Professional secrecy and ndaact.ai

The problem

Pasting a case excerpt into ChatGPT or Claude means transmitting your client’s data to a third party, OpenAI or Anthropic, who isn’t part of the trust relationship protected by professional secrecy. For a lawyer, notary or physician, that generally isn’t an option, regardless of how good the AI is.

What ndaact.ai technically does

The extension and app detect personal data in the text before sending (names, national IDs, IBANs, company numbers, email, health data…) and replace it with opaque markers. The LLM receives the markers in place of the detected values. An entity that is not detected stays in clear text. The mapping table that lets you restore the original value stays on your machine.

The exact terminology, and why it matters

This processing is client-side pseudonymisation under GDPR Art. 4(5): reversible for you (that’s what lets you read an understandable reply), so from your perspective the data remains personal data. We don’t call it “anonymisation” on your side: that would be inaccurate.

From the LLM provider’s perspective, however, the result aims for the effect of de-identification: it only receives opaque markers, without the mapping table, so it has no reasonable means of re-identifying your clients. That’s the relative approach taken by the Court of Justice of the EU (Case C-413/23 P, 4 September 2025): pseudonymised data may not constitute personal data for a given recipient when that recipient lacks reasonable means of re-identification.

What we don’t claim

• We don’t claim that using ndaact.ai automatically puts you in compliance with your professional obligations: it’s one technical measure among others, not a blanket clearance.
• We only redact the entities we detect. An indirect identifier buried in free text (“my client, the only organic baker in town”) can remain identifying by inference, even after passing through ndaact.ai.
• We don’t claim to anonymise the entire prompt, only the personal data identified as such.

For you to judge

The decision to use a general-purpose LLM on a real case, even with a technical safeguard, remains a professional decision that’s yours to make, depending on context (nature of the case, sensitivity, your professional body’s position). This page describes what the tool does, not what you should conclude for your practice.