Sending an employee's CV to ChatGPT to summarize it? You're violating GDPR. Sending an invoice with a tax ID to Claude — you're violating it. Customer mailing list to Gemini for rewriting? Also violating. I know because I did all three for six months.
This article shows how to anonymize personal data locally, before anything leaves your machine for the LLM API. Plus my open-source project that adds Polish recognizers to Microsoft Presidio — because default Presidio handles English well, but Polish identifiers (PESEL, NIP, REGON) are completely invisible to it.
The problem: every LLM sees your personal data
Standard Claude / GPT usage in a company looks like this:
- Marketing writes to a customer base → pastes a sample mailing into ChatGPT, asks for improvement
- HR has 50 CVs to review → uploads the batch to Claude, asks for a shortlist
- Accounting wants invoice analytics → drops a CSV with national IDs into Gemini
In all three cases personal data ends up on the provider's servers. Anthropic, OpenAI, Google log this data (at least for moderation). They may use it for training (depends on the plan — Enterprise typically doesn't, free tier typically does).
This is your customers' personal data. You don't have a legal basis to send it there unless you have a clear processing agreement (GDPR Art. 28, or CCPA equivalent) with the AI provider. Anthropic offers DPA for Enterprise. OpenAI does. Google does. Free / Plus accounts? You don't.
European DPAs are starting to enforce. Polish UODO already issues fines. EUR 7,000 per single incident is the baseline. Simple math: one marketing person, six months of daily uploads with customer names = 18,000 incidents. Penalties scale into hundreds of thousands.
The solution: local anonymization BEFORE the LLM
Architecture that works:
[your document with PII]
↓
[Presidio NER → detects national ID, tax ID, names, addresses, emails]
↓
[tokenization: "John Smith" → "<PERSON_1>", "123-45-6789" → "<SSN_1>"]
↓
[anonymized text → LLM API (Claude/GPT/Gemini)]
↓
[LLM response with tokens <PERSON_1>]
↓
[re-identification: "<PERSON_1>" → "John Smith"]
↓
[final response for the user]Important: tokens stay only in your process memory. They never leave your local machine. The LLM only ever sees anonymized versions.
Microsoft Presidio — solid base, but English-first
Microsoft Presidio is an open-source PII detection and anonymization toolkit. Two components: Analyzer (finds PII) and Anonymizer (replaces with tokens or fake values).
It supports 50+ PII types out of the box: email, phone, credit card, SSN (US), passport. All English-centric. Polish identifiers aren't there:
- PESEL (11-digit Polish national ID) — not detected
- NIP (10-digit Polish tax ID) — not detected
- REGON (9 or 14-digit company registry ID) — not detected
- Polish names (Krzysztof, Małgorzata, Bogdan) — generic SpaCy NER catches ~70% because it's trained mostly on English data
- Polish addresses (XX-XXX postal code, streets with diacritics) — sporadic
Drop a Polish CV into out-of-the-box Presidio and you get email, phone, sometimes a name. The national ID? Not happening. Which means your CV ships to the LLM with the registry number embedded.
My project: presidio-local-anonymizer
I open-sourced an addon to Presidio that fills the Polish gap. Repo: github.com/gacabartosz/presidio-local-anonymizer.
What it adds:
- PolishPESELRecognizer — regex + checksum validation (10th digit). Rejects fakes like 11111111111.
- PolishNIPRecognizer — regex + checksum. Handles dashed formats (123-456-78-90) too.
- PolishREGONRecognizer — 9 or 14 digits, checksum.
- PolishNameRecognizer — gazetteer of 10,000 common Polish first names + surnames + grammatical case variations.
- PolishAddressRecognizer — XX-XXX postal pattern + street prefixes.
Quick start — 4 lines and you have Polish-aware Presidio:
from presidio_analyzer import AnalyzerEngine
from presidio_local_anonymizer import register_polish_recognizers
analyzer = AnalyzerEngine()
register_polish_recognizers(analyzer) # ← single line, registers everything
results = analyzer.analyze(
text="Jan Kowalski (PESEL 86040512345) files a complaint",
language="pl"
)
# → detected: PERSON (Jan Kowalski), PL_PESEL (86040512345)Micro-benchmark — default Presidio vs +Polish recognizers
Test set: 50 Polish business emails (CVs, invoices, complaints, RFPs). Each contains an average of 6 PII types.
| PII type | Default Presidio | + presidio-local-anonymizer |
|---|---|---|
| 50/50 (100%) | 50/50 (100%) | |
| Phone | 48/50 (96%) | 50/50 (100%) |
| Name + surname | 34/50 (68%) | 49/50 (98%) |
| National ID (PESEL) | 0/50 (0%) | 50/50 (100%) |
| Tax ID (NIP) | 0/50 (0%) | 50/50 (100%) |
| Company ID (REGON) | 0/50 (0%) | 49/50 (98%) |
| Address (postal + street) | 12/50 (24%) | 43/50 (86%) |
| Total | 49% | 97% |
Default Presidio catches half. With Polish recognizers — 97%. The remaining 3% are corner cases (foreign address embedded in Polish text, non-standard tax ID formatting). Repo is open, contribute via GitHub Issues.
When NOT to use anonymization
Anonymization makes sense when the LLM doesn't need personal context. Email summarization, ticket classification, template drafting — anonymization works great here.
Anonymization doesn't work when:
- The LLM needs to personalize a response for a specific person ("Dear John, regarding your case...") — you must process data through a provider with DPA
- The model should infer sentiment from a name (e.g. brand mention analysis — "Adam Smith said..." — anonymization destroys semantics)
- You're working with public figures (politicians, celebrities) — public data, less protected by GDPR
What I do in practice
For my automation projects with EU clients the setup looks like this:
- Each project with PII gets its own Anthropic workspace with DPA signed with Anthropic. First line of defense — formal GDPR Art. 28 consent.
- All data passes through Presidio + Polish recognizers before hitting Claude. Tokens like <PERSON_1>, <PL_NIP_1> etc.
- Token mapping table stays locally in PostgreSQL (per-user, per-session). After receiving the LLM response — re-identify.
- Audit log of what went out to the API. Monthly report: how many records, which PII types were anonymized, how many re-identifications.
- Integration test in CI: 50 sample documents; if <90% of PII is detected → build fails.
This adds 100-300ms latency per request (Presidio isn't lightning fast), which is acceptable for most use cases — a chatbot at 200ms latency is still <1s response.
FAQ
Is it allowed to send personal data to Claude / ChatGPT?
Yes, but only if you have a Data Processing Agreement (DPA) with the provider (Anthropic Enterprise, OpenAI Enterprise, Google Cloud DPA). Free tier and Plus subscriptions typically don't qualify — check the terms. No DPA = no legal basis under GDPR Art. 28 / no compliance with CCPA's "service provider" carve-out.
What about employees using Claude / ChatGPT "off the books"?
The biggest GDPR / CCPA exposure of 2026. Employees sending customer data to free AI tools without IT's knowledge. Solutions: (1) firewall blocks on free tiers, (2) provide an alternative — internal chatbot on company data with anonymization, (3) training + procedures.
What's the cost of deploying presidio-local-anonymizer?
The software is open-source, zero license cost. Self-hosting on a typical Python backend adds minimal overhead — 100-300ms latency, ~200MB RAM. Integrating it into a web app takes about a developer-day (install + integrate + tests).
Can I use this with Claude over the API instead of UI?
Yes, and it's actually safer. You send the anonymized text via API, get a response, run re-identification on your side. Claude / ChatGPT UIs give you less control (e.g. you don't always know if session storage holds a copy).
GDPR vs CCPA — same thing?
Similar intent, different requirements. CCPA doesn't mandate DPAs the way GDPR Art. 28 does, but it does require a "do not sell" opt-out for personal information. Anonymization before the LLM helps in both regimes — if the data leaves anonymized, it's not PII under GDPR or CCPA.
Want to deploy this in your stack?
I help companies set up this flow in 1-2 weeks: integration with existing backend, security tests, compliance documentation. It's part of automation services. If you're sending customer data to LLMs without an anonymization layer — book a free Fit Call, I'll show you where to start.
Or DM me on LinkedIn with the keyword ANONYMIZATION — I'll send a checklist of 12 PII types most commonly leaked by EU companies + a DPA template to sign with Anthropic.