A support team that wants to send customer chat transcripts to a language model for summarization might first run them through a redaction step that replaces “Maria Lopez, card ending 4421, 12 Elm St” with placeholders such as [NAME], [CARD], [ADDRESS]. Tools such as the open-source Presidio framework combine pattern matching (for formats like card numbers and emails) with named-entity recognition (for names and places) to find candidates, then mask, replace or remove them. The same step is used before writing prompts to logs, building training datasets or sharing data with vendors.
Redaction is imperfect in both directions. It misses unusual formats and context-dependent details, and it can over-redact text until it is useless. The deeper problem is that identity can emerge from combinations. Kyndryl’s Kris Lovejoy makes that point in episode 62 at 26:54: pieces of data that are harmless in isolation become regulated personal data “when two or three pieces of data come together.” In enterprise analytics, WisdomAI CPO Kapil Chhabra lists in episode 75 at 1:04:42 the unglamorous checks an agent must respect, including row-level security and whether “the PII information” is masked for a given user. That is his account in an interview WisdomAI sponsored (sponsor thanks).
Editorially, treat redaction as one layer: pair it with access controls such as least privilege, AI guardrails on inputs and outputs, and, for statistical releases, differential privacy. It is part of data governance, not a substitute for deciding what data should reach a model at all.
Hear it from the guest
“When two or three pieces of data come together, all of a sudden it's PII.”
“Is the PII information masked?”
Quotes lightly edited to remove filler words.
Sources
- NIST SP 800-122: Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) — April 2010 NIST guide to identifying PII and protecting its confidentiality; checked October 24, 2026.
- Presidio (GitHub) — Open-source framework for detecting, redacting, masking and anonymizing sensitive data (PII) across text, images and structured data; checked October 24, 2026.
