PII anonymisation in legal work: what gets stripped, what stays

By Michael Nadalin, Founder, Market Lead · 7 August 2026 · 7 min read

A witness statement goes into an AI tool. The name comes out as [PERSON_1], the home address as [ADDRESS_1], the date of birth as [DATE_1]. What is left reads: a 62 year old crane operator, injured on a Port Kembla site in the second week of March, whose employer had prior improvement notices on the same piece of plant. Nobody in that industry needs the name.

That is the gap in most conversations about PII anonymisation. The stripping works in the narrow sense that it does what it advertises. Tax file numbers, Medicare numbers, ABNs, phone numbers and email addresses have fixed shapes and get matched nearly every time. Names in clean typed text get caught most of the time. Then the tool stops, because everything else in the document is prose about a matter, and prose about a matter is the part that identifies it.

The second gap is that anonymisation answers a privacy question, while a solicitor's exposure is mostly a confidentiality question. Those are different obligations with different tests. Here is what the tooling actually removes, what it leaves behind, and where the residual risk sits.

What a PII stripper actually catches, and how

Two mechanisms do the work and they fail in different ways. The first is pattern matching. A tax file number is nine digits with a checksum, an ABN is eleven, a Medicare number has a known structure, a BSB has a fixed form, an email address has an at sign. Anything with a fixed shape can be found deterministically, and this part of the job is close to solved.

The second mechanism is named entity recognition: a statistical model that reads tokens and predicts which ones are people, organisations and places. It is a prediction, and it degrades exactly where legal documents are messiest. Witnesses whose surnames are also ordinary words. Company names that read as sentences. Transcripts that spell the same name three ways because the typist was working from audio. Interpreted evidence with transliterated names. Scanned exhibits where the text layer is thin or absent, so there is nothing to classify at all.

It pays to know which layer you are relying on. If the sensitive item is a Medicare number, the tool has it. If it is a small family company named once in a signature block on a scanned page, assume it does not.

The parts that identify a person without naming them

Re-identification is a numbers problem. Every fact left in the document narrows the pool of people it could describe, and that pool was never the population of Australia. It was the people who could plausibly be in this document. In a Sydney personal injury matter, a 40 year old woman with a lumbar injury identifies nobody. In a regional matter, the only paediatrician at the base hospital identifies exactly one person, and never needed a name to do it.

The same holds for matters containing no personal information at all. A settlement figure, a distinctive product defect, an unusual easement, the trading name left behind after the ABN was scrubbed. Commercial matters are frequently identifiable through facts that no privacy tool is designed to touch, because none of those facts are personal information.

Consistent pseudonyms make this worse in one specific way. Replacing parties with Party A and Party B preserves the relationships between them, which is precisely what the model needs to reason usefully, and precisely the structure that makes a fact pattern recognisable to a human reader.

Confidentiality is a wider net than privacy

Three obligations sit on top of the same document, and de-identification speaks to only one of them.

The Privacy Act 1988 and the Australian Privacy Principles govern personal information, and if information is genuinely de-identified so that no individual is reasonably identifiable in the circumstances, that layer largely falls away. The professional duty does not work like that. Rule 9 of the Australian Solicitors' Conduct Rules covers information that is confidential to a client and acquired during the engagement. It contains no carve-out for information that fails to identify anyone. A stripped document is still the client's confidential information, and putting it somewhere outside your control is still a disclosure.

Privilege is a third question again, and it attaches to the communication. Removing names from a letter of advice does not change what the letter is.

Where it fails quietly in real files

Most actual leaks are not sophisticated. They are the same failures that predated AI, running through a new pipe.

The one that catches careful practitioners is the conversation itself. The document is stripped properly. Then, three exchanges later, you use the client's real name because it is the only way to keep the discussion straight, and the thread now holds both the anonymised facts and the key to them. The strip only holds if every turn holds, and it rarely does.

There is also the mapping key. If you swapped names for labels and kept a note of which was which, that note is a client record. It belongs where client records live, with the same access controls and the same destruction schedule.

Sort the question before you sort the data

The practical move is to classify the task first, because a large share of legal AI use needs no client facts at all.

Research questions are the clearest case. Limitation periods, the elements of a cause of action, what a section requires, how a line of authority has shifted. None of that needs a client. If you are anonymising a document in order to ask a question of pure law, the anonymisation was never the problem, the workflow was.

The questions worth putting to a vendor

Ask the boring questions and get the answers in writing. Does the provider train on your inputs, and does that differ between the consumer tier and the business tier. How long is submitted text retained, and is retention for abuse monitoring counted separately from retention for the product. Who inside the vendor can read it, and under what process. Where is it stored. If there is a breach, who assesses it and who notifies under the Notifiable Data Breaches scheme, because the answer is usually you.

The strongest control is structural: do not send the document at all. A research tool that answers from legislation, regulation and case law needs your legal question, not your client's affidavit, and material that never leaves the firm needs no anonymisation step. Legal Brain is built on that footing. Whatever tools are already sitting in your firm, run the same test at them: what would we have to send, and what happens to it once we do.

Anonymisation is worth doing where facts genuinely have to go out. It is a control on the input, not an answer to where the input ends up.

Frequently asked questions

If I anonymise a document, is it still confidential?

Yes. Rule 9 of the Australian Solicitors' Conduct Rules covers information confidential to a client and acquired during the engagement, whether or not any individual is identified in it. De-identification reduces exposure under the Privacy Act, it does not discharge the professional duty. Treat a stripped document as client material that has simply been made harder to attribute.

Can I paste client documents into ChatGPT if I remove the names?

Removing names does not remove the fact pattern, and the fact pattern is often enough to identify the matter to anyone in the relevant industry or region. The more important question is what the provider does with the text: retention period, whether inputs are used for training, and who can access it. Consumer and business terms differ substantially, so check the ones that apply to your account rather than the ones on the marketing page.

What is the difference between de-identification and pseudonymisation?

Pseudonymisation swaps identifiers for consistent labels and keeps a key, so the process is reversible by design. De-identification aims to make re-identification unlikely in the circumstances, with no key retained. Most legal tools perform the first and describe it as the second. If a key exists, it is a client record and needs the same protection as the file it came from.

Is de-identified data still personal information under the Privacy Act?

It depends on whether an individual remains reasonably identifiable in the circumstances, including by combining the material with other information that is available. That makes it contextual: the same stripped statement can be genuinely de-identified in one setting and clearly identifiable in another, such as a small regional community or a narrow professional field. Assess the document against who might read it, not against a checklist of removed fields.