DEV Community

Cover image for Presidio 2026: PII Detection and Anonymization for GDPR-Compliant AI Pipelines
saaro
saaro

Posted on Originally published at blog.saaro.net

Presidio 2026: PII Detection and Anonymization for GDPR-Compliant AI Pipelines

#ai #privacy #gdpr #pii

Anyone using AI systems like ChatGPT, Claude, or their own Large Language Models (LLMs) in business processes faces a fundamental problem: Personally Identifiable Information (PII) unintentionally ends up in the prompt text box, in log files, or in fine-tuning datasets. However, the GDPR requires data minimization and a clear legal basis for every processing activity. This is where Presidio comes into play – an open-source framework that detects PII in text and images and automatically redacts it before the data reaches an AI system.

What is Presidio?

Presidio (Latin praesidium – protection, garrison) was originally developed by Microsoft and released as open source in 2018. Since 2026, the project has been in transition to a community-led organization under the umbrella of the Data Privacy Stack on GitHub (github.com/data-privacy-stack/presidio) – Microsoft supports this step. This is not a fork, but rather the continuation of the same project under new, independent governance. The source code remains available under the MIT license.

The framework consists of five modules:

  • presidio-analyzer – detects PII in text using regular expressions, Named Entity Recognition (NER), checksums, rule sets, and context analysis
  • presidio-anonymizer – replaces, masks, hashes, encrypts, or redacts the detected entities
  • presidio-image-redactor – redacts PII in images, including medical DICOM scans
  • presidio-structured – searches tabular data (DataFrames) column by column for PII
  • presidio-cli – enables command-line scans for CI/CD pipelines

The current version 2.2.364 from July 2026 shows active development: Python 3.14 compatibility, new country recognizers (Philippines, Germany), and batch deanonymization were recently added.

How does PII protection work?

The typical workflow is two-stage: First, the AnalyzerEngine analyzes the text and returns a list of detected entities with text position and confidence score. Then the AnonymizerEngine takes these results and applies the desired operators.

from presidio_analyzer import AnalyzerEngine
from presidio_anonymizer import AnonymizerEngine
from presidio_anonymizer.entities import OperatorConfig

analyzer = AnalyzerEngine()
anonymizer = AnonymizerEngine()

text = "Mein Name ist Max Mustermann, Tel: 0170-1234567"

# Step 1: Detect PII
results = analyzer.analyze(text=text, language="de")

# Step 2: Anonymize PII
anonymized = anonymizer.anonymize(
    text=text,
    analyzer_results=results,
    operators={"DEFAULT": OperatorConfig("replace")}
)

print(anonymized.text)
# Output: "Mein Name ist <PERSON>, Tel: <PHONE_NUMBER>"
Enter fullscreen mode Exit fullscreen mode

The analyzer currently supports over 100 predefined recognizers for various countries and entity types: from email addresses, IBANs, and credit card numbers to country-specific ID documents. spaCy, Stanza, or Hugging Face Transformers can serve as the NLP engine. Language detection is extensible – while English is configured by default, additional languages can be added by swapping the NLP model and adjusting context words.

Presidio in front of AI pipelines: Working GDPR-compliant

The most important use case for companies is deployment as a protective layer in front of LLMs. Before a prompt reaches an AI service, it passes through Presidio: email addresses, phone numbers, names, and other personal data are replaced with placeholders. The risk of unintentional data disclosure drops dramatically.

From a GDPR perspective, however, an important nuance must be noted: Presidio typically performs pseudonymization, not complete anonymization. Since the encrypted or hashed values can be restored under certain circumstances (e.g., via the built-in decrypt operator), the data continues to qualify as personal data under GDPR Recital 26 – but the risk is significantly reduced. For true anonymization, the data would need to be irreversibly deleted or aggregated in such a way that no re-identification is possible.

Presidio can be operated in various ways: embedded as a Python library in existing applications, as a Docker container for microservice architectures, via PySpark for batch processing on data pools, or in Kubernetes clusters.

Limitations and honesty

The developers of Presidio are transparent: "Presidio can help identify sensitive/PII data in un/structured text. However, because it is using automated detection mechanisms, there is no guarantee that Presidio will find all sensitive information." PII detection is never 100% accurate – NER models can produce false positives, miss unusual formats, or misinterpret context. Presidio is a powerful tool, but not a substitute for legal advice or a comprehensive Data Protection Impact Assessment (DPIA).

Conclusion

Presidio has evolved from a Microsoft-internal tool into an independent community project and is today the most mature open-source building block for PII detection and anonymization. For companies that want to operate AI systems GDPR-compliant, it is one of the most practical solutions: it is self-hostable, auditable, extensible, and covers text, images, and tabular data. Anyone looking to add a PII protection layer to their AI workflow will find a solid, actively maintained entry point in Presidio.

Sources

  1. Representative documentation homepage – Presidio by Data Privacy Stack: https://presidio.dataprivacystack.org
  2. GitHub repository (README, license, architecture): https://github.com/data-privacy-stack/presidio
  3. Project Transition – Microsoft → Community project: https://github.com/data-privacy-stack/presidio/blob/main/docs/project_transition.md
  4. Releases – Version 2.2.364 (July 22, 2026): https://github.com/data-privacy-stack/presidio/releases
  5. Analyzer documentation (architecture, recognizers, API): https://presidio.dataprivacystack.org/analyzer/
  6. Anonymizer documentation (operators, hash, encrypt): https://presidio.dataprivacystack.org/anonymizer/
  7. Multi-language support in Presidio: https://presidio.dataprivacystack.org/analyzer/languages/
  8. Pasquale Pillitteri (June 19, 2026, updated July 15, 2026) – Presidio & GDPR: https://pasqualepillitteri.it/en/news/5538/microsoft-presidio-pii-data-protection-ai

Top comments (1)

Collapse
 
veramask profile image
Veramask API Team •

Good overview. I've used Presidio on a few projects and the pseudonymization point near the end is the one most teams miss. Deterministic output is what makes anonymized data useful for joins and analytics, but the moment your mapping is repeatable it's still linkable, so Recital 26 still applies.

The other choice people run into is whether to run the models at all. Presidio works well self-hosted, but plenty of teams don't want to babysit NLP models just to clean a log stream. That's why hosted anonymization APIs are showing up, some of them stateless with zero retention. Same detect-and-transform job, done as a service. Presidio for control, an API for convenience. Nice to see this space written up honestly.