Replacing names with placeholders is a good first step. Under the GDPR it does not by itself make the data anonymous. This article sets out what the regulation says, what the EU Court of Justice decided in September 2025, and what to do with that.
The short answer
Yes, in general. The GDPR says that personal data which has undergone pseudonymisation, and which could be attributed to a person by using additional information, is information about an identifiable person. If you hold the key that links "Person_1" back to a real name, the text you replaced is still personal data in your hands, and your processing of it falls under the GDPR.
The more careful answer is that it depends on who holds the data and what means they could reasonably use to identify the person. That is where the 2025 court decision matters.
What the GDPR says
Article 4(5) defines pseudonymisation as:
"the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person"
Recital 26 says that personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information, should be considered to be information on an identifiable natural person. To decide whether a person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person, including the costs and time required and the available technology.
Two practical points follow from the wording. The key has to be kept separately, with technical and organisational measures. And "identifiable" is judged on realistic means, not on whether identification is theoretically possible.
What the Court of Justice added in 2025
On 4 September 2025 the Court of Justice of the EU decided EDPS v SRB (Case C-413/23 P). It concerned comments that a banking authority passed to a consultancy after replacing the authors' identities with codes. The case was decided under Regulation 2018/1725, which applies to EU institutions, but its definitions of personal data and pseudonymisation mirror the GDPR's.
The Court held that pseudonymised data must not be regarded as personal data "in all cases and for every person". Whether data is personal for a given recipient depends on the circumstances, including whether that recipient has means reasonably likely to re-identify the people involved. The party that did the pseudonymising and holds the additional information remains in a different position from a recipient who has no way to link the codes to anyone.
This is a legal development that specialists are still working through. Do not read it as permission to send pseudonymised client data anywhere. It says the question is assessed from the recipient's side, not that the question goes away.
What this means for an AI chatbot
- You are still the controller of the original data and of the key. Your own GDPR duties apply to what you do with the document, including the replacement.
- Whether the AI provider receives personal data is a fact-specific question. Context can identify a person even without a name: a rare job, a small town, an unusual event. If someone could realistically work out who the text is about, treat it as personal data.
- Do not build your compliance position on the idea that placeholders make the text anonymous. Plan as if it may still be personal data, and treat the placeholders as one safeguard among several.
Pseudonymisation is still worth doing, and the GDPR says so. Article 32(1)(a) lists pseudonymisation among the security measures a controller may use. Recitals 28 and 78 say it can reduce risks to data subjects and supports data protection by design and by default. The regulation treats it as a safeguard, not as an exit from the regulation.
What to do in practice
- Minimise first. Send only the passage the task needs. See how to use AI tools with client documents.
- Replace every identifier, not only names. Account numbers, ID numbers and dates of birth are identifiers too. The checklist lists them.
- Keep the key on your side, separate from the text you send, and delete it when the matter ends.
- Check the provider's terms and your plan. A business plan with a data processing agreement is a different position from a free personal account. See what the data settings say.
- Get advice on the high-risk cases: health data, children's data, special categories, or anything where a breach would be serious.
The terms are used loosely in everyday talk. Anonymization, pseudonymization and redaction compares them.
Frequently asked questions
Is pseudonymised data the same as anonymous data?
No. Recital 26 says the principles of data protection do not apply to anonymous information, meaning information that does not relate to an identifiable person, or data rendered anonymous so that the person is no longer identifiable. Pseudonymised data that can be re-linked is a different category.
Does the GDPR ban using AI tools with personal data?
No. It requires a lawful basis, minimisation, security and, with a provider, an appropriate contract. Using placeholders helps with minimisation.
Does this apply outside the EU?
The UK has its own version, and many countries have similar rules. The GDPR can also apply to businesses outside the EU that serve people in it.
ClientSafe keeps the table that links placeholders to real names on your PC. The text you copy for an AI tool carries the placeholders only. You review what it found first, since no tool catches everything.
General information, not legal advice. Ask a qualified data protection adviser about your own situation.