How to anonymise a contract without uploading it anywhere

What does “without uploading” mean?

The file never leaves your computer: you use software installed on it, not a website you send the file to. Even Cloak, the Singapore government’s anonymisation toolkit, works by uploading or pasting your text, and it is currently for public-sector users; others need approval.

What should I take out?

Check the whole contract, including schedules, annexes and the signature page:

• Names of parties, signatories and witnesses, in every form: full name, surname or given name alone, initials, capitals.
• NRIC, FIN and passport numbers. Singapore’s Personal Data Protection Commission (PDPC) notes that a name plus an NRIC number is usually enough to identify someone.
• Company names and UEN, if the other side must not be recognised.
• Addresses, phone numbers, emails and bank account numbers.
• Prices, dates and unusual terms, if they would tell a reader which deal this is.
• Signatures, initials and company stamps.
• Headers, footers and the file name.

Short forms such as “the Tenant” can stay; they keep the contract readable.

How do I do it in Word?

These steps are for Word on Windows.

1. Save a copy in a folder on this computer, not in OneDrive, and work only on the copy. Use File > Save As, or File > Save a Copy if that is what you see.
2. Make your key in a separate file: every name, ID number, address, phone number, email and bank account, each with its own tag, such as Tan Ah Kow = [Person 1] and S1234567A = [ID 1]. Use the same tag every time that person or company appears, so the contract still makes sense (PDPC).
3. On the Review tab, choose Accept > Accept All Changes and Stop Tracking, so your replacements are not kept as tracked deletions (Microsoft). The No Markup view only hides changes; Microsoft says they come back the next time someone opens the file.
4. On the Review tab, select the down arrow by Delete and choose Delete all Comments in Document.
5. Press Ctrl+H, click More and tick Find whole words only, so “Tan” is not changed inside “Tanjong” (Microsoft). Put each item on your key in Find what and its tag in Replace with. Click Find Next, then Replace, one at a time. Don’t use Replace All: it also changes words you didn’t mean.
6. Then do the short forms: the surname or given name alone, the initials, “Mr Tan”. Step through them the same way, because two people in one contract can share a surname.
7. To catch ID numbers you missed, tick Use wildcards and search for [STFGM][0-9]{7}[A-Z]. NRIC numbers start with S or T and FINs with F, G or M, then seven digits and a letter (ICA). Replace anything it finds, then untick Use wildcards, because @ in the next step is a wildcard too.
8. Search for @ to find emails, then read the copy once for anything missed.
9. Go to File > Info > Check for Issues > Inspect Document, and click Remove All beside Comments, Revisions, Versions, and Annotations; Document Properties and Personal Information; and Hidden Text (Microsoft). This clears hidden data, not the names in the contract’s own text.
10. Save under a file name with no party names in it.

Only pasting part of it into ChatGPT? See How to remove names from a document before pasting it into ChatGPT.

What if it’s a PDF?

Open it in Word with File > Open. Word converts a copy and leaves the PDF unchanged; then follow the steps above. Microsoft says this works best when the PDF is mostly text: one that looks like a copy from a copier won’t format well, and a page that comes in as an image can’t be edited. If that happens with a scanned contract, retype the parts you need.

Never use white text, or black shapes or comment boxes laid over the words. The US District Court for the Southern District of Alabama warns in its redaction guide that white text only looks gone, and that black-out shapes and comments added with a PDF program’s markup tools can be removed by anyone.

On a Mac, open a copy of the PDF in Preview, click Show Markup Toolbar and use Redaction Selection. Apple says it permanently removes the selected text from view once you close the document.

How do I do it free, in LibreOffice?

LibreOffice is free and open source. First choose Edit > Track Changes > Accept All, turn off Record Changes in the same menu (LibreOffice), and choose Edit > Comment > Delete All Comments. Edit > Find & Replace then works as in Word: tick Whole words only for names, and Regular expressions to find NRIC and FIN numbers with [STFGM][0-9]{7}[A-Z] (LibreOffice). Before you save, go to Tools > Options > LibreOffice > Security, click Options and tick Remove personal information on saving, which takes user data out of the file properties, comments and tracked changes (LibreOffice).

To send a PDF to a person, Tools > Auto-Redact marks every match of the names and patterns you list and opens the marked copy in LibreOffice Draw. Check the marks, then choose Redacted Export (Black), not Direct Export to PDF, which only makes a copy for review. The marked parts become solid black pixels, so the words under them can’t be restored or copied (LibreOffice). For text you will paste into an AI, tags work better, because [Person 1] and [Person 2] still show who is who.

How do I check it?

• Search the copy for each item on your key. Nothing should come up.
• On Windows, paste the text into Notepad and read it. Then clear the formatting (the Edit menu or the formatting toolbar), or turn formatting off in Notepad’s settings first. A link can hide an email address behind its text (Microsoft).
• If it’s going into ChatGPT or another AI, paste only this checked copy. Singapore’s Cyber Security Agency (CSA) and IMDA warn that once you share information with AI tools, “you lose control over how it is stored, processed, or accessed.”

Is it really “anonymised”?

Not always. PDPC calls removing names, addresses and NRIC numbers de-identification: only the first step of anonymisation. Data is not anonymised if there is a serious possibility that someone could be re-identified from it, alone or combined with other information the reader has or is likely to get, taking the safeguards in place into account (PDPC). Dates, amounts and the deal itself can point to the parties. If the copy must not point to anyone, make those details less exact, which PDPC calls generalisation: the month and year instead of the full date, the area instead of the full address. Once data is truly anonymised, it is no longer personal data under the Personal Data Protection Act (PDPA).

Your key can undo all of this. PDPC says such a mapping table should be kept securely, because it permits re-identification, so never send it with the copy.