record which final file was approved under your normal process.

Automated detection can assist with the search, but it is not a complete reviewer. The Presidio project’s FAQ explicitly says its automated identification cannot guarantee that it finds all sensitive information. Treat a scanner’s findings as candidates to verify and its silence as no proof of safety.

Choose where the processing happens

An input can be cleaned locally, sent to an approved organizational service, or uploaded to a public web tool. Those routes have different destinations. Before using one, establish where the original and cleaned copies go, who can access them, whether the service stores them, and what your organization’s rules allow. Do not send the original to an online redaction service just to create a safer file for another service.

A local AI setup can change where the prompt is processed, but it does not remove the need to minimize input or control local files. If your concern is what a chatbot account retains or exposes, the separate guide to ChatGPT history and access covers that account question. For meeting transcripts, start with consent and capture controls in the guide to AI meeting notes privacy before preparing an excerpt.

FAQ

Is replacing names with “Person 1” enough?

No. A separate mapping can restore the names, and a combination of remaining details can still point to a person. Keep the mapping out of the submitted material and review the full context. NIST documents the possibility of re-identifying some de-identified data.

Can I ask an AI tool to redact the original for me?

Only if sharing the original with that tool is permitted. Sending the raw file to a service so it can remove identifiers still sends the raw file. Even when automated redaction is allowed, inspect its output; Presidio’s own documentation warns that automated detection can miss sensitive information.

Does a black box remove text from a PDF?

Do not assume so. Use an actual redaction function, apply the marks, save a new file and inspect it. Adobe’s process also includes removing hidden information. Search and copy from the exported PDF to check for text that should have gone.

What about document metadata?

Review properties, comments, revisions and other hidden content in the exact file you will send. Microsoft lists those categories for Office files, and Adobe lists metadata, comments and hidden layers for PDFs. Use the relevant tool’s inspection feature, then check its findings yourself.

How do I keep enough context for a useful answer?

Start with the output you need. Keep the facts that determine that answer, such as the problem category or sequence of events, and remove details that only identify the person or record. If the task requires exact personal details, use an approved route for that data rather than describing a lightly edited copy as anonymous.