7 ways to replace personal data, and when to use each

Seven ways to replace personal data at a glance

The seven ways to replace personal data differ in two things: whether you can get the original back, and what the replaced text looks like. Choosing the right one depends on what you will do with the result.

The examples below use simple values such as the name "John Smith", the IBAN GB29 NWBK 6016 1331 9268 19 and the phone number +44 20 7946 0958. LEXARIS offers all seven.

Reversible modes: token, pseudonym and format-preserving encryption

Reversible modes let you restore the original values later, as long as you hold the key. They are pseudonymisation in the sense of the GDPR.

Token

Each value is replaced with a label naming its type and a number.

Reversible: yes, with the key. Best for: sending documents to an AI and restoring the answer. Tokens are unambiguous, so the model keeps the parties apart and you can see at once what will be restored. See how to use AI with client documents.

Pseudonym

Values are replaced with realistic stand-ins: "John Smith" becomes "Peter Green", and a real phone number becomes a different, plausible one.

Reversible: yes, with the key. Best for: text that must read naturally, such as documents for review, training material or AI tasks where bracketed labels would distract. The drawback is that a pseudonym can be mistaken for a real person, so label such documents clearly.

Format-preserving encryption

Format-preserving encryption (FPE) encrypts a value so that the result has the same format as the original: an IBAN stays IBAN-shaped, a phone number stays a phone number.

Reversible: yes, with the key. Best for: databases and systems that validate formats, where a label like [IBAN_1] would break a field check.

Irreversible modes: mask, synthetic data and differential privacy

Irreversible modes cannot be undone. Use them when you will never need the original values in the output.

Mask

Part or all of a value is hidden, for example +44 20 **** **** or J*** S****.

Reversible: no. Best for: documents shared with third parties, disclosure bundles and anything published. Remember that the rest of the text may still identify someone through context.

Synthetic data

Real values are replaced with generated, realistic data. The replaced values are invented; the rest of the document may still relate to the real person.

Reversible: no. Best for: test environments, demos and developer datasets that need to look real.

ε-differential privacy

Differential privacy works on aggregates rather than individual records. Carefully calibrated noise is added to statistics, such as counts or averages, so that no single person's presence can be inferred. The parameter ε (epsilon) controls the trade-off: smaller values give stronger privacy and less precise results.

Reversible: no. Best for: reports, dashboards and research outputs built from personal data.

Keyed hashing: one-way, but not always anonymous

A keyed hash turns each value into a fixed string using HMAC-SHA-256 and a secret key. The hash itself cannot be reversed, but whether the result is anonymous depends on what else you keep.

Hash

"John Smith" might become a3f9…c21e. The same value with the same key always produces the same hash, which is what makes hashing useful: you can match records across datasets and remove duplicates without seeing the names.

• If you keep a "hash → value" lookup table, you can restore the originals from it. That is pseudonymisation.
• Without a lookup table the hash cannot be reversed, but anyone holding the secret key can test candidate values, so it remains pseudonymisation until the key is destroyed. It is not a HIPAA re-identification code.

Best for: matching and deduplication, analytics joins and pipelines where consistency matters more than readability.

Comparison table

The table sums up each mode's reversibility and typical use.

How these modes map to legal status is covered in pseudonymisation versus anonymisation under the GDPR.

How to choose: a quick decision guide

Start with one question: will you need the original values back? Then consider who will see the result.

1. You need the answer back with real names (AI drafting, summaries, analysis): use tokens. If the text must read naturally, use pseudonyms.
2. A system needs valid-looking values: use format-preserving encryption.
3. You need to match or deduplicate records: use a hash, and decide deliberately whether to keep a lookup table.
4. The result goes outside and never comes back: use a mask.
5. You need realistic test data: use synthetic data.
6. You only need statistics: use ε-differential privacy.

In spreadsheets you can combine modes by column, for example tokens for names and hashes for customer IDs; the guide to scans, spreadsheets and media shows how. Reversible modes need a key, and you can keep it in Cloud or on your own device, as explained in Keys stay with you and the Cloud and Keys comparison. All seven are summarised in the replacement modes section, and developers can use the same workflow through the API.