How to anonymize data before ChatGPT & co.: placeholders, a worked example and common traps

This guide is not legal advice.

Pseudonymization vs anonymization

The difference decides whether data protection law still applies.

Switzerland: FADP and FDPIC

The Federal Act on Data Protection covers any information relating to an identified or identifiable person (Art. 5 let. a FADP); it does not use the term pseudonymization. The Federal Data Protection and Information Commissioner (FDPIC) explains it in its guide to technical and organisational measures: pseudonymized data still carry a risk of re-identification and therefore remain personal data. Data are anonymized, and outside the FADP, only once they have been irreversibly changed so that they can no longer be linked to a person without disproportionate effort.

EU: GDPR

Under Art. 4(5) GDPR, pseudonymized data can no longer be attributed to a person without additional information, which is kept separately and protected. Recital 26 says such data should still be considered information on an identifiable person; only anonymous information is outside the GDPR. The European Data Protection Board confirms this in its Guidelines 01/2025 on pseudonymisation.

In 2025, the EU Court of Justice added a nuance (C-413/23 P, on the data protection regulation for EU institutions): for recipients who cannot re-identify anyone, pseudonymized data are not personal data in every case. For you as the sender who holds the key, nothing changes.

Why it is still worth doing

• Lower risk: pseudonymization can reduce the risks for the people concerned (Recital 28 GDPR). An IBAN that was never sent cannot be stored or reused by the provider.
• Less data: the FADP requires proportionate processing (Art. 6(2)); the GDPR requires data minimisation (Art. 5(1)(c)) and names pseudonymization as a possible safeguard (Art. 25 and 32).
• Answers just as good: for a letter, a summary or a formula, the AI hardly ever needs the real values.

Whether customer data may go into an AI service at all is covered in May employees enter customer data into ChatGPT?

Four ways to redact personal data for AI

1. Placeholders: replace each value with a readable placeholder such as [CUSTOMER_1] or [IBAN_1], always the same one for the same value, so the AI can follow who is who.
2. Leave it out: anything the AI does not need for the task stays out. A reply letter does not need a social security number.
3. Generalise: swap precise details for broader ones, as the FDPIC describes: an age range instead of a date of birth, a region or canton instead of an address.
4. Sample data: for formulas, scripts or spreadsheets, a few made-up rows with the same structure are often enough.

Before and after

This is how a request from the inbox becomes a text that can go into an AI chat:

The AI drafts the letter with placeholders; you fill in the real values afterwards in your own mail client. The social security number is left out entirely. All values shown are sample values, not real data.

Common traps

• Context gives the person away: the FDPIC cites a record without a name: a woman, 42, from a small village, with a diagnosis and a surgery date. Anyone who knows the village and her age can still identify her. “The managing director of our biggest client” is not a pseudonym either.
• File names: Quote_Max_Muster.pdf reveals the name on upload, however well the content is cleaned.
• Document metadata: files can carry the author, title, comments, tracked changes and hidden text; spreadsheets can hide rows or whole sheets, as the UK Information Commissioner’s Office (ICO) warns. More in Uploading documents to AI tools.
• Screenshots and redaction: an image shows everything visible, including sender lines or names in other windows. A black box over text in a PDF only hides it; the text stays in the file. Pixelating can be reversible, the ICO warns.
• The key in the same chat: adding “[CUSTOMER_1] is Max Muster” undoes all the work.

How AImori helps

By hand this is tedious. AImori does it locally in your browser before anything is sent:

• Placeholders: every detected value becomes [TYPE_n], for example [IBAN_1] or [EMAIL_1]; the same value always gets the same placeholder within a tab. The mapping lives only in the tab’s memory. Replies with placeholders can be shown with the real values, only in a view of the extension, never on the AI site.
• Alt+Shift+L replaces all detected values in the input field. Tip: paste rather than type. When you paste, values are replaced first; when you type, the site may already have seen them.
• Rephrase safely swaps sensitive details for general descriptions.
• Files: TXT, CSV, MD, PDF, DOCX and XLSX files are checked on upload. “Upload cleaned version” sends a cleaned copy, and for DOCX also clears the author details.

The AI site only sees the type and number of replaced values, never the values themselves. Context such as “biggest client” is still yours to check. See what would be detected in your text with the free test, no installation needed.

Frequently asked questions