PII redaction· Privacy and security
PII Redaction — Removing Personal Data Before a Chatbot Passes It On
Quick answer: PII redaction puts a filter between the customer and the model. The filter finds personal details in a message, swaps them for placeholders such as <PERSON_1>, and only then lets the text move on. The model can still understand the request, but it never sees the real name or email. Detection is automated, so it misses some items; redaction reduces exposure rather than removing it.
How PII redaction works
Most redaction pipelines have two stages, and Microsoft's open-source Presidio is a clear example of the split. An analyzer finds personal data in text. An anonymizer then changes what was found. Presidio's documentation lists the detection methods it combines: named entity recognition (a language model that tags names, places and similar items), regular expressions, rule-based logic, checksum validation (for example, whether a card number passes its check digit), and context from the surrounding words.
The second stage applies an operator to each match. Presidio's anonymizer documentation lists replace (swap for a value or the entity type, such as <PHONE_NUMBER>), redact (remove), mask (hide some characters), hash, encrypt, keep and custom. Other tools use different names, but the choices are the same.
Redaction, masking, pseudonymization and anonymization
These terms are often mixed up.
| Term | What happens to the data | Can the original be recovered? |
|---|---|---|
| Redaction | Detected items are removed or replaced with a label | No, unless a copy is kept elsewhere |
| Masking | Part of a value is hidden, such as ****1234 | Not from the output alone |
| Pseudonymization | An identifier is replaced with a consistent stand-in, such as <PERSON_1> | Yes, if a mapping is kept separately |
| Anonymization | Data is altered so a person can no longer be identified | Not by design, and hard to prove |
NIST's glossary describes pseudonymization as a de-identification technique that replaces a person's identifier with a pseudonym to conceal who the person is. That is the technique behind reversible placeholders. It is weaker than true anonymization, because whoever holds the mapping, or enough other details in the text, may still be able to identify the person. Regulations treat pseudonymized data differently from anonymous data, so ask a qualified adviser which one applies to you.
Reversible placeholders
A chatbot often needs the real value later. If a customer gives an email address and the reply should say "we sent the receipt to that address," the placeholder must be turned back. A common pattern keeps a small lookup table on your own server: <EMAIL_1> maps to the real address. The model sees only the placeholder; your code swaps the real value back into the reply before the customer reads it. Presidio documents an encrypt operator with a matching decrypt, which is one way to make the swap reversible. The table itself is then personal data and needs the same protection and retention limits as any customer record; see data retention policy.
Why a chatbot team does it
OWASP's LLM02:2025 entry, on sensitive information disclosure, notes that personal data can be exposed through interactions with a language model. Its listed mitigations include sanitizing or masking sensitive content, input validation, and redaction by pattern matching, alongside access controls. It also warns that restrictions written into a system prompt may not always be honored and can be bypassed by prompt injection, which is why removing data before the call is stronger than asking the model to keep it quiet.
Provider terms are the other reason. OpenAI's data-controls guide says data sent to its API is not used to train its models unless a customer opts in, and that abuse-monitoring logs are retained for up to 30 days by default, with zero data retention available only with prior approval. Terms differ by provider, plan and endpoint, and sending less personal data means less to govern under any of them.
Limits of redaction
Missed items. Presidio's documentation states plainly that automated detection cannot guarantee finding all sensitive information and that other safeguards are needed. Unusual name spellings, addresses typed in free form, and identifiers specific to your business are the usual misses.
False positives. Over-eager detection can replace a product name with <PERSON_2> and confuse the model.
Indirect identifiers. A job title plus a small town plus a date can identify someone with no name in sight. Redaction tools mostly look for direct identifiers.
Lost meaning. Removing too much can make a message unanswerable.
Other copies. Redaction before the model does nothing for transcripts, analytics tools or logs that capture the raw text earlier. See audit logs.
Worked example (invented numbers)
A team samples 100 real customer messages and hand-marks every personal item: 160 in total (names, emails, phone numbers, order numbers, addresses). Their detector catches 136.
- Recall is 136 ÷ 160 = 0.85, so 15% of items, 24 in the sample, get through.
- If the chatbot handles 1,000 such messages a month and the sample is typical, that is 1,000 × 1.6 = 1,600 items, of which 1,600 × 0.15 = 240 would reach the model.
- After they add a custom pattern for their order-number format, the detector catches 148 of 160. Recall is 148 ÷ 160 = 0.925, leaving 7.5%, so 1,600 × 0.075 = 120 items a month.
The point is the method: measure on your own messages, find which kinds of item slip through, and fix those. Do not assume any tool's published accuracy transfers to your data.
FAQ
What is PII redaction?
Detecting personal data in text and removing or replacing it before the text moves on to another system, such as an AI model.
Is redaction the same as anonymization?
No. Redaction removes items from text. Anonymization is a stronger claim: that the person can no longer be identified at all, which is hard to prove.
Can the model still answer if names and emails are removed?
Usually yes, if placeholders keep the structure. Replace rather than delete, so the model knows a name was there.
Does redaction make a chatbot GDPR compliant?
No. It is one technical measure. Compliance also covers legal basis, notices, retention, rights requests and contracts; see the GDPR chatbot guide and ask a qualified adviser.
What is the difference between redaction and masking?
Masking hides part of a value (****1234); redaction removes or labels the whole item.
Do I still need redaction if my provider does not train on my data?
It can still help. Data may be logged for a period, reach a second provider, or appear in your own transcripts.
Related terms
- LLM security — the wider set of risks, including data disclosure.
- Prompt injection — one way prompt-level privacy rules get bypassed.
- AI guardrails — checks on inputs and outputs, where redaction often sits.
- LLM gateway — a layer where redaction can run for every request.
- Data retention policy — how long raw text and mapping tables are kept.
- Entity extraction — the same detection idea, used to pull data out rather than hide it.
Sources
- Presidio documentation — presidio.dataprivacystack.org and its anonymizer page, read 28 October 2026. Source of the analyzer and anonymizer split, detection methods, operators, the encrypt and decrypt pair, and the statement that detection cannot guarantee finding all sensitive information.
- OWASP, LLM02:2025 Sensitive Information Disclosure — genai.owasp.org/llmrisk/llm022025-sensitive-information-disclosure, read 28 October 2026. Source of the disclosure risk, the mitigations and the warning about system-prompt restrictions.
- NIST CSRC, pseudonymization glossary entry — csrc.nist.gov/glossary/term/pseudonymization, read 28 October 2026. Source of the definition.
- OpenAI, Data controls in the OpenAI platform — developers.openai.com/api/docs/guides/your-data, read 28 October 2026. Source of the training, 30-day abuse-monitoring log and zero-data-retention statements.
- Chatbotscape evaluation methodology. /methodology (continuously updated).