Anonymize a document before you hand it to an AI
To anonymize a document, in everyday terms, is to remove everything that makes a person recognizable. Under the GDPR, the word is more demanding: data is anonymous only if no one can trace it back to the individual by reasonable means. Between these two meanings lies pseudonymization, and that is where most anonymization software, ours included, actually works.
Here we give you the landmarks for choosing the right level of protection. This page explains what the two notions cover, the role the mapping table plays, why consistent aliases keep an anonymized document useful, and how Biffer, our offline anonymization tool, applies these principles to a PDF, a Word, Excel or text file, keeping every file on your computer.
Anonymization and pseudonymization: what the GDPR says
Key points
- Anonymous data falls outside the GDPR; pseudonymized data remains fully subject to it (Recital 26).
- Replacing a name with PERSONNE_001 is pseudonymization as long as a table lets you reverse it.
- Without a table and with no reasonable possibility of re-identification, you approach anonymization; your review of the context confirms that result.
- Biffer works offline: the document stays on your computer throughout the operation.
Article 4 of the European regulation defines personal data as any information relating to an identified or identifiable person, directly or indirectly. Recital 26 draws the line: to determine whether a person is identifiable, account should be taken of all the means reasonably likely to be used, by the controller or by any other person. Without such means, the data is anonymous and falls outside the regulation. If a table, an identifier or cross-referencing still makes it possible, the data is pseudonymized and the regulation applies in full. The text is available on EUR-Lex (General Data Protection Regulation).
European regulators have spelled out these notions in the reference opinion on anonymization techniques adopted by the former Article 29 Working Party (WP29), which sets three criteria: singling out (can one person be isolated?), linkability (can records about the same person be linked?) and inference (can information about a person be deduced?). Successful anonymization withstands all three. A document in which each person carries a stable alias is still caught by the first criterion: PERSONNE_001 is singled out, even if their identity stays hidden. See WP29 Opinion 05/2014 on anonymisation techniques, which the CNIL, the French data protection authority, also draws on.
That is why we say Biffer pseudonymizes. It is a security measure the GDPR encourages (Articles 25 and 32) and which can, under certain conditions, lead to an anonymous result; the final classification depends on what remains in the document and on what you keep alongside it.
The mapping table: the dividing line
The mapping table is the file that links each alias to its original value: PERSONNE_001 to "Marie Dupont", EMAIL_002 to her address, IBAN_001 to the account number. Whether it exists changes the nature of the operation.
With a table, the document is pseudonymized. You can send the anonymized version to an AI, get back a summary, a letter or an analysis that talks about PERSONNE_001, then restore the names in that result. The GDPR continues to apply, to the whole formed by the document and the table.
Without a table, the operation is permanent. If, in addition, the remaining data shields people from any cross-referencing (a unique address, a date of birth tied to a place, a case number known to a third party), you approach anonymization. We say "approach" because the assessment depends on context: a file where only one person had a given accident on a given date remains recognizable to anyone who knows the case, even without a name. Your review of these elements completes the software's work.
In Biffer, the table is optional. If you ask for it, it is saved on your computer, either encrypted (Argon2id key derivation, AES-256-GCM encryption) or in plain text. The table stays on your machine; you use it to restore the values in the document an AI or a third party sends back. We explain how to organize this round trip on the page prepare a document for AI.
Consistent aliases for a document that stays readable
A document stays useful when you can follow its actors: knowing that the applicant and the signatory are the same person, that the email on page 3 belongs to the contact on page 1. This consistency matters to a human reader and becomes decisive for an AI asked to produce a summary or an analysis. That is what stable aliases are for.
Biffer gives each distinct value a stable alias and reuses it at every occurrence: "Marie Dupont" becomes PERSONNE_001 everywhere, her address becomes ADRESSE_001, and her lawyer's bar locker number (toque) or her doctor's RPPS number gets an alias of the same type. Readers follow the actors in the document without knowing who they are. The anonymized data stays usable: a summary, a timeline, a draft letter keep their meaning.
You stay in control of the degree of singling out mentioned above. A consistent alias distinguishes a person within the document without naming them: the ideal option for analysis. If your goal is strict anonymization for publication, the "mask" policy (every name becomes [PERSONNE]) merges all people under the same label, which strengthens protection. Biffer lets you choose for each data type: pseudonymize, mask or keep. The differences between these policies are detailed on the page redact a document.
Recognized types cover people, email addresses, phone numbers, postal addresses, French company numbers (SIREN and SIRET), French social security numbers, IBANs, license plates and dates, as well as each profession's fields (bar locker number (toque), court case number (RG), RPPS, CRPCEN notary staff number, claim number, employee ID, among others). You can add your own fields by keyword.
Anonymizing a file with Biffer: the method
Biffer is desktop software for Mac and PC (Windows), developed by Romain Rissoan, a trainer and consultant based in Lyon, France. It works offline, after you confirm your email address once, the first time you open it: your files and every fragment of text stay on your computer, which settles the question that comes before any document anonymization, namely who you hand the document to before it is protected. We expand on this on the offline software page.
1. Open the file
PDF, Word (.docx), Excel (.xlsx), CSV or text (.txt, .md), as well as images and scanned PDFs, read by character recognition then redacted by blacking out pixels, permanently.
2. Review the highlighted preview
Detected data is highlighted. You untick false positives, add whatever is missing, and each addition applies to all its occurrences.
3. Choose the policies
For each data type: pseudonymize (alias), mask ([PERSONNE]) or keep. Decide whether a mapping table is created, and whether it is encrypted.
4. Save
The text is rewritten in place, formatting is kept, and metadata (author, company, comment authors) is cleared. The anonymized file is ready to send.
Biffer is free for 5 files per month, with every feature included: the key, tied to your email address and your computer's identifier, is issued in the software once you confirm your address, once per computer. The unlimited plan, €10 excl. VAT (€12 incl. VAT) per computer, paid once, is described on the pricing page. Biffer makes your review quick, systematic and verifiable; by approving the preview, you confirm the document is ready from a GDPR standpoint.
Frequently asked questions
Is a document processed by Biffer anonymous under the GDPR?
It comes close, and you decide. Biffer pseudonymizes: it replaces each identifying item with an alias or a mask. If you keep a mapping table, the document remains pseudonymized data, subject to the GDPR. If you work without a table and the remaining information shields people from any cross-referencing, you approach anonymization as European regulators describe it. The assessment depends on the content: a document with no names but with a unique address, a date and a case number remains recognizable to anyone who has the context. Reviewing the result before sending it gives you that certainty.
What is the difference between anonymizing a PDF and anonymizing a Word file?
The principle is the same: local detection, preview, rewriting the text in place, metadata cleared. The difference lies in the format. In a Word or Excel file, the text is structured into paragraphs, cells and comments, and the formatting is kept as is. In a PDF, the text is spread across positioned objects and embedded fonts; Biffer rewrites the strings inside these objects to preserve the layout, which calls for precautions described on the page redact a PDF.
Should I keep the mapping table?
Only if you need to restore the original values. That is the case when you submit a document to an AI to get a summary, a letter or an analysis, and then want to put the names back into the result. In this scenario, we recommend the encrypted table (Argon2id and AES-256-GCM), stored on your computer. If the anonymized document is meant to be published, shared over the long term or used as an example, work without a table: the operation becomes permanent, which is exactly the effect you want. In every case, the table stays on your computer, separate from the document produced.
Can anonymized data be used to feed or train an AI?
Yes, with a much lower risk and within a framework you need to respect. EDPB Opinion 28/2024 points out that the anonymity of a model trained on personal data must be demonstrated, and the CNIL publishes guidance sheets on building training datasets. For everyday use (summarizing, rephrasing, analyzing a document with an assistant), pseudonymizing before sending keeps most of the personal data on your computer. To build a training corpus, you also check that the remaining data withstands cross-referencing, and you document the process. We detail these landmarks on the page personal data and AI.
Your business documents anonymized, ready to be published or handed to an AI tool.
Biffer runs on your computer without sending a single file. Free for five files a month, unlimited for €10 excl. VAT per computer.
100% offline · Free: 5 files a month · No file sent