How to pseudonymise a document before using ChatGPT

You want an AI tool to summarise a hearing report, draft a letter to the other side or compare two sets of conclusions. The joint AI guidelines of the Orde van Vlaamse Balies and AVOCATS.BE (20 January 2025) are short on this point: the lawyer pseudonymises personal data and refrains from entering personal data into prompts, input or other documents given to an AI tool (section 1.2).

This guide describes the round trip that makes this workable in daily practice: pseudonymise, ask the AI, restore.

Why pseudonymise instead of deleting

Deleting names makes the document unreadable for the AI and makes the answer useless for you: "the person" did what to whom? Pseudonymisation replaces each person, company, address or identifier with a consistent token, so the text keeps its logic:

• the same person keeps the same token everywhere, even when the document writes "Jan PEETERS", "Mr Peeters" and "J. Peeters";
• a role token such as [CLAIMANT] or [DEFENDANT] tells the AI who is who in the procedure, which a neutral [PERSON_1] does not;
• a restore key, kept on your computer, maps every token back to the original value, so the AI's answer can be turned back into a text with the real names.

A worked example

A fictitious extract from an employment file, before:

Mr Jan PEETERS, employed by Exemplum SRL since 2 May 2016, was dismissed on 14 January 2026 by a letter signed by Ms Sofie MARTENS, HR manager. He was then living at Rue des Exemples 12, 1000 Brussels.

After pseudonymisation with roles assigned (token names follow the language of the document):

[CLAIMANT], employed by [ORGANISATION_1] since 16 June 2016, was dismissed on 28 February 2026 by a letter signed by [PERSON_1], HR manager. He was then living at [ADDRESS_1].

Both dates moved by the same 45 days. The length of service, which drives the notice period, is unchanged; the actual dates are no longer visible.

The round trip with Localex

1. Open the tool, paste the text or drop the file (PDF, DOCX, TXT, MD or HTML). It is processed in this browser tab only.
2. Set the mode to Pseudonymise and choose the Before AI preset.
3. In Parties, give the main persons a role (Claimant, Defendant, Child, Witness) so they get role tokens.
4. Review the findings. Mask what the detection missed; keep in clear what the AI needs and what identifies no one, such as a court or a statutory provision.
5. Tick I have read the result and click Copy for AI. The pseudonymised text is copied together with an instruction asking the AI to keep the tokens exactly as they are.
6. In Restore key, choose a passphrase of at least 12 characters and download the encrypted key. You may also keep it in this browser for 24 hours.
7. Paste the text into the AI tool and ask your question.
8. Copy the AI's answer, open Restore, paste the answer (or load it as a DOCX), load the key and enter the passphrase. The original values come back, on your computer.
9. Read the restore report: how many values were restored, which tokens the AI altered (for example [PERSON 1] instead of [PERSON_1]) and were matched, and which tokens are missing from the answer.
10. Check the substance of the answer yourself, including every source it cites. The guidelines require it (section 1.1).

The restore key

The key is the table that links each token to its original value. It is encrypted on your computer with your passphrase (AES-GCM with a 256-bit key derived through PBKDF2-SHA-256, at least 600,000 iterations) and is never sent anywhere.

Treat it as client data. The European Data Protection Board notes that lookup tables linking pseudonyms to identities are themselves personal data and must be protected against unauthorised access (Guidelines 01/2025, para. 93). In practice:

• store the key file in the client file, and the passphrase somewhere else;
• never paste the key, or the original document, into the AI tool;
• if you lose the key or the passphrase, the originals cannot be restored. Nobody can recover them.

Practical tips

• Send less. Give the AI the passage it needs, not the whole file. Minimisation reduces what can go wrong.
• Mind the deadlines. Shifted dates keep their intervals, but weekdays and public holidays no longer match. A procedural deadline that ends on a Saturday, Sunday or public holiday moves to the next working day (art. 53 of the Judicial Code); compute such deadlines on the real dates.
• Watch the context. A name is not the only thing that identifies. "The only notary of a village of 900 inhabitants" points to one person without naming him. Generalise or remove such details. The AI features (free after e-mail verification) include a re-identification risk analysis that flags details of this kind left in clear.
• Keep the tokens intact. If the AI rewrites them, the restore step matches common variants and flags them, but a token the AI has dropped or merged cannot be restored.
• Read the AI tool's terms. The guidelines list the points to check: training, transfer and storage, further processing, location of processing, open or closed system, liability (section 1.1).

Honest limits

• Pseudonymised is not anonymous. Data that can be attributed to a person with additional information remain personal data, even when that information is held by someone else (EDPB Guidelines 01/2025, para. 22). You hold the key, so for you the text is personal data. Pseudonymisation reduces the risk; it does not remove your GDPR obligations.
• Professional secrecy is a separate rule. The same guidelines state that the lawyer never enters documents or information covered by professional secrecy or a confidentiality obligation into an AI tool, unless absolutely certain of working in a closed environment with adequate safeguards. Replacing the names does not settle whether the remaining facts may be shared. That judgement stays with you; see the bar guidelines in practice.
• Detection is not exhaustive. Checksum-validated identifiers are found reliably when well formed; names, nicknames and indirect details depend on rules and dictionaries, and the review is yours.
• The lawyer remains responsible for the AI's output (section 1.3 of the guidelines).

Related guides

• Pseudonymisation vs anonymisation (GDPR, EDPB 01/2025)
• The OVB/OBFG AI guidelines: pseudonymising in practice
• How the tool keeps your documents on your computer