How to anonymise a letter under the GDPR
Want to share a letter with a colleague, an adviser, a forum or an AI assistant, but it contains names, addresses or an ID number? Then it is wise (and often required) to anonymise it first. This article explains step by step how to do it properly, which details people tend to forget, and how to get it done in seconds.
Why anonymise a letter?
The General Data Protection Regulation (GDPR) protects everyone whose data appears in a document. Sharing a letter containing personal data without a valid reason can amount to a data breach. Even if it is "just" a sample letter or a question for ChatGPT, it is still information about real people. Anonymising the letter removes that risk while keeping the content usable.
Which data should you remove?
Don't stop at the name at the top. A letter often contains more identifying details than you think:
- Names of the sender, the recipient and anyone else mentioned;
- Addresses and postcodes, including in the letterhead and signature;
- National ID and tax numbers, plus customer, policy or case numbers;
- IBANs and other bank details;
- Phone numbers and email addresses;
- Dates of birth, licence plates and dates that make someone recognisable;
- Special category data, such as health, religion or criminal records.
Step by step: anonymising a letter
1. Decide on the purpose
Why are you sharing the letter? For a legal question the context matters, but the neighbour's name does not. Keep only what is needed.
2. Replace data with labels
Don't just type dots. Replace "John Smith" with [PERSON 1] and "12 Church Street, Bristol" with [ADDRESS]. The letter stays readable and the reader still knows who is who.
3. Check the hidden places
Look at headers and footers, the signature, attachments and the file properties (author) of a Word or PDF file.
4. Read it through once more
Combinations of details can still identify someone, such as "the only GP in village X". Remove such details or make them more general.
Pseudonymisation or anonymisation?
Under the GDPR, data is only truly anonymous if nobody can reasonably link it back to a person. If you keep a list of who [PERSON 1] is, that is pseudonymisation: safer, but still personal data. For sharing with others that is often fine, as long as you keep the key to yourself.
Beware of online tools. Many "free anonymisation tools" upload your letter to a server, which means you are sharing the data with an unknown third party. VerumVault works differently: the tool runs entirely locally in your browser. Your letter never leaves your computer.
Faster with VerumVault
Hunting manually for every ID number or IBAN is error-prone. VerumVault automatically recognises personal data such as names, addresses, postcodes, IBANs, phone numbers and email addresses and replaces them with clear labels. You paste the text or open your file, check the result and copy the anonymised letter. No account, no upload. Please note: detection is currently optimised for Dutch documents, so always check the result carefully for letters in other languages.
Anonymise your document for free with VerumVault →Runs locally in your browser · no upload · no account · optimised for Dutch documentsFrequently asked questions
Is anonymising a letter mandatory under the GDPR?
Not always, but you may only share personal data if there is a valid legal basis for doing so. If you want to share a letter where that is not necessary, such as a sample or a question for an AI, anonymising it is the safest choice.
Can I paste a letter containing an ID number into ChatGPT?
Better not. National identification numbers may only be processed in specific cases. Replace the ID number and other personal data with labels before sharing text with an AI service.
Does VerumVault store my documents?
No. VerumVault processes everything locally in your browser. Your text or file is not sent to a server and is not stored.