Using ChatGPT with the GDPR in mind: send codes, not people
No tool makes your use of AI compliant on its own. What the GDPR does ask is that you send no more personal data than the task needs. Paste your text below: names and identifiers become codes, and the key that reverses them stays in this browser tab. The AI does the work on the codes.
Restoring uses the key of this tab: code your text here first, keep this tab open, then come back with the answer.
Adjust
See the key (it stays in this tab)
The key links each code to the real value. It exists only in this tab's memory: close or reload the tab and it is gone.
connect-src 'none' in its security policy) and loads no analytics. Turn Wi-Fi off once the page has loaded: the tool works just the same. The engine is the one inside the Hidden Tokens app.How it works
1 · Code
Paste a text or drop a file. Names, companies, addresses, emails, phone numbers, bank details, ID and case numbers become codes such as NAME-001 or COMPANY-001. Unknown proper nouns are coded too: when in doubt, the engine codes.
2 · Send the codes
Copy the coded text, or download the coded file, and give it to ChatGPT, Claude, Gemini or Copilot. The AI reasons on the codes: it still knows who did what, not who they are.
3 · Restore
Paste the AI's answer in the Restore tab, in the same browser tab. The codes become the real names again, on your screen only.
Example: an HR grievance to summarise
Grievance from Daniel Kowalczyk (employee no. 30418) against his line manager, Sarah Pennington: he says she told the team about his medical leave on 2 October. He asks for a meeting with HR and union representation.Grievance from FIRSTNAME-001 NAME-001 (employee no. REF-001) against his line manager, FIRSTNAME-002 NAME-002: he says she told the team about his medical leave on 2 October. He asks for a meeting with HR and union representation.The employee, his number and his manager are coded. The facts stay readable, including the medical leave: that is health-related information. If the AI does not need it to answer, generalise it (“a leave of absence”) before sending.
What the GDPR says, and what coding does about it
Four parts of the GDPR are directly relevant when you paste work into an AI:
- Data minimisation (Article 5(1)(c)). Personal data must be limited to what is necessary. An AI asked to summarise a grievance does not need the employee's name: coding it is minimisation in practice.
- Pseudonymisation (Articles 4(5), 25 and 32). The regulation names pseudonymisation as a security measure and as part of data protection by design. This tool pseudonymises: each value becomes a code, and the key stays with you.
- Still personal data (Recital 26). For you, who hold the key, the coded text remains personal data. Your other obligations, such as a lawful basis and informing people, remain.
- Special categories (Article 9). Health, union membership and similar data need extra care. Coding names does not code the health information itself: remove or generalise it.
This is information, not legal advice. For a team, the Hidden Tokens app adds what an auditor will ask for: a policy applied on every computer, one key per case file, and a signed record of what each AI received.
The free tool or the Hidden Tokens app?
This free tool
- One text or one file at a time
- Up to 3,000 words or 1,000 spreadsheet rows
- The key lives in this tab and disappears when you close it
- Word, Excel, CSV and text
The Hidden Tokens app
- Whole folders: the same person keeps the same code in every document
- One key per case file, kept on your computer
- PDF and scanned documents, read on your computer
- Inside Claude Desktop, and in ChatGPT, Gemini and Copilot with the extension
- Industry packs, firm rules and a signed proof of what the AI saw
A word on the word “anonymize”
Strictly speaking, this tool pseudonymizes: each value is replaced by a code that can be reversed with the key. Under the GDPR, pseudonymised data is still personal data for whoever holds the key, which here is you, in this tab. What the AI receives no longer names anyone directly. Clues can remain, such as a job, a town and an age together: the tool warns you when it sees them. Read the result before sending it.
Questions
Does coding make my use of ChatGPT GDPR-compliant?
No tool does that on its own. Coding reduces the personal data the AI receives and is a measure the GDPR names. Compliance also depends on your lawful basis, your contracts and your records.
Is the coded text anonymous?
No, it is pseudonymised: you hold the key in this tab. What the AI receives no longer names anyone directly, but clues can remain, and the tool flags some of them.
Where is the key?
Only in this browser tab's memory. It is not written to disk or sent anywhere, and it disappears when you close the tab.
Does it help with a DPIA?
It can be one of the measures you describe. The free tool leaves no record; the Hidden Tokens app keeps a signed log of what each AI received, which is easier to show.
Other ways to use the free tool
By file type
By AI tool
By task
For whole folders, use the app
Hidden Tokens codes whole case files on your computer with one key, works inside Claude Desktop and in your browser, reads PDFs and scans, and puts the real names back into Word and Excel files.