Tips / Tip

Redact with numbered placeholders, so the text still makes sense

By Michael Shreeves · 14 July 2026 · AI & Copilot · 2 min read

Black boxes make a document unreadable. Who said what to whom? Placeholders fix that, as long as they're consistent: [PERSON 1] is always the same person, so the thread still follows.

The catch is who does the swapping. If you paste the original into an AI tool and ask it to redact, the tool's already seen every name. In a tool your organisation has approved for that kind of data, that can be fine. In one it hasn't, you've made the disclosure you were trying to avoid.

So I'd do it in this order.

  1. Replace the names yourself. List the people, organisations and reference numbers you know are in there and give each a label: [PERSON 1], [ORG 1], [REF 1]. Run find and replace on a copy, one item at a time, with the same label every time, including short forms and nicknames.
  2. Search the original for what you missed. Surnames on their own, initials, email addresses, phone numbers, street names.
  3. Paste the redacted copy, and only that, and ask what's left:
The text below has been redacted by hand. List anything in it that could
still identify a person or an organisation: names or nicknames that were
missed, email addresses, phone numbers, addresses, reference numbers, and
job titles or details that point to one individual. Quote each one.
Don't rewrite the text.

Text: [PASTE THE REDACTED COPY]

The tool only sees the redacted version, so there's nothing for it to leak. It's also good at the things people miss: the surname in a signature, the job title that points at one person in a small team.

If you do have an approved tool, you can let it do the first pass too. Ask for the same placeholders, the same label every time, and nothing else changed. Then do step 2 yourself, because models miss things as well.

Your list from step 1 doubles as the key. Keep it somewhere safe and you can put the real names back into a summary later.

Don't lean on any of this for something with legal weight, like a disclosure bundle or a subject access request, without a proper process behind it. For logs and system data, a script does the same job.

← All tips