Questions
Is anonymizing a document enough before using AI?
It is a strong first step, not a finish line. Removing names and identifiers reduces what the AI provider receives, yet the remaining facts can still identify someone: the Law Society of Ontario warns that “anonymizing is not perfect.” And if you keep a key to restore the names, the copy is pseudonymized, not anonymous. Reduce the residual risk by removing indirect identifiers, sharing only what the task needs, and reviewing the full copy.
Last reviewed · 3 sources
Why removed names are not the whole story
The Law Society of Ontario’s white paper puts it plainly: “Even in instances where a licensee anonymizes input data, there may be residual risks. It may be able to piece together information from the anonymized facts provided.”
A document about “a 52-year-old paramedic from a town of 800 people” identifies someone without a name. Detection tools also miss details, particularly in scans, tables and handwriting.
How to reduce what remains
- Generalize specific facts: an age range instead of an age, a region instead of a town
- Leave out details the task does not need
- Check headers, footers, file names and metadata
- Read the full copy as if you were trying to identify the person
- Where confidentiality still cannot be protected, follow your profession’s consent requirements
What removing identifiers does achieve
It aligns with regulators’ baseline expectations. The Office of the Privacy Commissioner of Canada asks organisations to limit disclosure “to only what is needed,” and Canadian law societies ask lawyers to remove identifying client information before using generative AI.
Be precise about the result. A tool that restores names afterwards, PiBye included, swaps identifiers for tokens and keeps a key. That is pseudonymization: the AI provider cannot reverse the tokens, but the copy remains personal information for you, so your confidentiality and consent obligations still apply to it.
Where PiBye fits
How PiBye handles this
PiBye swaps direct identifiers such as names, ID numbers, addresses and postal codes for tokens on your Mac, keeps the key there, and then shows you the complete approved copy, so the indirect-identifier review happens on exactly what the AI will receive.
1.0.1 · macOS 14.8.5 or later · Apple Silicon · 1.1 GB
Frequently asked questions
What is an indirect identifier?
A fact that identifies a person in combination with others, such as a rare job, a small place or a specific date.
Can anonymized text be re-identified?
Sometimes, from the facts that remain. That is why regulators describe anonymizing as imperfect. Text with placeholders can also be reversed by whoever holds the key, so keep the key off the AI platform.
Sources
- Licensee use of generative artificial intelligence (white paper), Law Society of Ontario, April 2024. Checked 17 September 2026.
- Principles for responsible, trustworthy and privacy-protective generative AI technologies, Office of the Privacy Commissioner of Canada, December 7, 2023. Checked 17 September 2026.
- Guidance on Professional Responsibility and Generative AI, Law Society of British Columbia, October 2023. Checked 17 September 2026.