Anyone using AI systems like ChatGPT, Claude, or their own Large Language Models (LLMs) in business processes faces a fundamental problem: Personally Identifiable Information (PII) unintentionally ends up in the prompt text box, in log files, or in fine-tuning datasets. However, the GDPR requires data minimization and a clear legal basis for every processing activity. This is where Presidio comes into play – an open-source framework that detects PII in text and images and automatically redacts it before the data reaches an AI system.
What is Presidio?
Presidio (Latin praesidium – protection, garrison) was originally developed by Microsoft and released as open source in 2018. Since 2026, the project has been in transition to a community-led organization under the umbrella of the Data Privacy Stack on GitHub (github.com/data-privacy-stack/presidio) – Microsoft supports this step. This is not a fork, but rather the continuation of the same project under new, independent governance. The source code remains available under the MIT license.
The framework consists of five modules:
- presidio-analyzer – detects PII in text using regular expressions, Named Entity Recognition (NER), checksums, rule sets, and context analysis
- presidio-anonymizer – replaces, masks, hashes, encrypts, or redacts the detected entities
- presidio-image-redactor – redacts PII in images, including medical DICOM scans
- presidio-structured – searches tabular data (DataFrames) column by column for PII
- presidio-cli – enables command-line scans for CI/CD pipelines
The current version 2.2.364 from July 2026 shows active development: Python 3.14 compatibility, new country recognizers (Philippines, Germany), and batch deanonymization were recently added.
How does PII protection work?
The typical workflow is two-stage: First, the AnalyzerEngine analyzes the text and returns a list of detected entities with text position and confidence score. Then the AnonymizerEngine takes these results and applies the desired operators.
from presidio_analyzer import AnalyzerEngine
from presidio_anonymizer import AnonymizerEngine
from presidio_anonymizer.entities import OperatorConfig
analyzer = AnalyzerEngine()
anonymizer = AnonymizerEngine()
text = "Mein Name ist Max Mustermann, Tel: 0170-1234567"
# Step 1: Detect PII
results = analyzer.analyze(text=text, language="de")
# Step 2: Anonymize PII
anonymized = anonymizer.anonymize(
text=text,
analyzer_results=results,
operators={"DEFAULT": OperatorConfig("replace")}
)
print(anonymized.text)
# Output: "Mein Name ist <PERSON>, Tel: <PHONE_NUMBER>"
The analyzer currently supports over 100 predefined recognizers for various countries and entity types: from email addresses, IBANs, and credit card numbers to country-specific ID documents. spaCy, Stanza, or Hugging Face Transformers can serve as the NLP engine. Language detection is extensible – while English is configured by default, additional languages can be added by swapping the NLP model and adjusting context words.
Presidio in front of AI pipelines: Working GDPR-compliant
The most important use case for companies is deployment as a protective layer in front of LLMs. Before a prompt reaches an AI service, it passes through Presidio: email addresses, phone numbers, names, and other personal data are replaced with placeholders. The risk of unintentional data disclosure drops dramatically.
From a GDPR perspective, however, an important nuance must be noted: Presidio typically performs pseudonymization, not complete anonymization. Since the encrypted or hashed values can be restored under certain circumstances (e.g., via the built-in decrypt operator), the data continues to qualify as personal data under GDPR Recital 26 – but the risk is significantly reduced. For true anonymization, the data would need to be irreversibly deleted or aggregated in such a way that no re-identification is possible.
Presidio can be operated in various ways: embedded as a Python library in existing applications, as a Docker container for microservice architectures, via PySpark for batch processing on data pools, or in Kubernetes clusters.
Limitations and honesty
The developers of Presidio are transparent: "Presidio can help identify sensitive/PII data in un/structured text. However, because it is using automated detection mechanisms, there is no guarantee that Presidio will find all sensitive information." PII detection is never 100% accurate – NER models can produce false positives, miss unusual formats, or misinterpret context. Presidio is a powerful tool, but not a substitute for legal advice or a comprehensive Data Protection Impact Assessment (DPIA).
Conclusion
Presidio has evolved from a Microsoft-internal tool into an independent community project and is today the most mature open-source building block for PII detection and anonymization. For companies that want to operate AI systems GDPR-compliant, it is one of the most practical solutions: it is self-hostable, auditable, extensible, and covers text, images, and tabular data. Anyone looking to add a PII protection layer to their AI workflow will find a solid, actively maintained entry point in Presidio.
Sources
- Representative documentation homepage – Presidio by Data Privacy Stack: https://presidio.dataprivacystack.org
- GitHub repository (README, license, architecture): https://github.com/data-privacy-stack/presidio
- Project Transition – Microsoft → Community project: https://github.com/data-privacy-stack/presidio/blob/main/docs/project_transition.md
- Releases – Version 2.2.364 (July 22, 2026): https://github.com/data-privacy-stack/presidio/releases
- Analyzer documentation (architecture, recognizers, API): https://presidio.dataprivacystack.org/analyzer/
- Anonymizer documentation (operators, hash, encrypt): https://presidio.dataprivacystack.org/anonymizer/
- Multi-language support in Presidio: https://presidio.dataprivacystack.org/analyzer/languages/
- Pasquale Pillitteri (June 19, 2026, updated July 15, 2026) – Presidio & GDPR: https://pasqualepillitteri.it/en/news/5538/microsoft-presidio-pii-data-protection-ai
Top comments (0)