On r/legaltech someone asked how firms redact sensitive information before uploading to an LLM. The best-received joke in the thread was the prompt “ChatGPT, remove sensitive info from the document”. The reply: “Congrats, you now have a job at DoJ.” (r/legaltech)
It lands because it describes what many lawyers actually do. Anonymisation performed inside the tool is not anonymisation; the document has already left the building. Knowing how to anonymise documents before AI touches them, on your own machine, is the skill that turns “never” into “sometimes, safely” for anything short of a matter-grade platform. Here is the method, and the three situations where it is not enough.
Pseudonymise, do not redact: the GDPR line
Lawyers use “anonymise” loosely. The GDPR does not. Article 4(5) defines pseudonymisation as processing personal data so that it can no longer be attributed to a person without additional information kept separately; Recital 26 treats such data as still personal, because someone holds the key. Anonymisation proper is irreversible. A placeholder workflow with a key table on your machine is therefore pseudonymisation: the GDPR still applies to the transfer, and so does professional secrecy. BRAK’s guidance for German lawyers is explicit: “Dabei reicht es regelmäßig nicht, Namen und Anschriften von Mandanten zu entfernen, wenn sich Mandatsinformationen aus dem Kontext ergeben können.”
So why not redact? Because redaction is built for disclosure, not for reasoning. The founder of ContractKen put it well in that thread: redaction “irreversibly removes text… But if your goal is to have an LLM reason over the document… you’ve just ripped out the context it needs. What you actually want for AI workflows is anonymization with label replacement”. Swap “Acme Corp” for [PARTY_A], “123 Main St” for [ADDRESS_1], “$5M” for [AMOUNT_1], then “re-hydrate the labels in the output”. A model needs to know that the party in clause 3 is the party in clause 14 and that the cap in clause 9 is smaller than the fee in clause 5. Placeholders preserve that. Black boxes destroy it.
The placeholder convention
| What | Placeholder | Rule |
|---|---|---|
| Your client | [CLIENT] | one token; never the name or initials |
| Other parties | [PARTY_A], [PARTY_B] | letters, in order of appearance |
| Individuals | [PERSON_1], [PERSON_2] | numbered; the role goes in the key table |
| Addresses, premises | [ADDRESS_1] | also plot numbers and land-registry references |
| Money and dates | [AMOUNT_1], [DATE_1] | keep currency and sequence, hide the values |
| Case, file, account numbers | [CASE_NO], [ACCOUNT_1] | any unique identifier |
| Sector tells | [PRODUCT], [SITE] | drug names, plant locations, a named vessel, a patent number |
Three rules. The same placeholder for the same entity throughout, or the model loses the thread. A two-column key table in a local file that never touches the tool. And anonymise per client, not per template: “Some clients don’t care about entity names but are hyper-sensitive about deal values”, as the ContractKen founder notes in the same thread.
The pre-paste checklist: what lives outside the visible text
Metadata is, in the ContractKen founder’s words, “a real attack surface… tracked changes, comments, document properties, embedded objects”. Before you touch a word:
- Duplicate the file and work on the copy.
- Accept all tracked changes; a rejected change can still show a deleted party name.
- Delete every comment. They carry author names and, often, the advice.
- Clear document properties. In Word, File > Info > Check for Issues > Inspect Document removes comments, properties, hidden text and headers in one pass.
- Headers, footers, footnotes: letterheads, file references and “Privileged and Confidential” lines live there.
- Embedded objects: a pasted Excel table brings its whole workbook, hidden columns included.
- Images and scans: photographs carry EXIF data (device, timestamp, sometimes location); a scanned letterhead is a name find-and-replace cannot see.
- Signature blocks, initials and email footers. The easiest leak of all.
Then the placeholder pass. Then one more read as opposing counsel trying to guess the matter.
Tools that do it for you
| Tool | What it does | Best for |
|---|---|---|
| Microsoft Presidio (open source) | detects, redacts, masks and anonymises personal data in text, images and structured data; runs locally, in front of the model | firms with IT |
| Pseudonymisation gateway (AliasPath is the example named on the thread) | swaps identifiers for consistent aliases before the external call and reverses them on return | firms that want the step invisible, or “adoption goes to zero” |
| A local model via Ollama | runs the prompt below with no third party involved | solo and small firms |
Word’s Document Inspector covers metadata; Adobe Acrobat Pro’s redaction is for court filings, not AI input. The prompt library entry for the local step:
Before I work with this document, replace every personal name, company name, address, account number, date of birth, case number and unique identifier with consistent placeholders ([PERSON_1], [COMPANY_A], [ACCOUNT_1], [DATE_1]) so that the document remains internally coherent. Also generalise contextual identifiers that would allow re-identification (unusual job titles, unique events, small towns) to a neutral description. Output the anonymised text and a separate key table. Do not summarise or alter any other content.
<document>
[paste]
</document>Read the output for leaks before it goes anywhere: initials, a signature block, a letterhead the model treated as body text. The local LLM guide covers the fifteen-minute set-up.
When anonymisation is not enough: re-identification by context
The facts identify the client. A listed company’s failed takeover in a named sector in a named month is identifiable with or without placeholders. BRAK anticipates this: the abstraction must hold “auch im Kontext”. Brooke Loesby’s example in the ABA Journal is the right instinct: not “My client Sarah is suing her business partner for embezzling $400,000” but “I am working on a partnership dispute involving allegations of financial misconduct”. Describe the matter type, not the matter.
The tool is a consumer tier. In United States v. Heppner (S.D.N.Y., February 2026), Judge Rakoff held that a defendant’s exchanges with consumer Claude were not privileged, in part because the platform’s privacy policy allowed third parties access to inputs and outputs. The tier sank them, not the content. ÖRAK is blunter: entering mandate-related information into public or unsecured AI systems “stellt einen Bruch der Verschwiegenheit dar und ist standesrechtlich unzulässig” (ÖRAK Leitfaden). The privilege guide has the 2026 cases.
The document is privileged strategy, a witness statement or protective-order material. Placeholders do not change what it is. That goes to an enterprise zero-data-retention tier, a legal platform or a local model, and nowhere else.
BRAK’s “abstract prompt” rule and § 203 StGB
For German lawyers the framework is criminal law (§ 43a Abs. 2 BRAO, § 203 Abs. 1 Nr. 3 StGB, § 43e BRAO for outsourcing), and BRAK’s Hinweise (Stand December 2024) draw the line accordingly: “Wenn möglich, sollten bei Sprachmodellen nur ‘abstrakte’ Anfragen (sog. ‘prompts’) gestellt werden, die auch im Kontext keinerlei Rückschlüsse auf ein bestimmtes Mandat zulassen.” A document that must be uploaded should first be “vollständig anonymisiert”. And the test for disclosure is access, not reading: it does not matter “ob die KI-Anbieter tatsächlich Kenntnis nehmen. Ausreichend ist … dass sie die Möglichkeit dazu haben.” The DAV’s July 2025 Stellungnahme is more relaxed about contracted providers under § 43e BRAO but treats complete anonymisation or pseudonymisation as mandatory for publicly accessible tools. The BRAK, DAV and ÖRAK comparison covers the rest.
A worked example: reviewing a limitation clause
The review prompt then works as on the real names; Katten’s diligence instruction to “identify every contract that requires third-party consent or is terminable on a change of control, and note the counterparty” is untouched, because [PARTY_A] is a counterparty. The playbook review guide has the full workflow.
You are reviewing a limitation of liability clause for [CLIENT] (the customer) under [jurisdiction] law. Parties and figures are placeholders; treat them as consistent and do not try to guess who they are.
Playbook position:
[paste, placeholders in place]
Clause 12 (verbatim, placeholders in place):
[paste]
For each deviation from the playbook: quote the words, rate the risk (low/medium/high), give one sentence of reasoning, and propose replacement wording that keeps every placeholder exactly as it is. Where the analysis depends on a hidden figure (for example whether [AMOUNT_1] exceeds twelve months' fees), say so and tell me what to check. Do not cite any case or statute unless you are certain it exists and is current; tag each one [VERIFY].Re-inserting names after the AI step
Re-insertion is find-and-replace from the key table, in reverse, on your machine. Two checks afterwards. Search the output for “[” to catch any placeholder the model altered or invented; a model asked about [PARTY_A] will occasionally introduce a [PARTY_C] that does not exist. And re-read every sentence in which a figure was hidden: the model reasoned without the number. Then log it; an audit trail with reviewer sign-off is what a regulator or insurer will ask to see.
Summarise this session as a log entry with these fields: date and time; tool, tier and model; matter reference (placeholder only); what was sent (document type; anonymised yes/no; metadata stripped yes/no); the question asked, verbatim; outputs relied on; every authority or factual claim in the output, marked "verified by [initials] on [date]" or "NOT YET VERIFIED"; placeholders re-inserted. Plain text, so I can paste it into the file.Where anonymisation ends and a commercial tier begins
Anonymisation is the workaround for the tool you have, not the strategy. On ChatGPT Business or Enterprise, Claude Team or Enterprise, or a legal platform, the vendor does not train on inputs by default, and pseudonymised client material can go in with a straight face; the confidentiality guide covers the tiers. On a consumer plan the placeholder method is what stands between you and Heppner. On no tier does it replace reading the terms: ABA Formal Opinion 512 expects lawyers to “read and understand the Terms of Use, privacy policy, and related contractual terms”.
Some exposure has nothing to do with what you paste. Microsoft Copilot in a work tenant surfaces whatever the user already has permission to see; as the ABA’s Law Technology Today put it, “Permissions set years ago and never revisited now define what an AI tool will surface on demand.” Labels and permissions, not the content of a prompt, decide what that AI can reach; the Copilot guide deals with that. And regulators watch vendors too: the Italian Garante fined OpenAI EUR 15 million on 20 December 2024 for training ChatGPT “without having an adequate legal basis”; OpenAI called the fine “disproportionate” and appealed (Lewis Silkin). A firm AI policy needs a paragraph on anonymisation, not just a list of banned tools.
Where to go next: is ChatGPT confidential for lawyers covers the tiers and opt-outs, running a local LLM is the zero-third-party option for the anonymisation step, and the confidentiality hub has the rest. The placeholder method is the first hour of AI Lab for Lawyers: you anonymise a real document yourself, badly and then properly, and use it for everything that follows.
Frequently asked questions
How do I anonymise a contract before using ChatGPT?
Work on a copy, on your own machine. Strip metadata first: accept tracked changes, delete comments, clear document properties with Word's Document Inspector, and check headers, footers and signature blocks. Replace every party, person, address, amount, date and reference number with consistent placeholders such as [PARTY_A] and [AMOUNT_1], keep the key table offline, and only then paste. Re-insert the values locally afterwards. Never ask the chatbot to do the anonymising.
Is pseudonymised data still personal data?
Yes. Under Article 4(5) GDPR, pseudonymisation means the data can no longer be attributed to a person without additional information kept separately, and Recital 26 treats such data as information on an identifiable person. A placeholder document with a key table you hold is pseudonymised, so the GDPR still governs the transfer, and German and Austrian professional-secrecy rules may still be engaged if the mandate can be inferred from context.
What tools anonymise legal documents?
Microsoft Presidio is the open-source standard: it detects and replaces personal data in text, images and structured data, runs locally and is usually placed in front of the model. Pseudonymisation gateways such as AliasPath swap identifiers for aliases before an external call and reverse them on return. A local model via Ollama can run an anonymisation prompt with no third party at all. Word's Document Inspector handles metadata; Acrobat Pro handles true PDF redaction.
Is anonymisation enough under BRAK guidance?
Only if it is complete. BRAK's Hinweise say public language models should receive only abstract prompts that allow no inference about a specific mandate, even in context, and that uploaded documents should be fully anonymised first. Removing names and addresses is regularly not enough where the mandate can be inferred. Because the mere possibility of provider access suffices under § 203 StGB, a contracted provider under § 43e BRAO or a local model is the safer route.
Can AI re-identify anonymised documents?
Not by magic, but context can. A dispute in a named sector, a unique event, a small town or an unusual job title can identify a client with every name removed, which is why BRAK requires abstraction to hold in context as well. Vendors' safety reviewers and, after a legal hold, litigants may see what you sent. Generalise contextual identifiers, and treat anonymisation as a mitigation rather than a licence to use consumer tools for client work.