PII redaction means removing personal information from a text, or replacing it with placeholders, before that text reaches an AI tool. PII stands for personally identifiable information, meaning anything that makes a person identifiable: names, addresses, dates of birth, tax numbers, case references, insurance numbers, bank details.
The idea behind it is sound, and in practice it is the fastest lever available. If there is no personal data in the prompt, the processing falls outside the scope of the GDPR and a large part of your obligations goes with it. That is why I regularly hear the sentence “we redact first, the staff take care of it” in law firms and tax practices. And that is exactly where the approach falls apart in daily work.
This post explains why manual redaction reliably fails, what automation actually delivers, where its limits sit, and what a workflow looks like that you can explain to an auditor.
Anonymisation or pseudonymisation: the distinction decides everything
The two terms get used interchangeably in everyday conversation. In law they are entirely different things.
Anonymisation means the person can no longer be identified with reasonable effort, not by anyone else and not by you, including by combining the text with other information you hold. Recital 26 GDPR makes clear that anonymous data falls outside the regulation. That is the target if you genuinely want the obligations to go away.
Pseudonymisation under Article 4(5) GDPR means the link to the person can still be restored using additional information that you keep separately. It is a protective measure in the sense of Article 32, explicitly encouraged, but the data remain personal data and every obligation continues to apply.
The practical difference: if you replace “Mr Müller” with “Client A” in a case summary and your file records who Client A is, you have pseudonymised. The risk goes down, the legal position does not change. Anyone who believes this takes the processing outside the GDPR is documenting the wrong thing and will be surprised during an inspection.
One more point that small firms tend to underestimate. Anonymity is context dependent. “A baker in a small town in the Upper Palatinate with three branches and a tax audit in 2024” contains no name and is still not anonymous. Where the combination of attributes is rare, very few details are enough to re-identify someone. I covered the underlying questions in more depth in the five questions before processing personal data with AI.
Why does manual redaction fail?
It does not fail because staff are careless. It fails because of how the task is structured. Four reasons I see over and over.
Time pressure works against it. The reason someone opens an AI tool in the first place is speed. A workflow that demands five minutes of manual work before every input cancels out the benefit. People do not resolve that contradiction by redacting more carefully. They resolve it by eventually not redacting at all.
Completeness is the hard half. Everyone removes the name. What gets missed is the case reference in the file name, the address in the letterhead, the IBAN in an attachment, the date of birth in a spreadsheet cell, the initials in a signature block, the metadata in a copied file. A redaction with one gap is not a redaction.
Contextual detail stays in. Even when every direct identifier is gone, the combination of attributes that gives the person away tends to survive. This is the mistake that catches experienced case handlers too, because familiarity with the matter hides it from view.
It cannot be evidenced. Even if every member of staff redacts properly every single time, you cannot demonstrate it. There is no log, no sample check, no record. For Article 5(2) GDPR, the accountability principle, a measure nobody can verify is close to no measure at all.
The fourth point is the most important one and usually the last to be understood. A policy that requires manual redaction is a promise. An automated step in the workflow is a technical and organisational measure that you can enter in your records of processing activities and produce when asked.
How does automated redaction work technically?
Automated redaction detects personal data in a text and replaces it before the text is passed on. Three techniques are usually combined.
Patterns and checksums. Structured data such as IBANs, tax numbers, VAT identification numbers, phone numbers and email addresses follow fixed formats, some with check digits. This kind of detection is reliable and close to error free.
List matching. Names from your client records, company names, ranges of case references: anything you already hold as a list can be matched directly. In a law firm this is the strongest lever, because your practice system already knows the relevant names.
Model-based entity recognition. A language model marks names of people, places and organisations in free text, including ones that appear on no list. This covers the unstructured remainder, but it works on probabilities and is the most error prone of the three components.
On the tooling side, Microsoft Presidio is the best known open source project in this space. It combines exactly these techniques, can be extended with custom recognisers for German formats, and runs in your own environment, which is the deciding factor for anyone bound by professional secrecy. Beyond that, document management and practice software vendors increasingly ship their own redaction features, and some AI gateways include filtering as a middle layer.
Placement matters. Redaction has to sit between your system and the AI service, not after it. A filter that cleans the response has not prevented anything, because the input was already transmitted.
Where automated redaction hits its limits
Honesty matters more than sales arguments here, because automation is routinely oversold.
Detection is very good on structured patterns and noticeably weaker on free text. An IBAN is found essentially every time. A surname that is also an ordinary word (Bach, Koch, Wolf), or a name with an unusual spelling, is not. There are no meaningful general accuracy figures, because accuracy depends entirely on which documents you process. Anyone quoting you a percentage without reference to your own material is guessing.
Contextual re-identification remains unsolved. No redaction tool recognises that the combination of sector, location, company size and year identifies the person uniquely. That judgement stays with a human.
False positives break usability. If the tool redacts too aggressively, the text loses its meaning, the AI output becomes useless, and staff start looking for a way around it. A setting that is too strict is just as dangerous over time as one that is too loose.
Files are harder than text. Scanned PDFs, images, spreadsheet attachments and metadata each need their own processing step. A solution that only filters the chat window falls short the moment someone uploads a document.
The practical consequence: automated redaction is a protective layer, not a guarantee. It reduces risk substantially and makes the measure evidenceable. It does not justify assuming that no personal data remains in the text afterwards. That is also why it replaces neither a data processing agreement, nor a legal basis, nor a data protection impact assessment.
A workflow that works in a small firm
Four stages that build on each other. The first two cost no budget.
Stage 1: Define your data classes. Decide up front which content may go into an external AI tool at all. For special categories under Article 9 (health data, religious or political information) and data on criminal convictions under Article 10, the answer for external tools is simply no, redacted or not, because the residual re-identification risk is too high. That boundary belongs in your AI acceptable use policy, not in the heads of individual staff.
Stage 2: Standard cases instead of case-by-case decisions. Most AI uses in a firm repeat: drafting letters, summarising text, translation, researching a legal question. For each of those you can define once which fields get replaced and with what. A member of staff filling in a template is no longer making a judgement call under time pressure.
Stage 3: Put the technical redaction in place. Install the tool between the source and the AI service. Start with what works reliably: client records as a name list, German number formats, IBAN, email, phone. That baseline catches the bulk of the typical failures.
Stage 4: Sample checks and a log. Decide that a small share of operations gets reviewed on a regular basis, and record the results. This is the part that turns the measure into evidence, and it takes less time than most people expect. Without it you have a piece of technology but no proof.
If you are reviewing your document storage anyway: redaction helps little as long as the AI assistant can reach documents through badly maintained permissions that the user should not see in the first place. That is a separate problem, and I described it in the post on oversharing in SharePoint.
The three most common mistakes
Mistake 1: Redaction as a substitute for the contract. I see firms that redact and therefore want to skip a proper data processing agreement. That does not hold. As long as there is a residual risk that personal data slips through, you need the contractual basis. Redaction reduces risk, it does not end your responsibility as controller.
Mistake 2: Placeholders that still speak. “Client Hans M.” is not a placeholder. “[PERSON_1]” is. Consistent, meaningless placeholders have the added benefit that you can reliably substitute the real values back into the AI’s output afterwards.
Mistake 3: Set up once, never reviewed. New clients, new document types, new case reference formats: a name list from two years ago will miss half of your current caseload. Maintenance belongs in the same review cycle you use for updating your documentation.
The next step
You do not need a project to get started. Take the three most common AI use cases in your firm and write down, for each one, which details typically appear and what they should be replaced with. That takes an hour and immediately shows you which cases can be redacted cleanly and which ones should never go into an external tool in the first place.
If you want to know where else the gaps sit between what your team actually uses and what you can evidence, take my free AI compliance check. It takes 2 minutes and is a good starting point for working out where automation genuinely pays off for you.
Jose Lugo is a CISSP-certified AI compliance consultant. He advises law firms, tax advisors and financial services firms in Germany on introducing AI tools in a GDPR-compliant way.