How to use AI without leaking client or personal data
10 min read
You can use ChatGPT, Claude and Gemini safely with sensitive material by redacting personal data locally before it ever reaches the model — replace every name, email, ID number and address with a placeholder on your own device, run the prompt, then restore the real values in the output using a private key. The model only ever sees [PERSON], [EMAIL] and [PESEL], so there is nothing to leak, retain, or train on — and no personal data crosses a border.
That single move — local redaction with reversible restore — is the difference between a productivity gain and a reportable data breach. This is the hub page for our commercial cluster on using AI safely with sensitive data; below, we explain the risk, who is exposed, exactly how the fix works, and link down to every deep-dive guide.
TL;DR
- The default is against you. For consumer accounts, OpenAI, Anthropic and Google all use your conversations to train or improve their models unless you actively opt out — and retention can run for years.
- GDPR follows the data. Pasting client data into a US-hosted AI tool is a cross-border transfer under GDPR Chapter V and usually needs a legal basis and safeguards you don’t have.
- The fix is local redaction. Strip PII on your own machine before prompting; the AI works on placeholders; you restore the real values afterwards with a private key.
- Anonymize, don’t just “be careful”. Manual redaction leaks through metadata, headers and human error. Automated, on-device masking is repeatable and auditable.
- Amaze does this locally — detecting names, emails, phone numbers, IBANs, logins/passwords and Polish IDs (PESEL, NIP, REGON, KRS), all on your device, fully reversible.
Why is it risky to paste client data into ChatGPT, Claude or Gemini?
Three risks stack on top of each other.
1. Providers retain and train on consumer inputs by default. On personal (non-business) tiers, your prompts are not a private scratchpad:
- OpenAI (ChatGPT Free/Plus/Pro): conversations are used to improve models unless you switch off “Improve the model for everyone” in Data Controls.
- Anthropic (Claude Free/Pro/Max): since the August 2025 consumer-terms update, chats and coding sessions may be used for training and retained for up to five years unless you opt out.
- Google (Gemini Apps): activity is on by default, conversations can be retained for months, and human reviewers may read samples — reviewed conversations can be kept for up to three years, disconnected from your account and not removed when you delete your history.
Business and enterprise tiers (ChatGPT Enterprise/Team, Claude for Work, the APIs) generally do not train on your inputs by default — but most professionals paste sensitive text into a consumer chat window, not a governed enterprise seat.
2. It’s a cross-border transfer. GDPR Chapter V (Articles 44–46) says personal data may only leave the EEA under an adequacy decision, appropriate safeguards such as Standard Contractual Clauses, or a narrow derogation. Pasting a client file into a US-hosted model is a transfer. Without the right paperwork, that transfer is simply unlawful — regardless of how good the answer was.
3. Confidentiality and privilege. For regulated professionals, the problem is bigger than GDPR. Lawyers owe legal professional privilege; doctors owe medical confidentiality; auditors and bankers owe contractual and statutory secrecy. Feeding an identifiable client matter into a third-party model can breach those duties on its own, even before a regulator gets involved.
Who is most exposed?
If your work involves other people’s identifiable information, you’re in scope. The exposure — and the fix — looks like this:
| Profession | What leaks | Core duty at risk | The local-redaction fix |
|---|---|---|---|
| Lawyers | Client names, case files, settlement figures | Legal professional privilege | Mask parties and identifiers before drafting/summarizing with AI |
| Healthcare | Patient names, diagnoses, PESEL | Medical confidentiality, health-data (special category) | Redact patient PII before using AI for notes or letters |
| HR | Employee records, salaries, disciplinary notes | Employment + GDPR | Anonymize before analyzing CVs or grievances with AI |
| Finance / accounting | NIP, IBAN, transactions, client accounts | Banking/tax secrecy, GDPR | Strip account and ID numbers before AI analysis |
| DPOs / compliance | Everything, org-wide | Accountability (Art. 5(2)) | Set a policy: AI only on anonymized data, with an audit trail |
What is the fix? Redact locally, restore with a key
The reliable pattern has four steps, and the important detail is where each step happens.
- Detect PII on your device. A local tool scans your document, dataset or prompt and finds the identifiers — names, emails, phone numbers, addresses, national IDs, account numbers.
- Replace with consistent tokens. Each value becomes a placeholder, and the same value always maps to the same token, so the text stays coherent and the model can still reason about it.
- Prompt the AI with the masked text. The model receives only placeholders. There is no personal data to log, retain or train on.
- Restore the real values locally. A private mapping key — held only on your machine — swaps the placeholders back for the originals in the AI’s output.
Before / after: a concrete example
Raw text you must never paste as-is:
“Please summarize the dispute involving Jan Kowalski ([email protected], PESEL 85010212345) regarding invoice NIP 521-30-51-000.”
What the model actually sees:
“Please summarize the dispute involving
[PERSON]([EMAIL],[PESEL]) regarding invoice[NIP].”
Token mapping (Jan Kowalski → [PERSON], [email protected] → [EMAIL], 85010212345 → [PESEL], 521-30-51-000 → [NIP]) stays on your device. The AI returns a summary about [PERSON]; you restore it locally and read the real names — the provider never saw them.
This is anonymization for the provider’s view combined with a reversible key for your view. It is worth understanding exactly where that sits between anonymization and pseudonymization — because it changes your GDPR obligations. See anonymization vs pseudonymization.
On-device vs cloud redaction — does it matter where masking happens?
Yes, and it’s the crux of the whole approach. Some “redaction” tools send your document to their cloud to detect the PII — which means the raw, unredacted data leaves your machine before it’s masked. You’ve just moved the leak one hop upstream.
On-device (local) redaction does the detection and masking on your own hardware. The sensitive text never leaves the building. That is the only version that genuinely shrinks your attack surface and keeps you clear of an extra cross-border transfer. We break down the trade-offs in full in on-device vs cloud PII redaction.
Do / don’t when using AI with sensitive data
| Do | Don’t |
|---|---|
| Redact PII locally before prompting | Paste raw client data and “hope” the provider deletes it |
| Use consistent tokens so text stays usable | Rely on manual find-and-replace (misses metadata, headers, inflected names) |
| Keep the restore key on your own device | Store the mapping next to the data, or in the cloud |
| Anonymize documents and datasets before AI use | Assume deleting your chat history removes reviewed data |
| Check what remains can’t re-identify the person | Treat “name removed” as “anonymized” — combinations still identify |
| Set an org policy + audit trail (for DPOs) | Depend on each employee’s judgment case by case |
The “combinations still identify” point is easy to underestimate: a postcode, a birth date and a job title can single out one person even with the name gone. That’s re-identification risk, and it’s why field-level masking has to be thorough — see re-identification risk.
Anonymizing documents and datasets, not just chat prompts
The same principle scales beyond a chat box:
- Documents (Word, PDF, Excel): mask names, IDs and figures while preserving formatting, so an AI can summarize or translate a contract without ever seeing the parties.
- Datasets (CSV, JSON): redact PII columns before you feed a spreadsheet to an AI for analysis or before sharing it with a partner. What is a “PII column” in the first place? Start with what is PII.
- Structured identifiers: national numbers (PESEL, NIP, REGON, KRS), IBANs, logins and passwords need pattern-aware detection, not just a name list.
Go deeper: the complete cluster
This pillar links down to every guide in the “use AI safely with sensitive data” cluster. Start here, then dive into the one that matches your situation:
- Anonymize data before ChatGPT, Claude & Gemini — the step-by-step workflow for masking before you prompt.
- Can lawyers use ChatGPT with client data? — privilege, confidentiality and the safe way for legal teams.
- Re-identification risk — why removing the obvious name isn’t enough, and how combinations betray identity.
- Anonymization vs pseudonymization — the GDPR distinction that decides your obligations.
- On-device vs cloud PII redaction — where masking should happen, and why local wins.
- What is PII? — the categories of personal data you need to detect and mask.
- Anonymize a dataset for AI/ML training — masking columns before the training pipeline.
- Anonymize Word, PDF & Excel documents — real redaction and the metadata leaks to catch.
- Microsoft Presidio alternative — no-code, ready-made PII masking vs building it yourself.
FAQ
Can I use AI at all with client data? Yes — as long as the model never receives identifiable personal data. Redact it locally, prompt with placeholders, restore the output on your device. The AI works on anonymized text, so there’s nothing to leak.
Isn’t opting out of training enough? It helps, but it’s not a compliance strategy. Opt-out is per-account, easy to forget, doesn’t remove data already used, and — crucially — doesn’t undo the cross-border transfer or the confidentiality breach. Not sending the personal data in the first place is far stronger.
Is masked data still “personal data” under GDPR? For the AI provider’s view, if it only ever sees irreversible placeholders, that view is effectively anonymized. Because you keep a restore key, the mapping itself is pseudonymization and stays personal data on your side — so keep the key protected and local. See anonymization vs pseudonymization.
What about business or enterprise AI tiers? Enterprise/API tiers generally don’t train on your inputs by default, which reduces the training risk — but they don’t remove the confidentiality duty or the cross-border transfer question, and most people still use consumer chat windows. Local redaction protects you regardless of tier.
Does local redaction work offline? Yes. Because detection and masking run on your device, they work with the network disconnected — no document leaves your machine during processing.
Use AI safely — mask locally with Amaze
Amaze detects and masks personal data entirely on your own machine, before a single character reaches ChatGPT, Claude or Gemini. It recognizes 13 categories out of the box — people, companies, locations, dates, email, phone, IBAN, login, password, and Polish identifiers PESEL, NIP, REGON and KRS — including Polish names across grammatical cases. Mask with one click, work in any AI tool, then restore the originals locally with your private mapping key. It runs offline, keeps document formatting intact, and produces an audit report for your DPO.
Use AI without leaking client data — download Amaze for Mac or Windows and keep sensitive data on your machine, not in the model.