Why is "it's just numbers" a dangerous mistake?
Because the law doesn't distinguish letters from numbers — it distinguishes identifying from non-identifying. A national ID identifies a person better than their name does: names repeat, ID numbers don't.
- National IDs and social security numbers — unique identifiers of one person. Such a column is personal data even when the rest of the file looks "clean".
- Mobile numbers — lead straight to a person; combined with messaging apps, to their name and photo too.
- Salaries and bank accounts — highly sensitive; a salary next to a role and department identifies someone without any name.
- Indirect combinations — birth date + town + department narrows to one person surprisingly fast.
What hides in an Excel file beyond the cells you see?
A spreadsheet is much more than what's on screen — and every hidden layer travels with the file when it is pasted or shared.
- Hidden sheets — a tab hidden years ago holding the full raw data.
- Collapsed columns and rows — "I deleted the sensitive column" sometimes turns out to be Hide.
- Metadata — author name, file path, cell comments.
- Formulas and ranges — a formula referencing another workbook exposes its name and location.
What does the law say about a sheet full of people's data?
Under GDPR, a spreadsheet with a row per person is a structured filing system of personal data; pasting it into an external AI tool is a disclosure that needs a legal basis and a processing agreement, with fines up to 20 million euros or 4% of global turnover. Anonymized data falls outside the regulation (Recital 26) — which is why cleaning the sheet first is the straight path, exactly as for anything you should never paste into ChatGPT.
How do you analyze an Excel file with AI — safely?
- Trim the file to the question — only the columns and period the analysis needs. Less data, less exposure.
- Unhide everything — reveal hidden sheets and columns and see what the file actually contains.
- Replace identifiers with consistent tokens — IDs, names, phones and accounts become PERSON_001 and the like; the same person keeps the same token across all sheets.
- Clean metadata and comments — author, paths, cell notes.
- Feed the clean version to the AI — sums, averages, trends and outliers compute exactly as before.
Won't the analysis suffer without the identifiers?
No. Quantitative analysis works on values and the relations between them — not on whose values they are. Average salary by department, age distributions, duplicate and outlier detection: all of it works when the identifier is a consistent token. It is the same principle as analyzing customer exports — the pattern stays, the identity stays home. The method in full: document anonymization guide.