How to anonymise a document: method, limits and a reversible alternative

Last updated : 2026-11-04

Strict anonymisation of a document cannot be undone and is hard to guarantee; most of the time, what you need is to remove personal data before sending the document to a third party or to an AI while keeping the ability to restore it, which is pseudonymisation.

Where the line falls between the two is a debate among specialists: lawyers, DPOs, authorities and courts are still working it out. You do not need to settle it to act. What matters in practice: ndaact.ai avoids sending personal data outside your PC. For the definitions and the legal texts, see the guide on anonymisation, pseudonymisation and de-identification.

What stays in a file when you hide the text

Deleting names in the text is not enough. A file often keeps other traces:

  • metadata: author name, organisation, edit history;
  • comments and tracked changes;
  • hidden text, or text outside the visible area;
  • in a PDF, a black box drawn over text can leave that text in the file.

Word offers a document inspector that finds part of these items (File, Info, Check for Issues).

The manual method and its limits

  1. Make a copy of the document and work on the copy.
  2. Replace every name, address, number and identifier with a neutral term, everywhere, including headers, footers and the file name.
  3. Run the document inspector (Word) or clean the metadata (PDF).
  4. Have someone else review it.

The limits are well known: one miss leaves data in the clear, variants of the same name escape a search, and nothing lets you go back to find out who was who.

With ndaact.ai

ndaact.ai detects names, addresses and identifiers on your PC and replaces them with markers before the text goes to an AI. The table that lets you restore them stays on your machine, so the model’s reply can be restored with the real names.

By format:

  • PDF with text: redacted directly in the PDF (see redact a PDF).
  • Scanned PDF: refused. ndaact.ai has no OCR and cannot redact an image. The document is not sent.
  • Word, PowerPoint, Excel, OpenDocument, RTF, EPUB, CSV: the text is extracted and redacted, and comes out as Markdown. The original file is not rewritten.
  • Older .doc and .xls formats: not supported.

A limit to keep in mind: only detected entities are replaced. An entity that is not detected goes out in the clear. Read the text before sending when the stakes are high. ndaact.ai is an aid, not a guarantee.

Frequently asked questions

Can ndaact.ai anonymise a scanned PDF? No. A scan is an image with no usable text: ndaact.ai refuses it rather than send it unprotected.

Can it be undone? With markers and the table kept on your PC, yes. With strict anonymisation, no.

Is the result anonymous under the GDPR? ndaact.ai performs client-side pseudonymisation. The legal status of the result depends on the recipient and the context: see the guide on definitions.

Source: Institut Michel-Sarrazin, “Comment anonymiser un document”, accessed 3 November 2026.