Practical guides on data anonymization, pseudonymization, and GDPR compliance from the Amaze team.https://heyamaze.com/enhttps://heyamaze.com/blog/anonymize-data-before-chatgpt-claude-gemini/https://heyamaze.com/blog/anonymize-data-before-chatgpt-claude-gemini/Learn how to anonymize data for ChatGPT, Claude, and Gemini: redact names, emails, and IDs locally before you paste, then restore the real values in the answer. A practical, GDPR-aware guide.Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/can-lawyers-use-chatgpt-with-client-data/https://heyamaze.com/blog/can-lawyers-use-chatgpt-with-client-data/Lawyers using ChatGPT with client data risk breaching confidentiality and waiving privilege. What GDPR, bar-association guidance and US v. Heppner require — and how to redact client identifiers locally before you prompt.Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/data-masking-vs-anonymization-vs-pseudonymization/https://heyamaze.com/blog/data-masking-vs-anonymization-vs-pseudonymization/Data masking is a technique; anonymization and pseudonymization are GDPR legal outcomes. Static masking usually anonymizes, dynamic and deterministic masking usually pseudonymize. Compare all three across reversibility, data status, and GDPR — with clear examples.Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/anonymize-dataset-for-machine-learning/https://heyamaze.com/blog/anonymize-dataset-for-machine-learning/A practical guide to anonymizing a training dataset before machine learning: which columns are direct vs quasi-identifiers, how to mask them consistently, why k-anonymity matters, and how doing it locally keeps raw data off third-party infrastructure.Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/anonymize-pdf-word-excel/https://heyamaze.com/blog/anonymize-pdf-word-excel/Redacting a document is more than blacking out text. How to anonymize Word, PDF and Excel files correctly: real redaction vs fake black boxes, the metadata and hidden-data leaks people miss (author, track changes, comments, hidden columns), and how to preserve formatting.Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/does-gdpr-apply-to-anonymized-data/https://heyamaze.com/blog/does-gdpr-apply-to-anonymized-data/Does the GDPR apply to anonymized data? No — Recital 26 places truly anonymous data outside the regulation. But the bar is high: the data must be irreversibly de-identified. How that affects erasure (Art. 17), retention limits, and the line against pseudonymization.Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/dpia-checklist/https://heyamaze.com/blog/dpia-checklist/A Data Protection Impact Assessment (DPIA) is a documented risk analysis you must run before high-risk processing under GDPR Art. 35. When it is mandatory, the four elements Art. 35(7) requires, a step-by-step checklist, and how anonymization lowers the risk you have to assess.Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/anonymizing-pesel-nip-regon-krs/https://heyamaze.com/blog/anonymizing-pesel-nip-regon-krs/A PESEL number encodes date of birth and sex, and a sole trader's NIP is personal data — so plain find-and-replace does not anonymize Polish identifiers. See what each ID reveals and how to mask PESEL, NIP, REGON and KRS under the GDPR.Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/data-anonymization-complete-guide/https://heyamaze.com/blog/data-anonymization-complete-guide/Data anonymization explained end to end: what it is, how it differs from pseudonymization and masking, the GDPR basis (Recital 26, Art. 4(5)), the core techniques (masking, k-anonymity, synthetic data), re-identification risk, and how to choose a local vs cloud tool.Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/hipaa-safe-harbor-18-identifiers/https://heyamaze.com/blog/hipaa-safe-harbor-18-identifiers/The HIPAA Safe Harbor method (45 CFR §164.514(b)(2)) de-identifies protected health information by removing 18 specified identifiers. The full list, how Safe Harbor differs from Expert Determination, and the actual-knowledge caveat — with before/after examples.Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/polish-pii-redaction-checklist/https://heyamaze.com/blog/polish-pii-redaction-checklist/A practical mask-and-verify checklist for redacting Polish personal data. What PESEL, NIP, REGON and KRS each reveal, why find-and-replace misses inflected Polish names, and a step-by-step routine to confirm a document is actually anonymized under the GDPR.Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/on-device-vs-cloud-pii-redaction/https://heyamaze.com/blog/on-device-vs-cloud-pii-redaction/On-device PII redaction keeps data on your machine — no new processor, no cross-border transfer, no extra breach surface. Cloud redaction uploads data to a third party. See the GDPR differences, a decision table, and when each is acceptable.Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/presidio-alternative/https://heyamaze.com/blog/presidio-alternative/Looking for a Presidio alternative? Microsoft Presidio is a powerful open-source PII SDK, but it needs engineering to deploy, tune, and maintain. When a ready-made, no-code app with built-in Polish ID support and local processing is the better fit — and an honest comparison.Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/re-identification-risk/https://heyamaze.com/blog/re-identification-risk/Re-identification risk is the chance that a person can be identified from "anonymized" data. Deleting the name is not enough — quasi-identifiers like ZIP code, birth date, and sex can single someone out. Here is what that means under GDPR.Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/reversible-anonymization/https://heyamaze.com/blog/reversible-anonymization/What is reversible anonymization? Masking that swaps each identifier for a placeholder while keeping a private key that can restore the original. How it differs from encryption and hashing, why it is legally pseudonymization, and when a two-way workflow beats irreversible masking.Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/synthetic-data-vs-anonymization/https://heyamaze.com/blog/synthetic-data-vs-anonymization/Synthetic data and anonymization both aim to let you use data without exposing people — but they work differently and fail differently. How each protects privacy, why synthetic data can still leak through the model that made it, and when masking real data is the more verifiable choice.Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/rodo-uodo-anonymization-guide/https://heyamaze.com/blog/rodo-uodo-anonymization-guide/Data anonymization under Poland's RODO (GDPR) and UODO guidance: how it differs from pseudonymization, when data leaves scope (Recital 26), how to handle the Polish identifiers PESEL, NIP, REGON and KRS, and a practical checklist for correct, irreversible anonymization.Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/safe-ai-redaction-workflow/https://heyamaze.com/blog/safe-ai-redaction-workflow/A vendor-neutral three-step workflow for using ChatGPT, Claude or Gemini without leaking personal data: anonymize on your machine, work with the AI on masked text, then restore the originals locally with your private key. What to redact, what stays, and why the order matters.Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/use-ai-without-leaking-client-data/https://heyamaze.com/blog/use-ai-without-leaking-client-data/Use AI without leaking data: consumer LLMs retain and train on your prompts by default. The fix is to redact PII locally before prompting and restore real values afterwards. A complete GDPR-ready guide for lawyers, healthcare, HR, finance and DPOs.Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/what-is-pii/https://heyamaze.com/blog/what-is-pii/What is PII? A clear definition of personally identifiable information and how it maps to "personal data" under GDPR Art. 4(1) — direct and indirect identifiers, special category data, and real examples (name, email, PESEL, IP address).Thu, 09 Jul 2026 00:00:00 GMThttps://heyamaze.com/blog/anonymization-vs-pseudonymization/https://heyamaze.com/blog/anonymization-vs-pseudonymization/Anonymization irreversibly breaks the link between data and a person, taking the data outside the GDPR. Pseudonymization is reversible and the data remains personal data. See the differences, practical examples, and when each is required.Wed, 08 Jul 2026 00:00:00 GMT