How to use AI with client documents without leaking personal data

Why client documents need care before they reach an AI

When you paste a client document into ChatGPT, Claude or Gemini, everything in it is sent to the provider. That includes names, dates of birth, account numbers and anything else the document happens to contain.

For most professional work, that raises three separate questions:

• Confidentiality. Lawyers, accountants, doctors and consultants usually owe clients a duty of confidence. Sharing identifiable information with a third party can breach it, whatever the provider promises.
• Transfers. Many AI providers process data outside the UK and the EU. Sending personal data to them can be an international transfer, which under the GDPR and UK GDPR needs a lawful basis and safeguards.
• Retention. Depending on the plan and settings, a provider may keep prompts for a period, for abuse monitoring or other purposes. Once the text has left, you no longer control it.

The simplest way to reduce all three is to make sure the AI never receives the personal data in the first place.

How to use AI with client documents: four steps

The safe workflow is anonymise, check, send, restore. Each step has a clear purpose, and none of them requires you to change how you write prompts.

1. Anonymise the document

Upload the document or paste the text. LEXARIS detects more than 116 types of personal data, including names, national ID and passport numbers, addresses, phone numbers, email addresses, bank details such as IBANs, and medical codes. Each item is replaced with a token that names its type and a number, so the same person is always [PERSON_1] throughout the document.

Tokens are only one of seven replacement modes. For AI work they are usually the right choice because they are reversible and easy for the model to follow. The seven replacement modes are compared in detail in our guide to ways of replacing personal data.

2. Check before sending

Before anything goes to an AI, a GO/NO-GO check reviews the result. When you send through LEXARIS, an unchecked document cannot be sent. The check reduces risk; review the result before sharing. If something looks wrong, you can adjust the detection and run it again.

3. Send the tokenised text

Send the anonymised text to the AI you prefer, and write your prompt as usual: "Summarise the obligations of [PERSON_1]" works just as well as the original. The AI sees only tokens.

4. Restore the answer

Paste or receive the AI's answer, and restore it in one click. Every token is replaced with the original value, so the draft or summary reads as if the AI had worked on the real document.

A before-and-after example

Here is how a short passage from a client file looks before and after anonymisation.

The sentence keeps its meaning. The AI can tell that [PERSON_1] is the client, that there is an address and a phone number, and it can reason about them without knowing what they are.

Handling the AI's answer

Treat the AI's output as a draft that you restore and then review. Restoration puts the real data back; it does not check whether the AI was right.

• Keep tokens intact in follow-up prompts. If you ask further questions, refer to [PERSON_1] rather than the real name, so nothing identifying slips into the conversation.
• Watch for invented tokens. Occasionally an AI will write a token that was not in your document, such as [PERSON_7]. A token like that has no original value behind it, so read the restored text for any leftover brackets.
• Review the restored text. Read the final version with the real names in place. That is where errors of fact or tone become obvious.

Common mistakes when redacting by hand

Most leaks happen not because people are careless, but because personal data hides in places that are easy to overlook.

Manual find-and-replace

Searching for "John Smith" will not find "J. Smith", "Mr Smith", "Smith's" or a misspelling in an email thread. National insurance numbers, IBANs and phone numbers appear in many formats. Pattern-based detection catches variants that a simple search misses.

Headers, footers and metadata

Word and PDF files carry text outside the main body: headers, footers, footnotes, comments, tracked changes and document properties such as the author name. If you copy only the body text, you may be fine; if you upload the whole file, those parts travel with it.

Attachments and scans

An email often contains more personal data in its attachments than in the message itself, and a scanned PDF has no text for find-and-replace to find. LEXARIS handles EML and MSG emails together with their attachments, and scanned PDFs through OCR with the redaction burned into the image. The supported formats and their limits are covered in our guide to scans, audio and video.

Are tokens enough for data protection law?

Tokenised text is pseudonymised, not anonymised, as long as someone holds the key to reverse it. Under the GDPR, pseudonymised data can still be personal data, although whether it is personal data for a particular recipient, such as an AI provider without the key, is a question recent case law has addressed.

In practice, tokenisation is a strong safeguard: it keeps identifying details away from the provider and is named in the GDPR as a security measure. It does not remove the need to think about your lawful basis, your contracts and your records. Our guide on pseudonymisation versus anonymisation under the GDPR explains where tokens stand.

Getting started

You can try the workflow on the free tier, which covers five documents a day. For teams, the Cloud adds shared workspaces, history and an audit log, and developers can build the same steps into their own tools with the REST API, LLM proxy, Python SDK or CLI described in the developer section of the main page.

If you advise on data protection, the section for lawyers and DPOs sets out the compliance profiles and contractual terms. For more guides, see the guides hub.