# How to Anonymize Data for AI: Methods, Limits and GDPR

> To anonymize data for AI, remove or replace direct and indirect identifiers, use consistent placeholders and review by hand. Methods, limits and GDPR basics.

Source: https://sellmydata.com/guides/how-to-anonymize-data-for-ai/
Published: 2026-10-28 · Updated: 2026-10-28

## Key takeaways

- To anonymize data for AI, you change it so the people in it can't reasonably be identified, directly or by combining details. In practice that means removing or replacing names, contact details and IDs, including inside free text, and handling rare details too.
- Pseudonymization swaps identifiers for placeholders while a key that can reverse them is kept separately. Under GDPR, pseudonymized data is generally still personal data, at least for whoever can reverse it (Recital 26, Article 4(5)). According to Bird & Bird, the EU Court of Justice (CJEU) has said strongly pseudonymised data may not be personal data for a recipient who cannot re-identify anyone. Truly anonymous data falls outside GDPR's principles.
- Removing names alone is not enough. Sweeney (2000) found that 87% of the US population was likely unique on 5-digit ZIP code, gender and date of birth alone.
- For AI training, consistent placeholders (the same person always becomes [PERSON_1]) keep conversations coherent while replacing direct identifiers. Rare details still need generalizing or removing.
- This is general information, not legal advice. Confirm your obligations with counsel before relying on any classification.

To anonymize data for AI, you remove or transform everything that could identify a person, directly or indirectly, and then check that no one could reasonably work out who is who. In practice that means finding names, contact details and IDs (including inside free text), replacing them with consistent placeholders, generalizing or removing rare details and reviewing the result by hand.

Truly anonymous data is a high bar. This guide explains the methods, where they fall short and how the main laws frame the question. It is general information, not legal advice.

## What does it mean to anonymize data?

Anonymizing data means changing it so the people in it can no longer reasonably be identified, either directly or by combining details. Deleting names is a start, not the finish.

There are two kinds of identifier to think about:

- **Direct identifiers** point to one person on their own: names, email addresses, phone numbers, account or employee IDs.
- **Indirect identifiers**, which NIST calls [quasi-identifiers](https://csrc.nist.gov/pubs/sp/800/188/final), look harmless alone but can identify someone in combination: a job title, an office location, a start date. A line like “the head of finance in our Leeds office, who joined in March” names nobody, yet it may point to exactly one person.

That is why European law treats [anonymization](/glossary/anonymization/) as a question of risk, not just deleted fields. GDPR [Recital 26](https://gdpr-text.com/read/recital-26/?col=2&lang1=en&lang2=en&lang3=de) says that to decide whether someone is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, by the organization holding the data or by another person. When judging what is reasonably likely, the recital points to objective factors such as [cost, time and the technology available](https://gdpr-info.eu/recitals/no-26/), including technological developments. How this applies to your data depends on the facts, so treat it as general information and check with counsel.

### A short glossary

- **Anonymization:** changing data so no one can reasonably identify the people in it, by any means reasonably likely to be used.
- **Pseudonymization:** replacing identifiers with placeholders while a key or mapping that links them back to real people is kept separately. Whoever holds that key, or other linking information, can reverse it.
- **[De-identification](/glossary/de-identification/):** the umbrella term. NIST describes it as [any process of removing the association](https://csrc.nist.gov/pubs/sp/800/188/final) between identifying data and the person it describes.
- **Redaction:** blanking out or replacing specific pieces of text, for example with [REDACTED].
- **Placeholder:** a stable label such as [PERSON_1] that stands in for a real identifier. A placeholder is a technique, not a legal status: whether the result counts as pseudonymized depends on whether anyone keeps a mapping back to real identities.
- **Quasi-identifier:** an indirect detail, such as ZIP code or birth date, that can identify someone when combined with others.

## Anonymization vs pseudonymization vs de-identification

De-identification is the overall practice; pseudonymization swaps identifiers for placeholders while a key that can reverse them is kept; anonymization goes far enough that re-identification is no longer reasonably possible. The difference matters both legally and for how useful the data stays.

| Term | What changes | Can it be reversed? | Typical legal treatment (general information only) | Usefulness for AI |
|---|---|---|---|---|
| De-identification | Any process that removes the link between data and people | Depends on the method | Depends on the law; HIPAA and CCPA each define it in their own way | Varies with the method |
| Pseudonymization | Identifiers replaced with placeholders, and a key or mapping that can reverse them is kept separately | Yes, by whoever holds the key or other linking information | Under GDPR, generally still personal data, at least for whoever can reverse it | High: structure and relationships survive |
| Anonymization | Data changed so people can't reasonably be identified | Not by any means reasonably likely to be used | Outside GDPR's data protection principles, if truly anonymous | Can drop if heavy removal strips useful context |

GDPR [Article 4(5)](https://gdpr-text.com/read/article-4/) defines pseudonymisation as processing [personal data](/glossary/pii/) so it can no longer be attributed to a specific person without additional information, provided that information is kept separately and protected. [Recital 26](https://gdpr-text.com/read/recital-26/?col=2&lang1=en&lang2=en&lang3=de) adds that pseudonymised data which could be attributed to a person using additional information should be considered information on an identifiable person. In short, pseudonymization reduces risk but does not, on its own, take data outside the law for whoever can reverse it; the position of a recipient is discussed below. Your position depends on your data and agreements, so confirm it with counsel.

Health data in the US has its own rules. The Department of Health and Human Services describes [two methods](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html) that can satisfy the HIPAA Privacy Rule's de-identification standard: Safe Harbor and Expert Determination. Under Expert Determination, an expert adjusts features or values in the data so that unique, identifiable elements no longer exist or are not expected to exist. The [HHS guidance](https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/understanding/coveredentities/De-identification/hhs_deid_guidance.pdf), dated November 26, 2012, explains that the rules allow use and disclosure of information that neither identifies nor provides a reasonable basis to identify an individual. If you hold health information, get specialist legal advice.

## Common techniques to anonymize data

The main techniques are removal, masking, consistent placeholder substitution, generalization, aggregation and synthetic data. NIST lists [specific techniques including removing identifiers, transforming quasi-identifiers and generating synthetic data using models](https://csrc.nist.gov/pubs/sp/800/188/final).

- **Removal (suppression):** delete the field or passage entirely. Simple and strong, but you lose whatever it contained.
- **Masking and redaction:** replace the value with asterisks or a label like [REDACTED]. Good for one-off sensitive values, but every redacted person looks the same, so a model can't tell who said what.
- **Consistent placeholder substitution:** replace each identity with a stable label, so Jane becomes [PERSON_1] everywhere she appears. This keeps conversations and relationships readable. If anyone keeps a mapping from labels back to real names, the result is pseudonymized rather than anonymous, and indirect details are a separate job (generalization or removal).
- **Generalization:** make details less precise, such as an exact age becoming an age band or a full address becoming a region.
- **Aggregation:** report totals or averages instead of individual rows.
- **Synthetic data:** artificial records generated using models, which NIST lists as one de-identification technique. Check that the output still serves your purpose before relying on it.

Aggregation suits statistics and tables. It doesn't translate well to a support ticket or an email thread, where the value is in the exact words.

| Technique | Structured tables (spreadsheets, databases) | Unstructured text (chat, email, tickets, documents, code) |
|---|---|---|
| Removal | Works well: drop the column | Works for whole fields; hard inside sentences |
| Masking / redaction | Works well | Works, but loses who-said-what |
| Consistent placeholders | Works well | Best fit for keeping threads coherent |
| Generalization | Works well (age bands, regions) | Useful for job titles, places, dates in text |
| Aggregation | Good fit | Poor fit |
| Synthetic data | Possible | Possible; check it still serves your purpose |

Text is harder than a spreadsheet because identifiers aren't in labeled columns. They hide in sentences, email signatures, quoted replies, file paths, code comments, nicknames and misspellings. Context can identify someone too, as in “my manager who just moved to the Lisbon office.”

## How to anonymize data for AI training

The short answer: limit scope, find identifiers in free text, replace them consistently, handle rare details, review by hand and check your rights.

**Step 1: Decide scope.** Choose which tools, date ranges and data types to include, and leave out what you don't need. Less data in means less to clean. If you're sizing a workspace, see [how to check your Slack data volume](/guides/how-to-check-slack-data-volume/).

**Step 2: Find identifiers in free text, not just columns.** Look for names in message bodies, email signatures, phone numbers pasted into tickets, and emails, usernames or API keys in code comments and config files. Secrets such as passwords and API keys may not identify anyone, but they should never leave your company.

**Step 3: Replace identifiers with consistent placeholders.** The same person gets the same label every time, so a model can still follow who asked and who answered. For example:

- Before: “Jane Okafor (jane@example.com) asked Tom to refund order 48213. Tom replied: Jane, done.”
- After: “[PERSON_1] ([EMAIL_1]) asked [PERSON_2] to refund order [ORDER_ID_1]. [PERSON_2] replied: [PERSON_1], done.”

**Step 4: Handle indirect identifiers and rare details.** A unique job title, a two-person team or a one-off event can identify someone without a name. Generalize these (“a senior manager”, “a European office”) or remove them.

**Step 5: Review a sample by hand.** Automated detection can miss nicknames, unusual formats and context clues, so no automated pass should be treated as final. Read a real sample and fix the patterns you find.

**Step 6: Check your rights to use the data.** Removing names doesn't settle whether you're allowed to share the content. Review customer contracts, your privacy policy, employee communications and third-party content; this [rights check page](https://sellmydata.com/rights/) lists those areas. What you may do depends on your agreements and applicable law, so confirm with counsel.

### If you plan to license the data

If you're preparing data to license to an AI lab, SellMyData works through this preparation by hand with each company. The company exports data from the tools and date ranges it chooses, the data is cleaned and prepared, and the company approves the result. Before anything is listed, people's names, contact details and identifiers are replaced with consistent placeholders, and every dataset goes through the rights check described above.

The process has further safeguards. Buyers see only a redacted sample before purchase, and a licensed lab receives the de-identified dataset, never raw data. Nothing is licensed without the seller's [sign-off on the buyer, the terms and the price](https://sellmydata.com/trust/), and sellers can unlist and delete their data at any time. Company exports are [deleted within 30 days](https://sellmydata.com/security/) of the de-identified dataset being approved. For exactly what is removed, and the limits, see the [de-identification page](https://sellmydata.com/de-identification/). The wider process is covered in [how to sell your company's data to AI labs](/guides/how-to-sell-company-data-to-ai-labs/).

## Anonymizing data before sending it to an LLM

It's generally wise to strip identifiers before sending data to an AI chatbot or API (an LLM, or large language model). The job is different from preparing a training dataset: a prompt is a one-off request, while licensing is a transfer of a dataset under an agreement.

When you paste data into a chatbot or an API prompt, you're sending it to a provider to get an answer back, and what happens to it next depends on that provider's terms and your account settings. When you license a dataset for training, the terms of use are set in the license. For the basics of that model, see [what AI data licensing is](/guides/what-is-ai-data-licensing/).

Practical guidance for prompts:

- **Strip identifiers first.** Remove names, emails, phone numbers, account numbers and secrets before you paste.
- **Use placeholders you can map back locally.** Keep a small lookup table on your own machine ([PERSON_1] = the real name) and swap names back into the answer yourself. Because you keep that key, this is pseudonymization: the data is protected in transit to the provider, but it is not anonymous to you.
- **Send the minimum.** Share the paragraph you need help with, not the whole thread.
- **Check the provider's data-use terms.** Look at whether inputs may be stored or used for training, and which settings control that.
- **Check your own obligations.** Customer contracts or internal policies may limit what you can share with outside services; confirm with counsel if unsure.

## Can anonymized data be re-identified?

Yes, if the anonymization is weak. One route is a linkage attack: matching a de-identified dataset against another, public one using details they share.

Two studies show why this works: ordinary details are often unique. Latanya Sweeney found that [87% of the US population](https://dataprivacylab.org/projects/identifiability/paper1.pdf) (216 million of 248 million) likely had a unique combination of 5-digit ZIP code, gender and date of birth, and about 53% (132 million) were likely unique on place, gender and date of birth alone.

Rocher et al., writing in Nature Communications on 23 July 2019, estimated that [99.98% of Americans](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6650473/) would be correctly re-identified in any dataset using 15 demographic attributes. Imperial College London noted those attributes included [age, gender and marital status](https://www.imperial.ac.uk/news/192112/anonymising-personal-data-enough-protect-privacy/). The authors concluded that even heavily sampled anonymized datasets are unlikely to satisfy the modern standards for anonymization set by GDPR.

The lesson isn't that protection is hopeless. It's that combinations of ordinary details matter, so you manage the risk deliberately:

- **Remove rare attributes** that make a record stand out.
- **Generalize** dates, places and titles to coarser levels.
- **Limit who receives the data**, and how much of it.
- **Use contractual restrictions** that forbid recipients from attempting re-identification.
- **Share only redacted samples before a deal**, so a prospective buyer sees the format without the full dataset.

## Is anonymized data covered by GDPR?

As general information: truly anonymous data falls outside GDPR's data protection principles, while pseudonymized data generally remains personal data, at least for whoever can reverse it. Where your data sits depends on the facts, so check with counsel before relying on any label.

[Recital 26](https://gdpr-info.eu/recitals/no-26/) says data protection principles should not apply to anonymous information, meaning information that doesn't relate to an identified or identifiable person, or personal data rendered anonymous so the person is no longer identifiable. Interpretations differ on how strict that test is. A [peer-reviewed article](https://academic.oup.com/idpl/article/10/1/11/5802594) notes that Recital 26 embodies a test based on the risk of identification, whereas the Working Party, an EU advisory body of data protection regulators, developed a parallel test under which there can be no remaining risk of identification.

Guidance and case law keep developing:

- On 16 January 2025 the European Data Protection Board (EDPB) adopted its [Guidelines 01/2025 on Pseudonymisation](https://www.hunton.com/insights/publications/edpb-advises-on-pseudonymisation-for-gdpr-compliance).
- On 4 September 2025 the EU Court of Justice (CJEU) ruled in [EDPS v SRB](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A62023CJ0413). According to Bird & Bird, it was the first judgment to explicitly confirm that [sufficiently strongly pseudonymised data may be personal data for the original controller but not for a recipient](https://www.twobirds.com/en/insights/2025/eu-the-srb-decision-a-new-era-for-personal-data-and-data-processing-agreements) who can't reverse it or identify people by other means. Jones Day notes the court treated pseudonymisation as [an important method to reduce identification risk, not a blanket exemption](https://www.jonesday.com/en/insights/2025/09/cjeu-clarifies-scope-of-personal-data-in-edps-v-srb-decision).
- An EDPB document titled [Guidelines 02/2026 on Anonymisation, Version 1.0](https://www.edpb.europa.eu/system/files_en?file=2026-09%2Fedpb_guidelines_202602_anonymisation_v1_en_0.pdf) is marked as adopted on 7 July 2026; it may be a version for public consultation. It states that whether data is anonymous may vary from one entity to another, so anonymity should be assessed from each relevant party's perspective, typically anyone for whom the data is intended to be anonymous.

Other regimes use their own definitions. Under California law, [Civil Code 1798.140(m)](https://cppa.ca.gov/regulations/pdf/ccpa_statute.pdf) defines “deidentified” information as information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer, provided the business meets listed conditions. Those include taking [reasonable measures](https://codes.findlaw.com/ca/civil-code/civ-sect-1798-140/) so the data can't be associated with a consumer or household, and publicly committing to keep it in deidentified form and not to attempt to re-identify it. The 2020 amendments (the CPRA) added a requirement to [contractually obligate recipients](https://www.wlf.org/2022/08/01/wlf-legal-pulse/what-qualifies-as-deidentified-information-under-california-data-privacy-laws/) to abide by the same restrictions.

These definitions differ, and the same dataset could be treated differently under each. Talk to counsel about which laws apply to you before you classify any dataset as anonymous or deidentified.

## Frequently asked questions

### What does it mean to anonymize data?

It means changing data so the people in it can no longer reasonably be identified, either directly (names, emails, IDs) or indirectly (combinations such as job title, location and date). Under GDPR Recital 26, the test considers all means reasonably likely to be used to identify someone, not just whether names are gone.

### How do you anonymize data for AI?

Decide what data you actually need, find identifiers in free text as well as in columns, and replace them with consistent placeholders so threads still make sense. Placeholders alone don't make data anonymous, so also generalize or remove rare details, review a sample by hand, and check your rights to use the data with counsel.

### Can anonymized data be re-identified?

Yes, if the anonymization is weak, because ordinary details are often unique. Rocher et al. (2019) estimated that 99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes, which is why removing rare details and limiting who receives data matter.

### What is pseudo-anonymized (pseudonymized) data?

Pseudonymized data has its identifiers replaced with placeholders, while a key or mapping that can link them back is kept separately. GDPR Article 4(5) defines the term, and Recital 26 says pseudonymised data that could be attributed to a person using additional information should be considered information on an identifiable person; how that applies to a recipient who cannot reverse it is developing (see EDPS v SRB, a 2025 EU Court of Justice ruling). Check with counsel for your situation.

### Is anonymized data covered by GDPR?

As general information, Recital 26 says data protection principles do not apply to truly anonymous information, while pseudonymized data is generally still personal data, at least for whoever can reverse it. According to Bird & Bird, the EU Court of Justice (CJEU) has said strongly pseudonymised data may not be personal data for a recipient who cannot re-identify anyone. Where the line falls depends on the facts, so talk to counsel before relying on it.

### Should I anonymize data before sending it to an LLM?

Generally it is sensible to strip identifiers before prompting, using placeholders you can map back on your own machine. Also check the AI provider's data-use terms and your own customer contracts, ideally with counsel.

### What's the difference between anonymization and de-identification?

De-identification is the umbrella term for any process that removes the link between data and the people it describes, as NIST defines it. Anonymization is the strongest outcome of that process, where no one can reasonably be re-identified, for example, under GDPR. HIPAA and California law define their own terms, so check with counsel which applies.

### What are direct and indirect identifiers?

Direct identifiers point to one person on their own, such as names, email addresses, phone numbers, or account and employee IDs. Indirect identifiers, which NIST calls quasi-identifiers, look harmless alone but can identify someone in combination, such as a job title, an office location or a start date.

### Why is text harder to anonymize than a spreadsheet?

In text, identifiers aren't in labeled columns. They hide in sentences, email signatures, quoted replies, file paths, code comments, nicknames and misspellings, and context can identify someone too.

### How can health data be de-identified under HIPAA?

The US Department of Health and Human Services describes two methods that can satisfy the HIPAA Privacy Rule's de-identification standard: Safe Harbor and Expert Determination. If you hold health information, get specialist legal advice.

## Sources

- [Recital 26 GDPR: Not Applicable to Anonymous Data](https://gdpr-text.com/read/recital-26/?col=2&lang1=en&lang2=en&lang3=de)
- [Recital 26: Not Applicable to Anonymous Data](https://gdpr-info.eu/recitals/no-26/)
- [Article 4 GDPR: Definitions](https://gdpr-text.com/read/article-4/)
- [International Data Privacy Law, Vol. 10, Issue 1, p. 11 (article on anonymous data under the GDPR)](https://academic.oup.com/idpl/article/10/1/11/5802594)
- [Guidelines 02/2026 on Anonymisation, Version 1.0](https://www.edpb.europa.eu/system/files_en?file=2026-09%2Fedpb_guidelines_202602_anonymisation_v1_en_0.pdf)
- [EDPB Advises on Pseudonymisation for GDPR Compliance](https://www.hunton.com/insights/publications/edpb-advises-on-pseudonymisation-for-gdpr-compliance)
- [Judgment of the Court (First Chamber) of 4 September 2025, EDPS v SRB](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A62023CJ0413)
- [EU: The SRB decision – a new era for personal data and data processing agreements](https://www.twobirds.com/en/insights/2025/eu-the-srb-decision-a-new-era-for-personal-data-and-data-processing-agreements)
- [CJEU Clarifies Scope of Personal Data in EDPS v. SRB Decision](https://www.jonesday.com/en/insights/2025/09/cjeu-clarifies-scope-of-personal-data-in-edps-v-srb-decision)
- [Methods for De-identification of PHI](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html)
- [Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the HIPAA Privacy Rule (November 26, 2012)](https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/understanding/coveredentities/De-identification/hhs_deid_guidance.pdf)
- [California Consumer Privacy Act of 2018 (statute text)](https://cppa.ca.gov/regulations/pdf/ccpa_statute.pdf)
- [California Civil Code § 1798.140](https://codes.findlaw.com/ca/civil-code/civ-sect-1798-140/)
- [What Qualifies as Deidentified Information Under California Data Privacy Laws?](https://www.wlf.org/2022/08/01/wlf-legal-pulse/what-qualifies-as-deidentified-information-under-california-data-privacy-laws/)
- [Simple Demographics Often Identify People Uniquely (Sweeney, 2000)](https://dataprivacylab.org/projects/identifiability/paper1.pdf)
- [Estimating the success of re-identifications in incomplete datasets using generative models (Rocher et al., 2019)](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6650473/)
- [Anonymising personal data 'not enough to protect privacy'](https://www.imperial.ac.uk/news/192112/anonymising-personal-data-enough-protect-privacy/)
- [SP 800-188, De-Identifying Government Datasets: Techniques and Governance](https://csrc.nist.gov/pubs/sp/800/188/final)
- [De-identification](https://sellmydata.com/de-identification/)
- [Rights](https://sellmydata.com/rights/)
- [Trust](https://sellmydata.com/trust/)
- [Security](https://sellmydata.com/security/)