How to anonymize data before pasting it into ChatGPT, Claude & Gemini
8 min read
To anonymize data for ChatGPT, Claude, or Gemini, replace every piece of personal data — names, emails, phone numbers, national IDs — with neutral placeholder tokens before the text leaves your device, then paste the redacted version into the model. If you need real values back, keep a private mapping so you can restore them locally in the answer. Done right, the AI never sees a single identifiable detail.
TL;DR
- Consumer chat tiers of ChatGPT, Claude, and Gemini may use your conversations to train models by default — you have to opt out, and even deleted chats can be retained.
- Pasting client or patient data into a public LLM is a disclosure to a third party (and usually a transfer to the US), which needs a legal basis under the GDPR.
- The fix is simple: redact PII locally, before pasting, e.g.
Jan Kowalski → [PERSON],85010212345 → [PESEL]. - Keep a reversible mapping so you can swap the real values back into the model’s reply on your own machine.
- Amaze does exactly this — on-device detection and masking, with a private key to restore originals. Your data never leaves your device.
What’s the risk of pasting personal data into an AI chatbot?
The moment you paste a contract, medical note, or support ticket into a chatbot, that text is transmitted to servers you don’t control — and on consumer plans it may be stored, reviewed by humans, and used to train the next model.
- OpenAI (ChatGPT). By default, content from consumer plans (Free, Plus, Go, Pro) may be used to improve models unless you turn training off in Data Controls. Business products — ChatGPT Team, Enterprise, and the API — are not trained on by default (OpenAI: how your data is used).
- Anthropic (Claude). Since a policy change effective September 2025, chats and coding sessions on Free, Pro, and Max are used to train Claude unless you opt out — and if you allow it, retention extends to five years (versus 30 days if you decline). Commercial products (Claude for Work, Government, Education, and API access via Amazon Bedrock or Google Vertex AI) are excluded (Anthropic: updates to consumer terms).
- Google (Gemini). A subset of conversations is reviewed by humans and can be retained for up to three years, disconnected from your account — and, per Google’s own help pages, those reviewed conversations aren’t removed even when you delete your activity (Gemini Apps Privacy Hub).
“Deleted” doesn’t always mean gone, either. In the New York Times v. OpenAI litigation, a May 2025 court order forced OpenAI to preserve ChatGPT output logs that would normally have been deleted — including deleted chats on Free, Plus, Pro, and Team tiers — overriding users’ deletion requests (OpenAI’s response). The obligation was later narrowed, but the lesson stands: once data leaves your device, its lifecycle is out of your hands.
This isn’t hypothetical. In April 2023, Samsung engineers pasted proprietary semiconductor source code and internal meeting notes into ChatGPT; the company responded by banning generative AI tools on its devices (Bloomberg).
Is it legal under GDPR to send personal data to ChatGPT?
Pasting personal data into a public LLM is a disclosure to a third party — a processing operation that needs a lawful basis under Article 6 GDPR — and because these providers are US-based, it’s usually an international transfer governed by Chapter V (Articles 44–49 GDPR). Without a data processing agreement and appropriate transfer safeguards, that’s hard to justify for client, patient, or employee data.
There’s a clean way out. If the text contains no personal data, most of these obligations fall away, because under Recital 26 GDPR the rules don’t apply to anonymous information. Removing the personal data before you paste is therefore the simplest path to compliance. For a deeper treatment of when data truly stops being personal, see anonymization vs pseudonymization and data masking vs anonymization vs pseudonymization. If your work involves privileged material, can lawyers use ChatGPT with client data? goes further.
How do I anonymize data before pasting it into an LLM?
The workflow is four steps, and all of the sensitive part happens on your machine:
- Detect the PII. Find every name, email, phone number, address, and identifier in the text.
- Mask it with placeholder tokens. Swap each value for a neutral label, keeping the sentence readable.
- Paste the redacted version into ChatGPT, Claude, or Gemini and do your work.
- Restore the real values locally in the model’s answer using your private mapping — only if you need them back.
Here’s what the masking looks like on a real snippet:
Before (never paste this):
Customer Jan Kowalski (PESEL 85010212345, [email protected], +48 512 345 678) disputes invoice FV/2026/114 for his company NIP 521-30-51-000.
After (safe to paste):
Customer [PERSON] (PESEL [PESEL], email [EMAIL], phone [PHONE]) disputes invoice [CASE] for his company NIP [NIP].
Field by field:
Jan Kowalski → [PERSON]85010212345 → [PESEL][email protected] → [EMAIL]+48 512 345 678 → [PHONE]521-30-51-000 → [NIP]
The model can still draft the reply, summarize the dispute, or suggest wording — it simply never learns who the customer is.
Redact by hand or use a tool?
You can do this manually, but manual find-and-replace is exactly where redaction fails: it misses identifiers in unusual formats, skips the third mention of a name, and — for Polish text — ignores grammatical inflection, so Kowalskiego and Kowalskim slip through even after you’ve caught Kowalski. A tool built for the job is more reliable.
| Manual find-and-replace | Local anonymization tool (Amaze) | Paste raw into the LLM | |
|---|---|---|---|
| Where data is processed | Your device | Your device | Third-party servers |
| Catches every occurrence | Easy to miss | Automatic | n/a |
| Handles Polish IDs (PESEL, NIP, REGON, KRS) | You must know them | Built-in | n/a |
| Handles Polish name inflection | Usually missed | Yes | n/a |
| Reversible (restore originals) | Manual, error-prone | Private key / mapping | n/a |
| GDPR exposure | Low if thorough | Low | High |
| Speed | Slow, per document | One click | Fast but unsafe |
How do I get the real values back after the AI answers?
Use a reversible mapping. When you mask, the tool records that [PERSON] meant Jan Kowalski and [PESEL] meant 85010212345 in a private mapping file that stays on your machine. When the model returns an answer full of [PERSON] and [EMAIL] tokens, you run the reverse step locally and the real values drop back into place — the AI provider never touched them.
This two-way workflow is the difference between pseudonymization (reversible, with a protected key kept separately) and irreversible anonymization. Both keep the identifiers away from the model; the mapping just lets you finish the job on your side. Just remember that consistent tokens can still enable re-identification if a record is unique enough on its remaining fields, so mask thoroughly — not just the obvious name.
Which data types should I always mask?
At minimum, mask anything that identifies a person directly or in combination with other fields. Amaze detects 13 categories out of the box: people, companies, locations, dates, email, phone, PESEL, NIP, REGON, KRS, IBAN, logins, and passwords — the entities that actually show up in legal, medical, and support documents in Europe.
FAQ
Does ChatGPT train on what I paste? On consumer plans (Free, Plus, Go, Pro) it may, unless you turn off model training in Data Controls. ChatGPT Team, Enterprise, and the API are not used for training by default. The safest assumption for any public chatbot is that inputs may be stored and reviewed — so redact first.
Is it enough to just turn off chat history or training? It reduces exposure but doesn’t eliminate it. Data may still be transmitted and temporarily retained, human review can apply, and — as the NYT v. OpenAI preservation order showed — legal holds can override deletion. Removing the personal data before it leaves your device is the only control that doesn’t depend on the provider’s settings.
Can I anonymize data for Claude and Gemini the same way? Yes. The mask-before-paste workflow is provider-agnostic — it works identically for ChatGPT, Claude, Gemini, or any other model, because the protection happens on your machine before you paste.
Is masked data still personal data under the GDPR? If the mapping is destroyed and nothing in the remaining text can identify the person, it’s anonymous and outside the GDPR (Recital 26). If you keep a reversible key, it’s pseudonymized and remains personal data (Article 4(5)) — still far safer than pasting raw identifiers.
Anonymize locally with Amaze
Amaze detects and masks PII — including PESEL, NIP, REGON, KRS, IBAN, and Polish names across grammatical cases — entirely on your own machine, before any text reaches ChatGPT, Claude, or Gemini. Mask with one click, work in any AI tool, then restore the originals locally with your private key. It even runs fully offline (air-gap), so no outbound connection happens while a document is processed. Paste with confidence — your data never leaves your device.
See the workflow end to end: Before you paste — the safe-AI redaction workflow breaks the anonymize → use → restore loop into three steps with a diagram.
Part of our guide: how to use AI without leaking client data.