Use ChatGPT for HR emails without sharing employee data
HR writes a lot of careful text: rejection letters, reference letters, replies to difficult emails, summaries of a conversation. An AI chat helps with tone and structure. The drafts, though, are about real employees and applicants, and they usually carry their names, contact details, salaries and sometimes far more sensitive things.
Stricter than a customer email
HR data is often the most sensitive personal data an organization holds. Health, sick leave, trade union membership or religion are special categories under Article 9 of the GDPR, with stricter rules than ordinary personal data. Many employers also have works council agreements or internal policies on AI tools. Check yours before you start.
The routine
- Leave out what the AI doesn't need. For a polite rejection it needs the role and the tone, not the applicant's CV. Shorten the text first.
- Open the anonymizer with the AI prompt preset and paste the draft.
- Review every finding. Names, emails, phone numbers, addresses, dates of birth, IBANs and national ID numbers such as a social security number are detected. Add the company name, team names and anything else that points to one person to the custom terms list.
- Copy the pseudonymized text into the AI chat and ask it to keep placeholders like
[PERSON_1]unchanged. - Restore the answer in the Restore view: the placeholders become the real names again, on your device.
What to keep out entirely
Detection finds identifiers, not meaning. A sentence like "she has been off since her diagnosis in March" contains no name to replace and is still health data about an identifiable person, once the rest of the text says who she is. Rewrite or remove such details by hand before anything goes into an AI chat: "after a longer absence" says enough for the tone of a letter.
Placeholders are pseudonymization: the text is still personal data, only much less revealing. See pseudonymization vs. anonymization.
This page describes a working routine; it is not legal advice. Your data protection officer can say what your organization allows.