PII redaction before AI checklist
Use this before sending customer, employee or operational text into a downstream AI workflow. Minimise first, detect candidates, require human review, then export a clean version that no longer contains the raw sensitive spans.
No email gate. Automated detection can miss context-specific or unusual sensitive data, so this checklist does not claim complete PII discovery, GDPR compliance or legal sufficiency.
Copyable checklist
Redact before the model path.
If unnecessary personal data is already in the outbound prompt, redacting it after generation is too late for that transmission. The preparation boundary belongs before downstream AI processing.
- [ ] Confirm the document or input is within the supported format and has a usable text layer before extraction. - [ ] Malware-scan supported uploaded documents before normal text processing. - [ ] Define the sensitive-data categories that matter for the actual downstream AI task instead of assuming one universal PII list. - [ ] Remove fields and passages the AI task does not need before running entity detection. - [ ] Run automated candidate detection as a proposal step, not as proof that every sensitive span was found. - [ ] Review every proposed redaction and reject false positives that would unnecessarily damage the downstream task. - [ ] Read the remaining text for missed names, identifiers, account details, contact details, secrets and context-specific sensitive information. - [ ] Add manual redactions for sensitive spans the automated detector missed. - [ ] Export an irreversible clean-text version for the downstream AI workflow rather than a visually masked copy that still contains hidden raw text. - [ ] Keep raw values out of model prompts, logs, traces and audit summaries unless a separately approved workflow explicitly requires them. - [ ] Verify the clean export still contains enough non-sensitive context for the intended analysis or drafting task. - [ ] Record the reviewer, redaction decision summary and export fingerprint without storing raw PII in the audit output.
12 review points
Minimise → detect → review → export → verify.
Confirm the document or input is within the supported format and has a usable text layer before extraction.
Malware-scan supported uploaded documents before normal text processing.
Define the sensitive-data categories that matter for the actual downstream AI task instead of assuming one universal PII list.
Remove fields and passages the AI task does not need before running entity detection.
Run automated candidate detection as a proposal step, not as proof that every sensitive span was found.
Review every proposed redaction and reject false positives that would unnecessarily damage the downstream task.
Read the remaining text for missed names, identifiers, account details, contact details, secrets and context-specific sensitive information.
Add manual redactions for sensitive spans the automated detector missed.
Export an irreversible clean-text version for the downstream AI workflow rather than a visually masked copy that still contains hidden raw text.
Keep raw values out of model prompts, logs, traces and audit summaries unless a separately approved workflow explicitly requires them.
Verify the clean export still contains enough non-sensitive context for the intended analysis or drafting task.
Record the reviewer, redaction decision summary and export fingerprint without storing raw PII in the audit output.
Candidate detection is not a completeness guarantee.
Names, identifiers and sensitive facts can appear in unusual formats or be sensitive only because of surrounding context. Treat automated matches as candidates, then review the text for misses and false positives before it leaves the controlled preparation workflow.
A visually blacked-out document is not necessarily safe if the original text layer remains recoverable. For downstream AI, use an irreversible clean export appropriate to the supported workflow and verify that raw values are absent from the exported text.
PII Redaction Desk supports a bounded human-reviewed redaction workflow for supported text-layer documents. It does not replace privacy counsel, a full DLP platform, document classification across every format or a guarantee that all sensitive information has been found.