Source: [Preparing employee notes for AI: removing names is only the first step — Skills for Business]() [← All articles](https://skillsforbusiness.ai/blog/) HR & people · Guide # Preparing employee notes for AI: removing names is only the first step Before sharing employee notes with AI, reduce unnecessary context, inspect remaining clues and preserve the meaning needed for the task. [Skills for Business](https://skillsforbusiness.ai/blog/editorial/)1 November 20267 min read On this page 1. [The research concerns inference as well as memorization](https://skillsforbusiness.ai/blog/employee-notes-ai-context-after-name-removal/#the-research-concerns-inference-as-well-as-memorization) 2. [Define the output before editing the source](https://skillsforbusiness.ai/blog/employee-notes-ai-context-after-name-removal/#define-the-output-before-editing-the-source) 3. [A fictional note shows the tradeoff](https://skillsforbusiness.ai/blog/employee-notes-ai-context-after-name-removal/#a-fictional-note-shows-the-tradeoff) 4. [Inspect the combinations that remain](https://skillsforbusiness.ai/blog/employee-notes-ai-context-after-name-removal/#inspect-the-combinations-that-remain) 5. [Treat automated detection as one control](https://skillsforbusiness.ai/blog/employee-notes-ai-context-after-name-removal/#treat-automated-detection-as-one-control) 6. [Check that the concern survives the rewrite](https://skillsforbusiness.ai/blog/employee-notes-ai-context-after-name-removal/#check-that-the-concern-survives-the-rewrite) 7. [Make the release decision explicit](https://skillsforbusiness.ai/blog/employee-notes-ai-context-after-name-removal/#make-the-release-decision-explicit) 8. [Sources](https://skillsforbusiness.ai/blog/employee-notes-ai-context-after-name-removal/#sources) What to take away - Removing names and email addresses does not establish that the remaining text reveals nothing personal. - Start with the task and retain only the detail needed to support it, while checking that meaning survives. - Use approved preparation tools and contextual review; a detector's clean result is not an anonymity guarantee. Before sharing employee notes with an AI assistant, check what the task needs and what the remaining context reveals. Removing names, addresses and staff numbers is useful, but a rare role, a precise event or several ordinary details together may still reveal more than the task requires. For HR and learning teams, the practical decision is often narrower than anonymizing an entire document. An assistant asked to propose improvements to a training schedule may need a description of the scheduling problem. It may not need the original participant’s biography, exact workplace or verbatim complaint. Our editorial recommendation is to prepare the smallest useful input inside an approved environment, review both its remaining clues and its meaning, and retain appropriate access controls. This is a preparation workflow, not a certification that a document is anonymous or permission to use a particular AI product. ## The research concerns inference as well as memorization In [Beyond Memorization](https://arxiv.org/html/2310.07298v2), researchers at ETH Zurich studied whether language models could infer personal attributes from public Reddit text. They also evaluated a text-anonymization procedure and found that contextual clues could still support attribute inference after detected entities were removed. The paper was first submitted in October 2023; the inspected revision is dated May 2024. It used historical models and a selected, author-labeled dataset, not an employee-note trial or a current workplace assistant. Its results do not supply an error rate for your redaction process. Attribute inference and identification are different. Guessing an author’s location or occupation does not necessarily identify a named individual. Both can matter when preparing text, but this study should not be described as proving that every nameless employee comment can be traced to its author. There is also progress on defenses. The same team’s [Language Models are Advanced Anonymizers](https://arxiv.org/html/2402.13846v2), inspected in its February 2025 revision, evaluates a process in which an inference model supplies feedback to a text-rewriting model. The authors report improved privacy and utility against their baselines on online-text datasets. They explicitly note that evaluation depends on the strength of the inference adversary. This is follow-up work from the same researchers, not independent validation or a guarantee for an ordinary chatbot’s “anonymize this” instruction. ## Define the output before editing the source Suppose a learning team wants an assistant to propose ways to make training accessible across working hours. Before preparing notes, write down the output: possible scheduling and recording arrangements, with unresolved questions for the training owner. Exclude judgments about individual employees. This makes it possible to ask whether each source detail changes the requested work. Does the assistant need the depot’s name? Does it need the date of one person’s attendance? Does a precise job title explain a constraint, or merely make the speaker easier to recognize? In its [practitioner guidance on security and privacy](https://www.thoughtworks.com/en-us/insights/e-books/modern-data-engineering-playbook/shift-left-on-security-and-privacy), Thoughtworks emphasizes using the smallest necessary data subset and warns that masking obvious fields can leave revealing context. That is engineering guidance, not a measured guarantee of risk reduction for this workflow. If the actual task requires detailed individual records, do not force it into a supposedly anonymous version. Use the organization’s approved process for that information and involve the responsible privacy or security specialist. A general-purpose writing task and an individual case review need different inputs and controls. ## A fictional note shows the tradeoff Consider this invented training comment: a participant describes being the only night-shift instructor at a named depot, attending a precisely dated session immediately after handover, and having no recording available afterward. All details in this example are fictional; no employee data or redaction product was tested. Deleting the participant’s name leaves the unusual role, site and event intact. A colleague who knows the rota might recognize the situation. That is a contextual risk to consider, not a claim that identification has occurred. For the scheduling-improvement task, a narrower preparation could say: “A participant reported that session timing conflicted with shift handover and that no recording was available.” The report of a conflict remains. The distinctive biography is omitted. The following table proposes how to reason about the details, rather than a universal list of safe transformations: | Detail in the fictional note | Possible treatment for this task | Meaning to preserve | | --- | --- | --- | | Name and contact details | Omit | They do not explain the scheduling issue | | Named depot | Omit if location is unnecessary | Any genuine location-dependent constraint | | Unique instructor role | Generalize or omit | The relevant working-hours constraint | | Exact session date | Omit if timing relative to handover is enough | The sequence that caused the conflict | | No recording available | Retain if supported by the source | The stated obstacle to catching up | This shortened version is not guaranteed anonymous. Its suitability still depends on who will receive it, what other information they have and the approved environment. Some comments may remain too distinctive to share usefully. ## Inspect the combinations that remain Read the prepared text as a whole. Checking each field separately can miss the effect of a combination: role plus location plus a recent event may be more revealing than any one item alone. Ask someone authorized to see the source and familiar with the work context to review difficult cases. Their purpose is to identify remaining exposure and unnecessary detail, not to perform speculative profiling of employees. If assessment needs specialist expertise, route the case there instead of asking staff to guess whether it is safe. Consider the receiving audience too. A generic department description may reveal little to an outside reader but be distinctive to the department manager. Combining several prepared notes can also restore context removed from each note individually. Review the package that will actually be sent, including headings, filenames and attached material. Avoid inventing replacement facts merely to make the text sound natural. Changing the depot or shift can create a false operational explanation. Prefer omission or an explicit generalization, and preserve uncertainty where the source is unclear. ## Treat automated detection as one control The current [Presidio project documentation](https://presidio.dataprivacystack.org/) describes automated detection and de-identification components and explicitly warns that it cannot guarantee finding all sensitive information. This is the project’s own scope statement, not an independent performance evaluation or a recommendation of that product for HR notes. A detector can help locate configured types of information, but a clean result is not evidence that the full narrative is harmless. Conversely, removing every flagged span can damage the explanation the assistant needs. Someone must check both the residual exposure and the usefulness of the result. Prepare text using tools authorized for the original information. Uploading an unprepared note to an unapproved service so it can redact the note already gives that service the original. A prompt requesting confidentiality does not undo that transfer. For repeated work, evaluate the chosen preparation process on approved test material representative of your language and document types. Include ordinary identifiers, organization-specific terms and contextual combinations. Record missed information and meaning changes separately. These are proposed evaluation practices; this article does not report a test of any detector or assistant. ## Check that the concern survives the rewrite Privacy preparation and faithful summarization have different failure modes. A rewrite that removes revealing details can also erase an important exception, turn one comment into an apparent group view or make an unresolved issue sound settled. In the fictional example, do not rewrite the note as “Employees prefer recordings.” The source describes one participant’s reported scheduling conflict and missing recording. It does not establish a workforce-wide preference or prove which solution would work best. Keep a restricted internal record of material transformations when the workflow needs traceability. Do not include a lookup key or identifying explanation in the same AI input merely for convenience. Limit the source and review record to the people who need them. Our guide to [preserving disagreement in AI employee-feedback summaries](https://skillsforbusiness.ai/blog/ai-employee-feedback-preserve-disagreement/) covers what happens next when approved comments are analyzed. Preparing an input for that stage should preserve the relevant concern without assuming every original detail belongs in the assistant’s context. ## Make the release decision explicit Before submitting the prepared input, record the purpose, intended recipient or tool, details removed or generalized, unresolved risks and actual review scope. A completed checklist does not replace the organization’s authorization for the tool and information involved. If the useful meaning cannot be separated from distinctive or sensitive circumstances, keep the task with an authorized person or within the approved restricted workflow. Do not gradually restore identifying details to a general assistant just because its first answer is vague. Start with one recurring task, such as drafting training-improvement options. Define the minimum facts needed, prepare a fictional practice note and ask a reviewer to check two things: what can still be inferred, and whether the original concern remains accurately stated. Use those observations to improve the preparation process before introducing real employee material. ## Sources & further reading Sources checked for this article. Research findings and vendor claims are distinguished in the text. 1. [Beyond Memorization: Violating Privacy via Inference with Large Language Models](https://arxiv.org/html/2310.07298v2)Staab et al.; ETH Zurich / arXiv · Accessed 1 November 2026 2. [Language Models are Advanced Anonymizers](https://arxiv.org/html/2402.13846v2)Staab et al.; ETH Zurich / arXiv · Accessed 1 November 2026 3. [Presidio](https://presidio.dataprivacystack.org/)Data Privacy Stack; Presidio project · Accessed 1 November 2026 4. [Shift left on security and privacy: Why it’s critical to speed, quality and customer trust](https://www.thoughtworks.com/en-us/insights/e-books/modern-data-engineering-playbook/shift-left-on-security-and-privacy)Thoughtworks; Mitchell Lisle and Harmeet Kaur Sokhi · Accessed 1 November 2026 Produced with AI-assisted research and writing. Examples and recommendations are our editorial synthesis unless attributed. This article does not claim independent product testing or human expert review. [Read our editorial policy.](https://skillsforbusiness.ai/blog/editorial/) ## Keep reading [AI-assisted manager feedback: own the observations and the message](https://skillsforbusiness.ai/blog/ai-manager-feedback-observations-ownership/)[AI employee-feedback summaries: preserve disagreement and evidence](https://skillsforbusiness.ai/blog/ai-employee-feedback-preserve-disagreement/)