Document anonymization before using AI - PESEL, NIP, GDPR and professional secrecy
How and why to anonymize documents before they reach a cloud AI: recognizing PESEL, NIP and addresses, offline processing, GDPR and professional secrecy.
Anonymizing documents before using AI means removing personal data from them - PESEL, NIP, names, addresses - before the file reaches an AI tool, especially a cloud one. It makes sense wherever you want to use AI but cannot let sensitive data leave the company: in a law firm, an HR department, a clinic. The key point is that the cleaning happens locally - only a document without personal data goes to the cloud.
Below: why it matters, how recognizing Polish identifiers works, how anonymization reconciles GDPR and professional secrecy with the convenience of the cloud - and, honestly, what it does not solve.
The problem: cloud AI sees everything you send it
Every document uploaded to a cloud AI tool leaves your network in full. Along with it goes data that often shouldn’t: PESEL and NIP numbers, client names, addresses, case data. It lands on someone else’s server - and up comes the question you can’t answer: who has access, how long it’s kept, and whether it’s used further.
For many companies that’s an inconvenience. For a law firm it’s a risk of breaching professional secrecy; for an HR department or a clinic, personal data on someone else’s infrastructure.
What it means for GDPR and professional secrecy
GDPR requires you to know where personal data goes and who processes it. Sending a document with PESEL numbers to a cloud AI is a transfer of data to a third party - with the whole list of obligations that follow. In professions of public trust - lawyers, legal advisers, doctors - there’s also professional secrecy, which the cloud simply cannot guarantee.
Anonymization solves this at the source: if the document no longer contains personal data, there’s nothing to protect on the other side.
How anonymizing Polish identifiers works
Polish identifiers have a characteristic, recognizable structure:
- PESEL - 11 digits with an encoded date of birth and a checksum,
- NIP - 10 digits with a check digit,
- names and addresses - recognized by patterns and context.
The tool passes through the document, detects those fragments and masks or removes them. All of it happens offline, on your hardware - the document never leaves the network at any stage of cleaning. Only the cleaned file can then (if you want) go further.
Anonymization as a bridge to the cloud
Not every company is ready for a full, local AI deployment - and it doesn’t have to be to start safely. Anonymization is the half-step that gives the most: you clean the document locally, then use convenient cloud tools on data that has stopped being sensitive. You limit the risk instead of exporting it whole.
It’s a good entry into AI for business for those who want to use the cloud but cannot let specific data see it.
What anonymization does NOT solve - honestly
Anonymization is not a magic button, and that’s how we talk about it:
- Context can give people away. Even without a name, the description of a case or situation can identify someone. The scope of cleaning has to be thought through.
- Effectiveness depends on document quality. Poor scans, unusual formats and typos make recognition harder - worth testing on your own documents.
- It doesn’t replace the decision of what to send at all. Anonymization lowers risk, but it doesn’t excuse you from thinking about which data truly needs to reach the AI.
That’s why the scope and method of anonymization are matched to the specific case, not applied the same way to everything.
Summary
Anonymization before AI lets you use artificial intelligence where it would normally be too risky - because sensitive data disappears before anything leaves the company. For law firms, HR and healthcare it’s often the only way to reach for cloud AI at all while staying in line with GDPR and professional secrecy. But it’s a tool, not a spell: what and how you clean is what counts.
If you want to test anonymization on your own documents - describe your case. We’ll show what and how we recognize, and where the limits are.
Need this in your business?
AI for Business →Frequently asked questions
Do I have to anonymize documents before sending them to ChatGPT?
If a document contains personal data or data covered by professional secrecy, and the AI tool runs in the cloud - then yes, it's worth anonymizing it first. Otherwise you send PESEL numbers, names and addresses to someone else's server, often beyond your control. Local anonymization lets you use the cloud without exporting data that shouldn't leave.
How do you detect PESEL and NIP in a document automatically?
Polish identifiers have a characteristic structure (PESEL is 11 digits with a checksum and an encoded date; NIP is 10 digits with a check digit), so they can be detected automatically along with names and addresses. The tool passes through the document and masks or removes those fragments - all locally, without sending anything outside.
Is anonymization alone enough for GDPR compliance?
Anonymization strongly reduces risk, but it's not a magic button. If the removal of identifiers is effective and irreversible, the data stops being personal. But context matters - sometimes the description alone can identify someone - which is why the scope of anonymization is matched to the specific case.
Does anonymization work offline?
Yes, and that's the whole point. Recognizing and removing the data happens on your hardware, before the document goes anywhere. Only the cleaned file (if at all) goes to the cloud. This way sensitive data never leaves your network, not even for the moment of processing.