Anonymizing PESEL, NIP, REGON & KRS — what they reveal and how to mask them: Amaze

A Polish PESEL number encodes date of birth and sex directly in its digits, and a sole trader’s NIP is personal data — which is why simple find-and-replace does not anonymize Polish identifiers. To anonymize PESEL, NIP, REGON or KRS under the GDPR, you must remove not only the number itself but also the surrounding context that still points to a specific person.

TL;DR

PESEL reveals date of birth and sex straight from its digits — removing the number while leaving the date of birth protects nothing.
NIP for a sole trader (one-person business) is personal data; a company’s NIP generally is not, because it relates to a legal person.
REGON and KRS work the same way: personal data for a natural-person business, a legal-entity identifier for a company.
Removing the number alone is not anonymization if the rest of the record (name, address, job title) still identifies the person — that is the re-identification problem.
Amaze detects Polish identifiers locally, on your own machine, and masks them with consistent tokens ([PESEL], [NIP], [REGON], [KRS]).

What does a PESEL number actually reveal?

A PESEL is not a random string — its 11 digits encode date of birth and sex, so the number alone is a rich source of personal data.

The number has the form YYMMDDSSSSC:

YYMMDD — date of birth. The century is encoded in the month: for people born in 1900–1999 the month is 01–12, for 2000–2099 it is 21–32, for 1800–1899 → 81–92, for 2100–2199 → 41–52, and for 2200–2299 → 61–72.
SSSS — a serial number whose second-to-last digit (the 10th digit of the number) encodes sex: even for female, odd for male.
C — a check digit computed from the other digits using weights 1‑3‑7‑9‑1‑3‑7‑9‑1‑3.

Example: 85010212345 is a person born on 2 January 1985, female (the 10th digit 4 is even). Even if you strip out the name, the PESEL still betrays age and sex — and in a small dataset that is often enough to single out one individual.

So masking a PESEL must cover the whole number, not just part of it. A common mistake is leaving the first six digits “because they’re just a date” — those six digits are the date of birth.

85010212345 → [PESEL]

Is a NIP personal data?

It depends on who it belongs to: a sole trader’s NIP is personal data, while a company’s NIP generally is not, because it identifies a legal person.

A NIP (tax identification number) is 10 digits with a check digit at the end, assigned to both sole traders and companies. The distinction matters for the GDPR:

Limited company, joint-stock company, general partnership — the NIP identifies a separate legal entity. On its own it is not personal data (the GDPR does not protect legal persons).
Sole trader (one-person business) — a real individual stands behind the NIP. The Polish DPA (UODO) treats a sole trader’s NIP — especially combined with a name, an address (often the same as the home address), or contact details — as personal data subject to the full GDPR.

521-30-51-000 → [NIP]

Practical note: a sole trader’s NIP is often their personal tax number linked to their PESEL in tax records, so treating it as mere “company data” can be a mistake. For the line between reversible and irreversible masking, see anonymization vs pseudonymization.

How do REGON and KRS differ — and when are they personal data?

REGON identifies an entity in the national statistical register (GUS), while KRS identifies an entity in the National Court Register; both are personal data when they belong to a natural-person business.

REGON usually has 9 digits (the first two are a territorial code, the next six a serial number, the last a check digit). Local units get a 14-digit REGON: the first 9 digits are the parent unit’s REGON, the next 4 identify the branch, and the last is a check digit. A sole trader’s REGON relates to a specific person → personal data.
KRS is a 10-digit number in the National Court Register, which covers companies, foundations and associations — not sole traders (those are in the CEIDG register). The KRS number itself identifies a legal entity, but the register entry contains personal data of board members, partners and founders. A KRS number alongside a board member’s name can therefore indirectly point to a natural person.

The takeaway: whether something is “personal data” depends on the entity and the context, not on the identifier type alone. In mixed documents (some entities are companies, some are sole traders) it is safer to mask all of these numbers first and decide later what to restore.

Map: identifier → what it reveals → personal data? → how to mask

Identifier	What it structurally reveals	Personal data?	How to mask
PESEL	Date of birth and sex (encoded in the digits)	Yes, always — it belongs to a natural person	Whole number → `[PESEL]`; also remove any separate date of birth
NIP	Link to a taxpayer; for a sole trader, to a person	Sole trader: yes. Company: generally no	`[NIP]`; check the name and address in context
REGON	Territorial code + entity number	Sole trader: yes. Company: no	`[REGON]`; mask together with NIP and name
KRS	An entity’s entry in the court register	Entity: no. People in the entry: yes	`[KRS]`; watch for board member / partner names

Why does simple find-and-replace fail?

Manual number-hunting misses formatting variants, data in metadata, and — most importantly — the context that identifies a person even after the number itself is removed.

Three common traps:

Formats and separators. A NIP can appear as 5213051000, 521-30-51-000 or 521 305 10 00. A REGON as 9 or 14 digits. A find-and-replace tuned to one pattern will let the others through.
The number is not everything. The Polish DPA states plainly that anonymization does not end with covering up a name — if even one unique identifier remains (a customer number, case number, PESEL, date of birth), it is not anonymization. The same works in reverse: removing the PESEL while the name and address remain does not anonymize the record either.
Re-identification risk. A combination of postcode, date of birth and sex can single out one person — and a PESEL contains two of those three. Masking the number without looking at the rest of the record can be deceptive. We cover this in depth in re-identification risk.

Should you anonymize or pseudonymize these numbers?

If you never need to recover the identity, anonymize (a permanent token with no key). If you must restore the data later, pseudonymize (replacement with a separately stored mapping key).

Anonymization (GDPR Recital 26): 85010212345 → [PESEL] with no mapping table. If the rest of the record cannot identify anyone either, the data falls outside the GDPR.
Pseudonymization (GDPR Article 4(5)): 85010212345 → PERSON-0042, with the key linking token to number stored separately and protected. The data is still personal data and fully subject to the GDPR.

The key reversibility nuance: as long as a key exists anywhere that can reconstruct the PESEL or NIP, it is pseudonymization, not anonymization — even if the document itself now shows only [PESEL]. We break this distinction down in anonymization vs pseudonymization.

How Amaze masks Polish identifiers locally

Amaze has built-in detection of PESEL, NIP, REGON and KRS, and recognizes Polish names across all grammatical cases — all of it happening on your own machine, before any text reaches ChatGPT, Claude or Gemini. Numbers are replaced with consistent tokens (same value → same label), with optional reversibility via a private key when you need the originals back. It is the practical way to anonymize data before pasting it into an AI tool.

FAQ

Is a PESEL always personal data? Yes. A PESEL is assigned to a specific natural person and additionally encodes their date of birth and sex, so it is always personal data under the GDPR.

Is a company’s NIP personal data? A company’s NIP is generally not personal data, because it relates to a legal person. A sole trader’s NIP is personal data, because a real individual stands behind it — especially when combined with a name, surname or address.

Is removing just the number enough to anonymize? No. According to the Polish DPA, anonymization does not end with removing a single identifier. If the remaining data (name, address, date of birth, case number) still lets you single out the person, the document is not anonymized.

Is replacing a PESEL with a token anonymization? Only if no key exists to reconstruct the number and the rest of the record cannot identify the person. If a mapping key is stored anywhere, it is pseudonymization, and the data remains subject to the GDPR.

How do I mask REGON and KRS in a mixed document? The safest approach is to mask every number with tokens ([REGON], [KRS]) and separately decide which ones belong to natural persons. Pay attention to board member and partner names tied to a KRS number.

Want a repeatable routine? Follow the step-by-step Polish PII redaction checklist — mask, sweep the non-obvious places, and verify before you share.

Part of our complete guide to data anonymization.