Find and redact PII with AI
Use a local AI assistant to locate personal data across structured and unstructured files and produce a redacted version — the data-minimization skill behind every privacy regime.
A customer-support export landed in your queue and it is full of personal data — names, emails, SSNs, dates of birth, card numbers. It has to go to a vendor for analysis, and it has to be scrubbed first. You also have an internal incident report where the PII is buried in prose, not tidy columns. Your job: find every piece of PII and produce a clean, redacted version.
1 Guided walkthrough
Do the one-time AnythingLLM setup if you have not. Download and unzip the Day 3 data pack (button below): a support-export CSV and an incident report.
Create a workspace and upload support-export.csv. Ask it to inventory the personal data.
Paste this into the assistantThis is a customer support export. List every column that contains personally identifiable information (PII), and for each say why it is sensitive.You should see: It flags name, email, phone, SSN-last-4, date of birth, address, and card-last-4.
Now have it redact.
Paste this into the assistantProduce a version of this data with every PII value replaced by [REDACTED], keeping the ticket IDs and the issue descriptions intact so it is still useful for analysis.You should see: A table where the sensitive fields are masked but the non-sensitive structure remains.
Upload incident-report.md — the harder case, where PII is inside sentences, not columns.
Paste this into the assistantThis incident report has personal data scattered through the prose. Find every piece of PII, quote the sentence it appears in, and give a redacted version of the whole report.You should see: It should catch inline SSNs and DOBs (James O_Brien, Priya Nair) and staff contact details — but check carefully, prose redaction is where it misses.
Compare its performance on the CSV versus the prose. Where did it do well, and where would you not trust it without a human review?
2 Ship a defensible redaction
No prompts given this time — you write them. Forming the right question is the skill. Work these on your own; compare with a neighbour if you can.
- Produce a final redacted copy of BOTH files that you would be comfortable sending to an outside vendor. Verify by hand that nothing slipped through — especially in the prose.
- Write the data-handling note that goes with it: what was redacted, what was kept and why, and who signed off.
- Answer the design question: should redaction happen at the INPUT (before data reaches an AI/log/ticket) or at the OUTPUT (filtering what comes back)? Defend your answer with an example from these files.
- Find one thing the assistant missed or over-redacted. What does that tell you about relying on it unsupervised for compliance work?
What to notice
- This is OWASP LLM02 (Sensitive Information Disclosure) turned into a control: you cannot leak what is not there.
- Column-structured PII is easy for the AI; PII embedded in prose is where it misses — the exact place a human still matters.
- Redaction at the INPUT is the real control. Telling a model "do not share this" is not — that is the Day 2 lesson applied to data.
Think about it
- The safest system cannot leak data it never held. How does that reframe the whole problem away from "guard the model" toward "minimize what reaches it"?
- Where would you still require a human review before this data left the building, no matter how good the AI got?
Take it further — for fast finishers
- Ask the assistant to classify each record by sensitivity tier (public / internal / restricted). Does a risk-tiering lens change how you would handle each?