PII Detection & Redaction

PII detection identifies personal information in report or case content so it can be reviewed, minimised, or redacted where appropriate.

What Disclosurely Supports

• Privacy-aware review of report and case content.
• Clear disclosure that the AI Assistant does not remove or redact personal information in report text before processing.
• Redaction-oriented workflows where sensitive details should be minimised before wider review.
• Audit and case-history context for sensitive data handling where relevant.
• Alignment with GDPR principles such as data minimisation, purpose limitation, and access control.

What Disclosurely Does Not Claim

• Disclosurely does not claim perfect detection of every item of personal data.
• Disclosurely does not claim automated redaction removes all privacy risk.
• Disclosurely does not claim AI analysis is required for every customer workflow.
• Disclosurely does not replace legal review of GDPR obligations, data subject rights, or investigation exemptions.

Procurement Checklist

• Confirm whether PII detection is enabled for the intended deployment.
• Ask which content types are scanned, such as report text, messages, notes, or files.
• Note that AI processing (Amazon Bedrock, London region) receives report text without names or other personal details removed.
• Confirm who can view original and redacted versions.
• Check whether PII handling events appear in audit history.
• Align PII workflows with the customer's privacy notice, retention policy, and DPIA.

Related Concepts

• GDPR Compliance for Whistleblowing Workflows
• Data Retention for Whistleblowing Cases
• File Uploads & Evidence Handling
• Access Control & Permissions
• Audit Trail & Case Activity Records
• GDPR-Conscious Whistleblowing Software

FAQs

Is PII detection the same as GDPR compliance?

No. PII detection can support GDPR-aware handling, but compliance also depends on lawful basis, transparency, retention, access governance, and customer procedures.

Can automated redaction miss information?

Yes. Automated detection should be treated as support for review, not a guarantee that all personal data has been found or removed.

When is PII detection most useful?

It is most useful before sharing case details broadly, exporting records, or reviewing sensitive allegations with a wider team.