A support agent pastes a complaint email into ChatGPT and asks for a polite reply. The task is the reply; the name, account number and IBAN in that email are not. Prompt redaction comes down to that distinction: keeping the task while removing the real-world identifiers the model does not need, such as names, email addresses, ID numbers, payment details, medical information and secrets.
The three redaction approaches
There are three practical ways to take sensitive data out of a prompt before sending it to an AI tool:
Remove: delete the sensitive data entirely when the AI does not need it to complete the task. If you are asking for help drafting a reply to a complaint, the customer's account number is irrelevant. Delete it.
Replace: swap real identifiers for generic placeholders that keep enough context for the model to help. Replace "Mateo García" with "the customer" or "Customer A". Replace real email addresses with example.com addresses.
Mask: keep the structure but hide the value. Replace "IBAN NL91ABNA0417164300" with "IBAN [MASKED]" when the structure matters but the real value does not.
Examples by team
Support teams
Risky prompt: "Mateo García (mateo@example.com, account #47291) called to complain about an overcharge of €47. Help me draft an apology."
Safer prompt: "A customer complained about an overcharge. Help me draft an apology that acknowledges the error and explains what happens next."
The account number, name and email address are not needed for the task. The model can help draft the apology without them.
HR teams
Risky prompt: "Here are Sarah Johnson's last three performance reviews. She earns €65,000 and has had two warnings. Help me write a summary for her annual review."
Safer prompt: "An employee has had a mixed performance history with two formal warnings. Help me write a constructive annual review summary that focuses on improvement areas."
Finance teams
Risky prompt: "Invoice from Acme Corp for €127,500 for project Falcon. Terms: net 30. Approve and draft a payment confirmation."
Safer prompt: "An invoice from a vendor for €127,500 has been approved. Draft a payment confirmation email."
Legal teams
Risky prompt: "This is from the acquisition file for TechCorp BV. The deal value is €4.2M. Summarise the key risk items."
Safer prompt: "This is a due diligence summary for a mid-sized acquisition. Summarise the key risk items without client or company names."
Is anonymisation always enough?
No. Some combinations of context can still identify a person, so prompt redaction should be paired with data minimisation. Even with names removed, a prompt that includes role, department, salary range and specific dates might still identify an individual in a small organisation.
So before you hit send, look at the prompt once more and ask: what does the model actually need from this? Remove, replace or mask the rest.
