PII redaction is the removal or masking of personal information, such as names and card numbers, in transcripts, call recordings, chat logs, and other data. Contact centers use it so that the people and systems that review conversations see only the data they need.
PII stands for personally identifiable information, a term from US practice. EU law uses "personal data", which the GDPR defines as any information relating to an identified or identifiable person (Regulation (EU) 2016/679, Article 4(1)). See GDPR compliance and customer data privacy.
Where PII redaction applies
Transcripts and chat logs. Text from chats, emails, and speech recognition. Detected items are replaced with a label, such as [CARD_NUMBER], or partly masked.
Call recordings. Audio segments are silenced or covered with a tone. Some setups pause recording while a card number is given, or take digits by keypad so they never reach the recording.
Analytics and quality data. Conversation data used for speech analytics, quality reviews, or model evaluation.
AI prompts and logs. Data sent to language models and speech engines, and the logs these services keep.
How redaction works
Pattern matching. Rules find items with a fixed format, such as card numbers, IBANs, or phone numbers.
Entity recognition. A model finds names, addresses, and other items with no fixed format.
Known values. The system looks for values it already holds about the customer, such as their name and address from the CRM.
Many setups combine the three. A missed item leaves personal data in place. Over-redaction removes context that analysts need, such as a product name mistaken for a person's name.
Spoken numbers can be harder to catch than typed ones, because speech recognition may write them as words or split them across a sentence. It helps to test on a sample of your own conversations and to count missed items per type.
Redaction, masking, pseudonymization, and anonymization
Redaction removes the item. Masking hides part of it, for example all but the last four digits of a card. Tokenization replaces it with a token that authorized systems can map back.
Pseudonymization, under the GDPR, means the data can no longer be linked to a person without additional information that is kept separately (Article 4(5)). Pseudonymized data is still personal data (Recital 26).
Anonymous data no longer relates to an identifiable person, and it falls outside the GDPR (Recital 26). Redacting names and numbers does not always make a transcript anonymous. The rest of the conversation, such as an unusual event, can still identify someone.
Rules that call for redaction
GDPR (European Union). Personal data has to be limited to what is necessary for the purpose (Article 5(1)(c), data minimization). Controllers must build in measures such as pseudonymization, by design and by default (Article 25).
PCI DSS (payment cards). The card industry's security standard prohibits storing sensitive authentication data after authorization, even if encrypted (Requirement 3.3.1). The PCI Security Standards Council states that card validation codes kept in a digital audio recording after authorization break that rule. Where technology exists to suppress or redact audio during data entry, it should be enabled (PCI SSC FAQ 1210).
Redaction also has to fit retention duties. Banks, insurers, and collectors may need an original recording for a complaint or dispute. One approach is an unredacted copy under tight access and a redacted copy for wider use. Where each copy is stored matters as well (see data residency).
Frequently asked questions
What is the difference between PII and personal data?
PII is a US term for information that can identify a person, such as a name or a Social Security number. The GDPR's "personal data" covers any information relating to an identified or identifiable person, including online identifiers and location data. A European contact center usually works to the GDPR definition.
Is redacted data anonymous under the GDPR?
Not necessarily. If the data can still be linked to a person with additional information, it is pseudonymized and remains personal data. It is anonymous only when the person can no longer be identified by the means reasonably likely to be used (Recital 26).
Should call recordings be redacted?
Recordings that may hold card security codes fall under PCI DSS. The PCI SSC asks for audio suppression or redaction where the technology exists, and otherwise for deletion promptly after authorization. For other personal data, the decision follows the purpose of the recording, the retention rules, and who needs access.
How accurate is automated PII redaction?
It depends on the data, the language, the channel, and the method. Speech transcripts with spoken numbers, names, and addresses tend to be harder than typed chat. A test on a sample of your own conversations, per item type, gives the figure that matters for your setup.
How we approach this at Zowie
Zowie builds AI agents for voice, chat, and email. The platform runs in our cloud or in a customer's own Google Cloud, and Zowie holds a SOC 2 Type II report. If you would like to review where conversation data is stored and who can read it, you are welcome to book a demo.
Explore: GDPR compliance, Customer data privacy, Data residency, SOC 2 compliance, AI audit trail, Speech analytics