How to Redact Sensitive Information Before Uploading Documents to ChatGPT

1. Reduce the document before you redact it

Begin with the task you want ChatGPT to perform. If the task is to rewrite one clause, extract that clause. If the task is to analyse a small table, create a new table containing only the necessary columns. Every page or field removed at this stage is one less item that redaction must catch.

Work on a duplicate. Keep the original unchanged and clearly name the prepared copy. This protects evidence, avoids accidental data loss, and makes the exact uploaded artefact easier to review later.

2. Build a redaction inventory

List information that is unnecessary for the AI task. Include direct identifiers such as names, email addresses, phone numbers, account numbers, and signatures. Then consider indirect identifiers: precise dates, locations, job titles, unusual transaction values, project names, or combinations that point to one subject.

Add non-personal company risks such as pricing, forecasts, credentials, internal URLs, security findings, source-system IDs, contract language, and information supplied by another party. Company data can be confidential even when it is not personal data.

Choose transformations deliberately. Delete irrelevant passages, replace recurring identities with consistent placeholders, generalise unnecessary detail, and use synthetic values where the exact number is not needed.

3. Apply format-aware redaction and sanitisation

In a PDF, Adobe distinguishes applying redaction to visible content from sanitising hidden information. Marking text is not the final step: the redaction must be applied and the saved result checked. Sanitisation can address other items such as metadata, comments, attachments, hidden layers, or scripts.

In Word, Excel, or PowerPoint, inspect comments, tracked changes, document properties, headers and footers, hidden rows or slides, speaker notes, external links, and embedded objects as applicable. Microsoft Document Inspector can help, but Microsoft documents items it may not detect or remove automatically.

For scanned documents, text may exist only as pixels until OCR is applied. OCR can misread characters, so search results need a visual review of every page. Images may also carry camera and location metadata.

4. Verify the exact upload copy

1. Close and reopen the prepared file.
2. Search for every identifier and keyword on the inventory.
3. Try selecting and copying text near each redaction.
4. Review comments, attachments, layers, notes, hidden sheets, and properties again.
5. Confirm that formulas, references, and document meaning still behave as intended.
6. Ask a second reviewer when the consequence of disclosure is high.

Finally, confirm the ChatGPT workspace, Data Controls, retention, administrator access, and organisational approval. File preparation and destination governance are different controls; both are required.

A reusable final checklist

• The original is preserved and the output is clearly named.
• Only content needed for the AI task remains.
• Visible redactions remove underlying content rather than cover it.
• Supported hidden data and metadata have been inspected.
• The output opens normally and has been searched again.
• The destination, account, settings, and policy are approved.
• A human has reviewed the exact file to be uploaded.