{"site":{"name":"Koji","description":"AI-native customer research platform that helps teams conduct, analyze, and synthesize customer interviews at scale.","url":"https://www.koji.so","contentTypes":["blog","documentation"],"lastUpdated":"2026-10-25T12:29:51.476Z"},"content":[{"type":"blog","id":"e386f7ff-ffea-4fc0-bb54-16bfa0a7c6eb","slug":"pii-redaction-user-research","title":"Automatic PII Redaction in User Research: What It Catches, What It Misses, and Where to Use It","url":"https://www.koji.so/blog/pii-redaction-user-research","summary":"Guide to automatic PII redaction in user research, October 2026. Redaction replaces direct identifiers in interview transcripts (names, email addresses, phone numbers, street addresses and postcodes, employers) with labels such as [NAME], while products, job titles, cities and ages stay. It is not anonymization: automatic tools miss some details (a 2008 de-identification study reported recall of 0.943), and indirect identifiers can still point to one person (Sweeney estimated 87% of Americans are unique by ZIP code, gender and birth date, Golle later put it at 63%). Redacting at the source, before analysis, means summaries, reports and exports start clean. Dovetail added automatic redaction on its Enterprise plan in March 2026. Koji has a per-study Remove personal details setting on every plan, including free: each interview is cleaned when it finishes, the original is not kept, the voice recording is dropped if anything was removed, and pre-interview form answers stay as they are.","content":"**Short answer:** automatic PII redaction finds the details that identify a participant in an interview transcript (names, email addresses, phone numbers, street addresses, employers) and replaces them with labels such as [NAME] before anyone analyzes the data. It is the fastest way to cut how much personal data your research holds, and it works best when it happens at the source, before summaries, reports and exports are built. It is not anonymization. A transcript with every name removed can still point to one person through their job, city and story, and automatic tools miss some details. Use redaction to shrink your risk, then review what you share.\n\nThis guide covers what redaction catches, what it misses, where it pays off, and how to set it up in Koji.\n\n## Why personal details end up in transcripts\n\nYou never ask for them, and they arrive anyway. People explain context the way they would to a colleague: \"my manager Priya set this up\", \"we moved from the Leeds office\", \"email me at tom@acme.com if you want the file\". In a customer interview, the participant names their employer in the first minute, because it explains why they use your product.\n\n![Two people talking on a video call at a laptop, the kind of everyday conversation where names and employers come up without anyone asking](https://images.unsplash.com/photo-1758874573113-aa93077f421f?crop=entropy&cs=tinysrgb&fit=max&fm=jpg&ixid=M3w5NDUzMDN8MHwxfHNlYXJjaHw5fHx0d28lMjBwZW9wbGUlMjB2aWRlbyUyMGNhbGwlMjBsYXB0b3B8ZW58MXwwfHx8MTc5MjkxMTAxMHww&ixlib=rb-4.1.0&q=80&w=1080)\n\n_Photo by [Vitaly Gariev](https://unsplash.com/@silverkblack?utm_source=koji&utm_medium=referral) on [Unsplash](https://unsplash.com/?utm_source=koji&utm_medium=referral)_\n\nEach of those details is personal data under GDPR, and each copy multiplies. The transcript feeds a summary, the summary feeds a report, quotes go into a slide deck, the deck goes to leadership, and someone exports everything to a spreadsheet. By the time a study is done, a single name can live in a dozen places you will never clean up by hand.\n\nThat matters because personal data is what attackers and regulators care about most:\n\n- In the IBM [Cost of a Data Breach Report 2025](https://www.ibm.com/reports/data-breach), customer personal data was the most commonly compromised record type, involved in 53% of breaches, and the global average breach cost $4.44 million.\n- The [DLA Piper GDPR fines and data breach survey of January 2026](https://www.dlapiper.com/en/insights/publications/2026/01/dla-piper-gdpr-fines-and-data-breach-survey-january-2026) counted about €1.2 billion in GDPR fines across Europe in 2025, and an average of 443 breach notifications a day.\n\nResearch teams are rarely the target, but research data is often the least governed copy of customer data in a company. Holding less of it is the cheapest protection there is.\n\n## What automatic PII redaction catches\n\nGood redaction targets the direct identifiers: the details that, on their own, tell you who someone is or how to reach them. In Koji, that means five kinds of detail, each replaced with its own label:\n\n- **Names** of people, including the participant, colleagues and family, full names and first names: [NAME]\n- **Email addresses**: [EMAIL]\n- **Phone numbers**: [PHONE]\n- **Street addresses and postcodes**: [ADDRESS]\n- **Employers**, meaning the organisation the participant or someone they mention works for, studies at or is a client of: [COMPANY]\n\nJust as important is what stays. Products, apps and tools people talk about remain, because \"we left Notion for Slack\" is the finding, not the risk. Job titles, cities, countries and ages also stay, since they carry meaning for analysis and are not direct identifiers on their own.\n\nHere is what that looks like on a real kind of answer:\n\n> **Before:** \"I am a team lead at Northwind, and my colleague Anna Schmidt and I moved the whole team from Trello to Asana last spring. You can reach me on 020 7946 0018.\"\n>\n> **After:** \"I am a team lead at [COMPANY], and my colleague [NAME] and I moved the whole team from Trello to Asana last spring. You can reach me on [PHONE].\"\n\nThe finding (a team lead who moved a team from Trello to Asana) survives. The person does not.\n\n![Table comparing what automatic PII redaction removes from an interview transcript, such as names, emails, phones, addresses and employers, with what it keeps](/visuals/pii-redaction-removed-vs-kept-table/pii-redaction-removed-vs-kept-table.png \"Use this to decide what you still need to check by hand before you share a transcript\")\n\n## What redaction misses\n\nTwo kinds of gap are worth knowing before you rely on it.\n\n**Some direct identifiers slip through.** Detection is never perfect, whoever does it. In a 2008 study of automated de-identification of nursing notes, the software reached a [recall of 0.943](https://groups.csail.mit.edu/medg/ftp/psz-papers/BMC%20Med%20Inform%20Decis%20Mak%202008%20Neamatullah.pdf), meaning it missed close to 6% of the protected details. Newer tools do better, but none claim 100%. Unusual spellings, nicknames, a name used as a common word, or an employer mentioned through a product name are the typical misses.\n\n**Indirect identifiers are not removed at all, by design.** A job title, a city and an age are kept because analysis needs them. Combined, they can still point to one person. Latanya Sweeney showed in 2000 that [87% of Americans could likely be identified](https://dataprivacylab.org/projects/identifiability) by just their ZIP code, gender and date of birth. A later re-check by Philippe Golle on 2000 census data put the figure at [about 63%](https://crypto.stanford.edu/~pgolle/papers/census.html), still most of the population. In B2B research the risk is sharper: \"the only head of procurement at a 40-person fintech in Lisbon\" is one person, with or without a name.\n\nSo redaction makes a transcript far less identifying. It does not make it anonymous. For that, you need the judgment calls in our guide to [anonymizing customer interview data](/docs/anonymizing-customer-interview-data): generalising roles, rounding numbers and removing stories that only one person could tell.\n\n## Where redaction belongs: at the source\n\nRepository tools that offer redaction usually apply it to recordings and transcripts after they arrive. Dovetail, for example, added [automatic redaction](https://dovetail.com/changelog/automatic-redaction/) in March 2026 with Off, On and Suggest modes, available on its Enterprise plan and applied to content uploaded after the setting is switched on. That is useful for a repository that gathers files from many sources.\n\nRedacting at the source changes what exists in the first place. If the details are removed when the interview finishes, before any summary or report is built, then every copy downstream starts clean: the per-question results, the quotes in the report, the shared link and the CSV export. Nothing has to be found and fixed in ten places, because it was never written to them.\n\nIt also helps you meet two GDPR principles without extra process. Data minimisation asks you to hold only what you need, and storage limitation asks you not to keep it longer than you need. If you never needed to know where the participant works to answer your research question, the right amount to keep is none. Our guide to [GDPR-compliant AI user research](/docs/gdpr-compliant-ai-user-research) covers the rest of the picture, from consent to retention.\n\n## When to turn it on\n\nRedaction costs you very little in most studies, since the findings rarely depend on a name. Turn it on by default when:\n\n- **Participants are the end users of your customers**, and you have no reason to know who said what\n- **The topic is sensitive**: health, money, employment, conflict at work, or anything a participant would not want traced back to them\n- **Results travel widely**, to leadership, a client or a public report\n- **You work in a regulated industry**, or a customer contract limits how you may handle their staff data\n- **You are an agency** sharing raw data with a client who should see themes, not people\n\nLeave it off when you genuinely need identity in the transcript, for example account-level win-loss interviews where the sales team must follow up with each named customer. Even then, keep identity in the pre-interview form, where you asked for it on purpose, rather than in free text.\n\n## How it works in Koji\n\nRemove personal details is a per-study privacy setting, available on every Koji plan, including the free one.\n\n1. Open the study and go to **Branding & Settings**.\n2. Open the **Privacy** section and turn on **Remove personal details (PII)**.\n3. Run interviews as usual. Each interview is cleaned when it finishes, before Koji analyzes it.\n4. Review responses before you share them, since automatic removal can miss some details.\n\nA few details matter in practice:\n\n- **The original is not kept.** Koji overwrites the transcript with the cleaned text. A hidden copy would be masking, not removal.\n- **The voice recording goes too.** If anything was removed from a voice interview, Koji does not keep the recording, since it holds the same details in the voice of the participant.\n- **Both sides of the conversation are cleaned.** A name the participant says is also removed where the AI interviewer repeats it back.\n- **Only the exact words are replaced.** The rest of each answer stays word for word, so quotes in your report are still in the words of the participant.\n- **It applies going forward.** Interviews that finish after you turn it on are cleaned. Answers to your [pre-interview form](/docs/intake-forms-and-consent) stay as they are, because those are fields you asked for by name.\n- **You can switch it on from chat.** Chat with Koji, or an AI assistant connected through the [MCP connector](/docs/mcp-overview), can turn the setting on for a study.\n\nBecause redaction runs before analysis, everything built on top of the transcript reads the cleaned text: summaries, quality scores, themes, report quotes and [exports](/docs/exporting-research-data).\n\n![Koji report summary with a side panel of supporting participant quotes behind one finding](/email/shots/shot-evidence-panel.jpg \"Report quotes are built from the cleaned transcript when Remove personal details is on\")\n\n## Before you share redacted data\n\nRedaction does most of the work, and a short human pass does the rest. Run this check before a transcript, a quote or an export leaves your team:\n\n![Checklist of eight things to check before sharing redacted interview data, from scanning quotes for missed names to setting a deletion date](/visuals/redacted-interview-data-sharing-checklist/redacted-interview-data-sharing-checklist.png \"A two-minute pass that catches what automatic redaction misses\")\n\n- Scan every quote you plan to share for names, nicknames and email addresses the tool missed\n- Look for rare combinations of role, company size and city that point to one person\n- Remove stories only one person could tell, such as a named incident or a unique project\n- Check what the pre-interview form collected, since redaction leaves it as it is\n- Share themes and short quotes rather than full transcripts wherever you can\n- Give each audience the least access it needs: a public report, a team or a named person\n- Set a date to delete raw data you no longer need, following your [retention policy](/docs/research-data-retention-deletion)\n- Tell participants in your consent text how their details are removed and who sees the results\n\n## The bottom line\n\nPersonal details get into interviews whether you ask for them or not, and every summary, report and export copies them further. Automatic redaction at the source is the simplest way to stop that: names, contact details, addresses and employers are replaced before analysis, products and context stay, and every copy downstream starts clean. It will miss a little, and it will not hide a person whose story is unique, so pair it with a short review before you share. For a fuller list of questions to ask any vendor, see our [AI interview data privacy and security guide](/docs/ai-interview-data-privacy-security).\n\n## Try it in Koji\n\n[Start a free Koji study](https://www.koji.so/signup) with 10 credits and no card. Write one research question, let the AI draft the brief, turn on Remove personal details under Branding & Settings, and take the interview yourself in preview to see what your participants will see.\n","category":"Research","lastModified":"2026-10-25T07:20:13.563968+00:00","metaTitle":"PII Redaction for User Research: What It Catches and Misses","metaDescription":"Automatic PII redaction removes names, emails, phones, addresses and employers from interview transcripts. What it catches, what it misses, and how to use it.","keywords":["pii redaction","pii redaction user research","redact interview transcripts","remove personal data from transcripts","anonymize interview data","gdpr user research","research data privacy"],"aiSummary":"Guide to automatic PII redaction in user research, October 2026. Redaction replaces direct identifiers in interview transcripts (names, email addresses, phone numbers, street addresses and postcodes, employers) with labels such as [NAME], while products, job titles, cities and ages stay. It is not anonymization: automatic tools miss some details (a 2008 de-identification study reported recall of 0.943), and indirect identifiers can still point to one person (Sweeney estimated 87% of Americans are unique by ZIP code, gender and birth date, Golle later put it at 63%). Redacting at the source, before analysis, means summaries, reports and exports start clean. Dovetail added automatic redaction on its Enterprise plan in March 2026. Koji has a per-study Remove personal details setting on every plan, including free: each interview is cleaned when it finishes, the original is not kept, the voice recording is dropped if anything was removed, and pre-interview form answers stay as they are.","aiKeywords":["pii redaction","transcript redaction","user research privacy","gdpr","data minimisation","anonymization","koji"],"aiContentType":"guide","faqItems":[{"answer":"PII redaction replaces the personal details in research data, such as names, email addresses, phone numbers, street addresses and employers, with labels like [NAME], so the data can be analyzed and shared without identifying the participant. In interview research it is applied to transcripts, and ideally before summaries, reports and exports are built from them.","question":"What is PII redaction in user research?"},{"answer":"No. Redaction removes direct identifiers, but job titles, cities, ages and unusual stories stay, and combined they can still point to one person. Automatic tools also miss some details. Treat redacted data as lower risk, not anonymous, and review quotes before sharing them.","question":"Is a redacted transcript anonymous?"},{"answer":"Names of people, email addresses, phone numbers, street addresses and postcodes, and the organisations people work for, study at or are clients of, each replaced with a label such as [NAME] or [COMPANY]. Products and tools people mention stay, along with job titles, cities, countries and ages. Answers to the pre-interview form are left as they are.","question":"What does Koji remove when Remove personal details is on?"},{"answer":"Rarely. Only the exact words that identify someone are replaced, and the rest of each answer stays word for word. Because products and context are kept, themes and quotes keep their meaning. Summaries, quality scores, report quotes and exports are all built from the cleaned text.","question":"Does redaction change my findings?"},{"answer":"Every plan, including the free one. Turn it on per study in Branding and Settings, in the Privacy section. It applies to interviews that finish after you switch it on.","question":"Which Koji plans include PII redaction?"},{"answer":"If anything was removed from a voice interview, Koji does not keep the recording, since it holds the same details in the voice of the participant. The original transcript is not kept either.","question":"What happens to the voice recording?"}],"relatedTopics":["research-privacy","gdpr","research-operations","ai-interviews"]}],"pagination":{"total":1,"returned":1,"offset":0}}