How to Anonymize Sensitive Data Before Sending It to an LLM: A Python Tutorial for Privacy-Preserving AI

To anonymize sensitive data before sending it to an LLM, detect personal data on your own server, replace each value with a consistent placeholder such as <PERSON_1>, send only the masked text to the model, then swap the real values back into the reply before your user sees it. The model still understands the task, because "refund for <PERSON_1> to <UPI_ID_1>" carries the same meaning, but the provider, its logs and your own prompt logs never see the name or the UPI ID.

This guide builds that layer in Python with Presidio, the open source PII detection library created by Microsoft. It covers Indian identifiers that generic tools miss, including Aadhaar, PAN, GSTIN, UPI IDs and Indian mobile numbers, plus streaming replies, tool calls and a fail closed leak check. Every snippet was run before publishing, and masking a typical support message took about 11 milliseconds on a CPU in our tests.

Why anonymize data before sending it to an LLM?

When you call a hosted model, your prompt leaves your infrastructure. Even with a provider that does not train on API data, the text may be retained for abuse monitoring, may show up in your own request logs, traces and error reports, and may be echoed back in a later answer if you reuse context. OWASP's Top 10 for LLM Applications lists Sensitive Information Disclosure as risk LLM02 for 2025 for exactly these reasons.

In India there is also a legal reason. The Digital Personal Data Protection Rules, 2025 were notified on 13 and 14 November 2025, with most obligations, including reasonable security safeguards, coming into force 18 months later, in May 2027. The Act's principles include data minimisation, and the highest penalty tier, up to ₹250 crore, applies to failing to take reasonable security safeguards. Not sending personal data you do not need to a third party is one of the simplest safeguards to show. This guide is engineering advice, not legal advice, so confirm your obligations with whoever owns compliance.

Redaction, pseudonymization or anonymization: which one do you need?

Placeholders beat plain redaction because they keep identity consistent. If a customer's name appears three times, all three become <PERSON_1>, so the model can still tell people apart and write "Dear <PERSON_1>". Redaction turns every value into the same [REDACTED] and the model loses track.

How the privacy layer works

Step 0: Install Presidio and a spaCy model

pip install presidio-analyzer presidio-anonymizer openai
python -m spacy download en_core_web_lg
export VELONA_API_KEY=your_key

Use en_core_web_lg in production. In our tests the small model, en_core_web_sm, missed "Ananya Iyer from Chennai" completely, while the large model caught both the name and the city at the same speed, about 11 ms per message. The large model is a download of several hundred megabytes, so size your container memory for it.

Step 1: Build the PII detector and the vault

This module does three jobs. It builds a Presidio analyzer with India specific recognizers switched on, it defines a PIIVault that hands out stable placeholders and restores them, and it wraps both in a PrivacyGuard with a fail closed leak check.

"""privacy_guard.py: reversible PII pseudonymization for LLM calls."""
import re
from presidio_analyzer import AnalyzerEngine, Pattern, PatternRecognizer
from presidio_analyzer.nlp_engine import NlpEngineProvider
from presidio_analyzer.predefined_recognizers import (
    InAadhaarRecognizer, InGstinRecognizer, InPanRecognizer,
    InPassportRecognizer, InVoterRecognizer,
)
from presidio_anonymizer import AnonymizerEngine
from presidio_anonymizer.entities import OperatorConfig

SPACY_MODEL = "en_core_web_lg"  # use en_core_web_sm if memory is tight

# Entities we always mask. Add or remove to match your data.
ENTITIES = [
    "PERSON", "EMAIL_ADDRESS", "PHONE_NUMBER", "CREDIT_CARD", "IBAN_CODE",
    "IP_ADDRESS", "LOCATION", "IN_AADHAAR", "IN_PAN", "IN_GSTIN",
    "IN_PASSPORT", "IN_VOTER", "UPI_ID",
]


def build_analyzer(model: str = SPACY_MODEL) -> AnalyzerEngine:
    provider = NlpEngineProvider(nlp_configuration={
        "nlp_engine_name": "spacy",
        "models": [{"lang_code": "en", "model_name": model}],
    })
    analyzer = AnalyzerEngine(nlp_engine=provider.create_engine(),
                              supported_languages=["en"])

    # India recognizers ship with Presidio but are disabled by default
    for rec in (InAadhaarRecognizer(), InPanRecognizer(), InGstinRecognizer(),
                InPassportRecognizer(), InVoterRecognizer()):
        analyzer.registry.add_recognizer(rec)

    # UPI IDs (name@bank). The lookahead skips emails like [email protected]
    upi = PatternRecognizer(
        supported_entity="UPI_ID",
        patterns=[Pattern("upi_id", r"\b[\w.\-]{2,256}@[a-zA-Z]{2,64}\b(?!\.)", 0.6)],
        context=["upi", "vpa", "gpay", "phonepe", "paytm", "pay"],
    )
    analyzer.registry.add_recognizer(upi)

    # Indian mobile numbers: the generic phone recognizer scores them low
    in_mobile = PatternRecognizer(
        supported_entity="PHONE_NUMBER",
        name="InMobileRecognizer",
        patterns=[Pattern("in_mobile",
                          r"(?<!\d)(?:\+?91[\s-]?|0)?[6-9]\d{4}[\s-]?\d{5}(?!\d)", 0.7)],
        context=["phone", "mobile", "call", "whatsapp", "contact"],
    )
    analyzer.registry.add_recognizer(in_mobile)
    return analyzer


class PIIVault:
    """Maps real values to stable placeholders like <PERSON_1>, per request."""

    TOKEN_RE = re.compile(r"<\s*([A-Z][A-Z_]*_\d+)\s*>")

    def __init__(self):
        self._forward = {}   # (entity, value) -> token
        self._reverse = {}   # token -> value
        self._counts = {}

    def token_for(self, entity: str, value: str) -> str:
        key = (entity, value.strip())
        if key not in self._forward:
            self._counts[entity] = self._counts.get(entity, 0) + 1
            token = f"<{entity}_{self._counts[entity]}>"
            self._forward[key] = token
            self._reverse[token] = value
        return self._forward[key]

    def restore(self, text: str) -> str:
        def swap(m):
            token = f"<{m.group(1)}>"
            return self._reverse.get(token, m.group(0))
        return self.TOKEN_RE.sub(swap, text)


class PrivacyGuard:
    def __init__(self, analyzer: AnalyzerEngine | None = None,
                 entities=ENTITIES, threshold: float = 0.5):
        self.analyzer = analyzer or build_analyzer()
        self.anonymizer = AnonymizerEngine()
        self.entities = entities
        self.threshold = threshold

    def find(self, text: str):
        return self.analyzer.analyze(text=text, language="en",
                                     entities=self.entities,
                                     score_threshold=self.threshold)

    def anonymize(self, text: str, vault: PIIVault) -> str:
        results = self.find(text)
        operators = {
            r.entity_type: OperatorConfig(
                "custom", {"lambda": (lambda ent: lambda v: vault.token_for(ent, v))(r.entity_type)})
            for r in results
        }
        return self.anonymizer.anonymize(text=text, analyzer_results=results,
                                         operators=operators).text

    def assert_clean(self, text: str, min_score: float = 0.85):
        """Second pass: refuse to send if a high-confidence entity survived."""
        stripped = PIIVault.TOKEN_RE.sub(" ", text)
        leaks = [r for r in self.find(stripped) if r.score >= min_score]
        if leaks:
            kinds = sorted({r.entity_type for r in leaks})
            raise ValueError(f"PII still present after masking: {kinds}")


class StreamRestorer:
    """Restores placeholders in a streamed reply. Holds back a partial '<TOKEN' tail."""

    def __init__(self, vault: PIIVault, max_token_len: int = 40):
        self.vault = vault
        self.buf = ""
        self.max_token_len = max_token_len

    def feed(self, chunk: str) -> str:
        self.buf += chunk
        cut = self.buf.rfind("<")
        if cut != -1 and ">" not in self.buf[cut:] and len(self.buf) - cut < self.max_token_len:
            ready, self.buf = self.buf[:cut], self.buf[cut:]
        else:
            ready, self.buf = self.buf, ""
        return self.vault.restore(ready)

    def flush(self) -> str:
        ready, self.buf = self.buf, ""
        return self.vault.restore(ready)

Three details came from testing, not from the docs:

• India recognizers are off by default. Presidio ships InAadhaarRecognizer, InPanRecognizer, InGstinRecognizer, InPassportRecognizer and InVoterRecognizer, but does not load them. You must add them to the registry, as above.
• Indian mobile numbers score too low. Presidio's generic phone recognizer scored "+91 98765 43210" at 0.4 in our test, below the usual 0.5 threshold, so the number would have leaked. The custom in_mobile pattern scores it at 0.7.
• Restricting entity types cuts false positives. Run on everything, Presidio flagged a plain 10 digit number as a UK NHS number and a US bank number. The ENTITIES list keeps only types that make sense for your data.

Here is what the guard does to a real looking support message, using a Verhoeff valid test Aadhaar number:

IN:  Customer Priya Sharma ([email protected], +91 98765 43210) says her
     refund to UPI ID priya.s@okhdfcbank failed. Aadhaar 4987 5612 3018,
     PAN ABCPS1234K. Please draft a reply to Priya Sharma.

OUT: Customer <PERSON_1> (<EMAIL_ADDRESS_1>, <PHONE_NUMBER_1>) says her
     refund to UPI ID <UPI_ID_1> failed. Aadhaar <IN_AADHAAR_1>,
     PAN <IN_PAN_1>. Please draft a reply to <PERSON_1>.

Note that both mentions of Priya Sharma became the same <PERSON_1>, and the email address was not mistaken for a UPI ID, thanks to the lookahead in the UPI pattern.

Step 2: Call the LLM with masked text and restore the reply

The wrapper below is the only path your app should use to reach a model. It creates a fresh vault per request, masks the input, blocks the call if anything high confidence is left, logs only the masked text and restores placeholders in the answer. It uses Velona's OpenAI compatible endpoint, so the same code works with any model on the models page, and any OpenAI compatible provider if you change the base URL.

"""private_llm.py: mask, call the model, restore. Raw PII never leaves this process."""
import json
import logging
import os

from openai import OpenAI

from privacy_guard import PIIVault, PrivacyGuard, StreamRestorer

client = OpenAI(api_key=os.environ["VELONA_API_KEY"], base_url="https://velona.in/v1")
guard = PrivacyGuard()
log = logging.getLogger("llm")

SYSTEM = (
    "Some values in the user's text were replaced with placeholders such as "
    "<PERSON_1> or <PHONE_NUMBER_2>. Treat each placeholder as the real value. "
    "When you need one, copy it exactly, including the angle brackets. "
    "Never guess, invent or ask for the hidden values."
)


def private_chat(user_text: str, model: str = "deepseek/deepseek-v4-flash") -> str:
    vault = PIIVault()                      # one vault per request, kept in memory
    masked = guard.anonymize(user_text, vault)
    guard.assert_clean(masked)              # fail closed if something slipped through
    log.info("prompt=%s", masked)           # log the masked text only

    resp = client.chat.completions.create(
        model=model, temperature=0.2,
        messages=[{"role": "system", "content": SYSTEM},
                  {"role": "user", "content": masked}],
    )
    return vault.restore(resp.choices[0].message.content)


def private_chat_stream(user_text: str, model: str = "deepseek/deepseek-v4-flash"):
    vault = PIIVault()
    masked = guard.anonymize(user_text, vault)
    guard.assert_clean(masked)
    restorer = StreamRestorer(vault)
    stream = client.chat.completions.create(
        model=model, stream=True,
        messages=[{"role": "system", "content": SYSTEM},
                  {"role": "user", "content": masked}],
    )
    for chunk in stream:
        delta = chunk.choices[0].delta.content if chunk.choices else None
        if delta:
            yield restorer.feed(delta)
    yield restorer.flush()


def tool_args_for_execution(tool_call, vault: PIIVault) -> dict:
    """Model tool calls carry placeholders. Restore them only here, inside your system."""
    return json.loads(vault.restore(tool_call.function.arguments))

from private_llm import private_chat

print(private_chat(
    "Hi, I am Rohan Mehta, phone 9876501234. My refund to rohan.m@ybl is stuck. "
    "Write a short apology and say we will call back today."
))
# The model received:
#   Hi, I am <PERSON_1>, phone <PHONE_NUMBER_1>. My refund to <UPI_ID_1> is stuck. ...
# Your user sees:
#   Dear Rohan Mehta, ... we will call you on 9876501234 today.

The system prompt matters. Without it, some models "helpfully" rewrite <PERSON_1> as "the customer" or try to guess a name, and the restore step has nothing to swap back. Telling the model to copy placeholders exactly, including the angle brackets, keeps the round trip reliable. The restore regex also tolerates stray spaces such as < PERSON_1 >.

Step 3: Handle streaming replies

When you stream, a placeholder can arrive split across chunks: "<PER" in one and "SON_1>" in the next. The StreamRestorer in privacy_guard.py holds back any unfinished "<" tail of up to 40 characters until it either closes or clearly is not a placeholder, so users never see a half token. A literal "3 < 5" in the reply passes through unchanged once the stream ends.

Step 4: Keep tool calls inside your trust boundary

If your agent calls tools, the model will produce arguments such as {"customer": "<PERSON_1>"}. Restore those values with tool_args_for_execution just before running the tool on your server, and mask the tool's result again before it goes back to the model. The real value exists only inside your code. This pattern matters most for agents that look up orders or accounts, the kind of tool calling workload covered in our benchmark of cheap LLMs for production agents.

What Presidio catches, and what it misses

No detector is perfect, and a privacy layer you trust blindly is worse than one you know the limits of. We ran the guard on deliberately hard sentences. Results with en_core_web_lg:

For domains where these gaps matter, two open source projects are worth a look. LLM Guard from Protect AI wraps Presidio style anonymization with a vault and adds other prompt scanners. Presidio itself supports transformer based NER models, which raise recall on names at the cost of speed. And never forget the cheapest control of all: do not put data in the prompt that the task does not need.

Production checklist for privacy preserving AI

If you are building retrieval over customer documents, combine this guard with the ingestion step in our production RAG application tutorial. For a wider view of privacy and cost trade offs, including keeping data entirely on your own hardware, see local AI versus cloud AI in India.

Limits of this approach

Pattern and NER based detection reduces exposure, it does not eliminate it. Context can identify a person even when every name is masked, for example "the only cardiologist in our Asansol branch". Free text descriptions, images, PDFs with scanned IDs and audio need their own handling. The DPDP Rules timeline and penalty figures are taken from the Press Information Bureau's November 2025 release and law firm summaries, so confirm details for your case. Our latency and detection results come from a small set of test sentences on one CPU, and are meant to show behaviour, not to rate Presidio's accuracy in general.

Frequently asked questions

Sources and method

All code was run with Python 3.13, presidio-analyzer 2.2.364 and spaCy English models, with a stand in chat client used to verify masking, restoration, streaming and tool argument handling offline. Latency is the median of 20 runs on one cloud CPU after model loading. Detection results are from the specific sentences shown. Legal dates and penalties are quoted from the sources below.

• Presidio on GitHub (created by Microsoft, now under the Data Privacy Stack organisation)
• Presidio supported entities, including India recognizers
• spaCy on GitHub
• LLM Guard by Protect AI on GitHub
• Faker, synthetic data generator, on GitHub
• OWASP Top 10 for LLM Applications 2025: LLM02 Sensitive Information Disclosure
• Press Information Bureau, DPDP Rules, 2025 Notified (November 2025)
• Dhir and Dhir Associates via Mondaq, Key changes in India's DPDP Rules 2025
• Velona API documentation, OpenAI compatible endpoint