Redaction vs. pseudonymization vs. anonymization
| Method | What you do | What you get |
|---|---|---|
| Redaction | Delete or mask the detail | A document full of holes — context is lost, you can't track who is who |
| Pseudonymization | Replace with an alias, keep a re-identification key | Still personal data under GDPR — the key makes it reversible |
| Consistent anonymization | Replace each detail with a stable token, keep no key | A readable, useful document outside the scope of the law |
The critical question is who holds the replacement map: if it stays only with your organization (or isn't kept at all), whoever receives the document — including an AI engine — receives anonymous data.
What must be handled? The complete checklist
- Direct identifiers — names, national IDs, passports, phone numbers, emails, addresses.
- Financial identifiers — bank accounts, card numbers, unique amounts that give away a deal.
- Organizational identifiers — company, customer, supplier and project names.
- Indirect identifiers — "the CFO of a 40-person company in the north" identifies someone without any name.
- Metadata — the Author field, comments, tracked changes and file paths expose identities you can't see in the text. Office files keep them even after you 'delete' them from the page.
Why is consistency the most important rule?
If "John Miller" becomes PERSON_001 in one paragraph and PERSON_007 in another, the document loses its meaning: you can't tell who signed, who received, who committed. Consistent replacement — the same token for every occurrence of the same detail — preserves the chain of events, so an AI analyzing the document draws the right conclusions.
How to anonymize a document: five steps
- Scan — find every candidate: deterministic detection (ID check digits, Luhn for cards, phone patterns) plus contextual detection for names and companies.
- Human review — go over each finding and decide: keep, replace or remove. Automation without review misses things; review without automation never ends.
- Consistent replacement — every detail gets a stable token (or a synthetic value) across all occurrences.
- Metadata cleaning — author, comments, tracked changes and document properties.
- Indirect-identifier check — read the output and ask: can you still tell who this is about?
Anonymization before AI: why it's the key move
A Cyberhaven study found that about 11% of what employees paste into AI tools is sensitive company data, and IBM's Cost of a Data Breach 2024 puts the average breach at $4.88 million. Blocking AI doesn't work — anonymization does: it lets people use the tools on a document that no longer contains what must never be pasted.
Where the anonymization happens matters just as much: a tool that uploads your document to its own server merely moves the problem to another vendor. Local processing — in the browser or on the device — means the original document never leaves your organization at all.