How to prepare documents before using ChatGPT or another AI tool
Uploading a complete document often discloses more than the task requires. Preparation is not just deleting a name: decide what the task needs, remove direct identifiers and review the clues that could still identify a person or organisation.
1. Define the task before editing the file
Write down the intended output: summarise clauses, improve the tone or extract skills. That purpose determines which passages are necessary. If two clauses are enough, do not upload the full agreement.
- Keep the source separate from the working copy.
- Remove appendices, signatures and irrelevant pages.
- List the context that must remain for a useful answer.
2. Review direct and indirect identifiers
Remove or replace names, emails, phone numbers, addresses, identity numbers, bank details and case references. Then look for subtler combinations: role, office, date, amount, client and project can identify someone even without a name.
- Use consistent placeholders such as PERSON_1 or CLIENT_A.
- Generalise dates or amounts when exact values are unnecessary.
- Check headers, footers, comments, properties and file names.
3. Check the provider and account type
Reducing the document does not replace an assessment of the service. Check account terms, retention, training controls, processing locations and permissions. Consumer, business and API services can apply different conditions.
- Read the provider's current official documentation.
- Use an approved corporate account where available.
- Do not upload data banned by internal policy, even after pseudonymisation.
4. Perform a final re-identification review
Read the copy as someone familiar with the sector would. Ask whether the remaining details could reveal the subject when combined. Verify that replacements have not altered duties, figures or relationships needed to understand the text.
- Search again for names, contacts, identifiers and internal references.
- Inspect the exported file, not only the preview.
- Record who reviewed the copy when the risk justifies it.
Limitations to keep in mind
- Pseudonymised content remains personal data when it can be reconnected to a person.
- Scanned PDFs need OCR; the current Privalume beta does not provide it.
- Preparing a file does not determine the lawful basis, DPIA requirements or contractual duties.