FAQ: PII, GDPR & AI Privacy Questions

PII stands for Personally Identifiable Information, any data that can identify a specific person, directly or in combination with other data. Examples include names, email addresses, phone numbers, national ID numbers, IP addresses, and dates of birth.

It depends on what is in the document. If it contains personal data, sending it to an AI tool means that data leaves your organisation and is processed on external servers, potentially a GDPR violation. Remove PII first with PrivacyPromptAI and the risk disappears.

Yes. GDPR has extraterritorial reach under Article 3. It applies to any organisation that processes personal data of EU residents in connection with offering goods or services to them, or monitoring their behaviour, regardless of where the organisation is based.

Anonymisation permanently removes all identifying information so that re-identification is impossible, anonymised data falls outside GDPR entirely. Pseudonymisation replaces identifiers with tokens or codes, but re-identification is still possible if you have the key. PrivacyPromptAI performs pseudonymisation: PII is replaced with tokens like [NAME_1] or [EMAIL_1], preserving document structure while removing exposed identifiers. True anonymisation requires additional steps and careful verification.

PrivacyPromptAI can help reduce HIPAA risk when sharing medical documents with AI tools. It detects and cleans Protected Health Information (PHI) including names, dates, phone numbers, email addresses, and other identifiers listed under HIPAA's Safe Harbour method. However, PrivacyPromptAI is not a certified HIPAA compliance solution and does not replace a formal risk assessment or Business Associate Agreement. It is a practical tool for reducing exposure before AI use.

If personal data about real individuals is submitted to ChatGPT, it is processed by OpenAI's servers and may be used to train future models unless you have opted out or are using a paid API plan with data retention controls. Under GDPR, this constitutes a transfer of personal data to a third-party processor. You should document the incident, assess whether individuals are at risk, and consider notifying your Data Protection Officer. Going forward, use PrivacyPromptAI to clean all PII before pasting any document into an AI tool.

Yes. PrivacyPromptAI runs entirely in your browser, so it works on any modern mobile browser including Chrome for Android and Safari for iOS. The text paste tool and file upload section are both mobile-friendly. The browser extension is currently Chrome/Chromium desktop only and is not available as a mobile app.

No. Once a document is cleaned with PrivacyPromptAI and the original is discarded, the cleaned version cannot be reversed. The tool replaces PII with tokens such as [NAME_1] or [EMAIL_1], the original values are never stored on any server. If you need to recover the originals, you must keep a copy of the original document yourself before cleaning.

A personal data breach is any incident where personal data is accidentally or unlawfully accessed, disclosed, altered, or lost. Under GDPR, most breaches must be reported to your supervisory authority within 72 hours. Cleaning PII before sharing documents with AI tools or third parties significantly reduces breach risk: if a cleaned document is accidentally exposed, no personal data is present to be compromised.

Yes. PrivacyPromptAI lets you remove personal information from PDF documents directly in your browser, with no software to install and no account required. Simply upload your PDF, and the tool detects and removes names, emails, phone numbers, passport numbers, bank details and more. Everything happens locally on your device: the file is never uploaded to a server.

The safest approach is to remove all personal information from the document before sharing it. PrivacyPromptAI does this automatically: paste or upload your document, and it detects and removes names, contact details, financial data, identification numbers and other personal information. Once cleaned, the document contains no personal data and can be shared freely by email, file transfer or any other method.

Word documents can contain personal information in two places: inside the visible text and inside the document metadata. The text may include names, addresses, email addresses, phone numbers, identification numbers and financial details. The metadata, which is invisible to most readers, can store the author name, company name, previous editors, revision history and creation date. PrivacyPromptAI removes personal information from the document text. For metadata, you should also use the built-in Inspect Document feature in Microsoft Word before sharing.

Yes. PrivacyPromptAI includes a Batch Mode that lets you process multiple documents in one session. You can upload several files and clean them one after the other without reloading the page. Pro users can process a higher number of files and access additional formats including PDF, Excel and CSV.

PrivacyPromptAI detects personal information in 23 languages, covering all major European Union languages as well as English. This includes French, German, Spanish, Italian, Dutch, Polish, Portuguese, Romanian, Swedish, Czech, Hungarian, Bulgarian, Croatian, Danish, Finnish, Greek, Lithuanian, Latvian, Slovak, Slovenian, Estonian and Maltese. The language is detected automatically, so no manual selection is needed.

Yes. PrivacyPromptAI is designed specifically for professional and corporate use. All processing happens locally in your browser: no document content, no personal data and no file is ever sent to an external server. This means it works safely within corporate network policies and does not create any data transfer that would need to be declared under GDPR or other privacy regulations. IT departments can verify this by inspecting network traffic during use.

PrivacyPromptAI supports 23 languages and detects the language of your document automatically, with no manual selection is needed. If your document contains text in multiple languages simultaneously, detection accuracy is best for the dominant language. Pattern-based detection (emails, IBANs, phone numbers, credit cards) works reliably across all languages regardless, as these formats follow international standards. See all features →

Cleanup permanently removes personal information from a document, the data is gone and cannot be recovered. Encryption scrambles data so it can only be read with the correct key, but the original data still exists and could be exposed if the key is compromised. For sharing documents with AI tools or external parties, cleanup is generally safer: there is no key to steal and no risk of decryption. Encryption is better suited to secure storage and transmission between trusted parties.

PrivacyPromptAI cleans personal information from the text content of your document, names, emails, IBANs and other PII visible in the body of the file. It does not remove file-level metadata such as the author name, creation date or revision history embedded inside a Word or PDF file. To strip metadata, use your word processor's built-in 'Inspect Document' feature (Word) or a dedicated metadata removal tool before sharing.

Yes. While PrivacyPromptAI was designed with GDPR in mind, it is equally useful for California Consumer Privacy Act (CCPA) compliance. The CCPA defines personal information broadly, including names, email addresses, IP addresses, geolocation data and financial details. All of which PrivacyPromptAI detects and cleans. Removing this data before sharing documents with AI tools or third parties reduces your exposure under both regulations. Read about compliance →

When you close the browser tab, all text you pasted or files you uploaded are immediately cleared from memory. Nothing is saved to any server. PrivacyPromptAI stores only your settings (such as custom keywords and Pro licence status) in your browser's localStorage, which stays on your device and is never transmitted anywhere. You can also manually clear your session at any time using the 'Clear Session' button on the homepage.

Yes. Law firms regularly work with documents containing highly sensitive personal data, full legal names, signatures, case details, financial records and contact information. PrivacyPromptAI is well-suited to this environment because all processing is local: no client data ever leaves the device or touches an external server. This is critical for attorney-client privilege and GDPR compliance. The Pro tier adds PDF and batch processing, which are particularly useful for legal workflows. See Pro features →

Yes. Simply copy and paste the email thread text into the PrivacyPromptAI tool. It will detect and clean names, email addresses, phone numbers and other personal information throughout the thread, including quoted replies. For best results, paste the full thread as plain text. If you need to process many email threads at once, the Pro batch mode allows you to handle multiple files in a single session. Try it free →

PII (Personally Identifiable Information) is a broad term for any data that can identify a specific individual, names, email addresses, national IDs, IBANs and more. PHI (Protected Health Information) is a subset of PII that specifically relates to a person's health status, medical records or healthcare payments, governed by HIPAA in the United States. All PHI is PII, but not all PII is PHI. PrivacyPromptAI detects and removes both. See our full PII vs PHI guide →

Yes. Courts and legal proceedings frequently require that personal data belonging to uninvolved third parties be removed from disclosed documents. PrivacyPromptAI can strip names, addresses, contact details and financial identifiers from contracts, statements and correspondence before submission. Note that formal legal cleanup for court use may also require physical marking or certified procedures depending on the jurisdiction. PrivacyPromptAI handles the personal data removal step quickly and locally.

Yes. A handwritten or electronic signature is personal data under GDPR because it is unique to an individual and can be used to identify them. When processed using biometric recognition technology, signatures additionally qualify as biometric data under GDPR Article 9, requiring explicit consent. Any document containing signatures should be treated as containing personal data before it is shared with AI tools or third parties.

Structured personal data is organised in defined fields, rows and columns in a spreadsheet or database, where each field has a fixed meaning (name, email, date of birth). Unstructured personal data appears in free-form content such as emails, PDFs, contracts and chat logs, where personal information is embedded in natural language without a fixed format. Unstructured data is significantly harder to clean because personal details can appear anywhere in the text. PrivacyPromptAI is specifically designed to detect personal data in unstructured documents.

Yes. Sharing a cleaned copy of a document back with the original sender is a common and legitimate practice, particularly in legal, HR and compliance workflows. Once personal data belonging to third parties has been removed, the document no longer triggers GDPR obligations in relation to those individuals. The original sender, already having access to the unmodified document, is not affected by your removal of third-party data from your copy.

Yes. Payroll providers are data processors under GDPR and should only receive the minimum personal data necessary for the task. If an HR document contains information about employees not relevant to payroll, such as disciplinary notes, health records or personal contact details, those fields should be removed before sharing. PrivacyPromptAI can strip names, IBANs, national IDs and other identifiers from HR documents locally before you send them, ensuring data minimisation compliance under GDPR Article 5(1)(c).

PrivacyPromptAI processes text-based documents. Scanned PDFs that are image-only do not contain extractable text and cannot be processed directly. To use the tool with a scanned document, first run it through an OCR tool such as Adobe Acrobat, Google Docs, or a free OCR service to convert the image to selectable text, then paste or upload the result into PrivacyPromptAI.

Nothing is lost from a privacy perspective. PrivacyPromptAI processes all documents entirely in your browser, with no data is ever sent to a server. If you close the tab before copying or downloading your cleaned text, that session's data is simply discarded. No trace remains anywhere. Pro users can use the session history feature to restore recent results within the same tab session.

Yes. The Detection Categories panel lets you toggle entire PII types on or off before running detection, for example, keep dates but remove emails, phones, and IBANs. This is available to all users. Pro users additionally have access to the selective override checklist, which lets you review every detected item individually and uncheck specific instances you want to keep before erasing.

Detection sensitivity (Pro) controls how aggressively the tool flags potential PII. Strict mode uses precise patterns and minimises false positives; it flags items it is confident about. Broad mode uses looser matching and catches more potential identifiers, including partial phone numbers and standalone number sequences, at the cost of more false positives. Strict mode is recommended for most professional use cases.

Yes, Pro users can define custom replacement tokens for each PII category. Instead of [EMAIL_1] you can use [REDACTED], ████, or any label you prefer. Use {n} in the token to include a counter, for example [HIDDEN_{n}] produces [HIDDEN_1], [HIDDEN_2], and so on. Set your tokens in the Rename What Gets Removed panel and click Apply Tokens.

Yes. After cleaning, all users can download an Audit Report in JSON format listing every detected PII item, its category, original value, replacement token, and position. Pro users can also download a one-page Cleanup Summary PDF showing a category-by-category count, document name, date, and a compliance statement, useful for GDPR audit trails and Data Protection Impact Assessments.

Yes. After running Step 2: Erase, click the Compare View button in the download bar. This shows the original and cleaned text side by side in two columns so you can verify every cleanup at a glance. Available to all users, free and Pro.