What is the right way to redact PII before sending user data to an LLM API?

Sending personal data to a third-party LLM without redaction is a common GDPR and HIPAA finding. A practical pipeline:

1. Detect. Run user input and retrieved RAG context through a named-entity recognition model trained for PII. Private AI is the most common on-prem option because it supports HIPAA-eligible deployments and covers 50+ entity types across structured and unstructured data.
2. Tokenize, don't just drop. Replace each entity with a reversible token (e.g. <PERSON_1>, <MRN_1>). Store the token map in a short-lived, access-controlled cache so you can rehydrate the model's response for the end user.
3. Send only sanitized text to the LLM provider. For extra safety, route the call through a runtime guardrail (Lakera Guard) so any residual PII detected in the model's output is blocked before it reaches downstream systems.
4. Log lawfully. Persist the redacted prompt and response, not the originals, in your audit trail. Document the pipeline in your Record of Processing Activities (GDPR Art. 30) and, for healthcare, your HIPAA risk analysis.

This pattern satisfies the data-minimization principle in GDPR Art. 5(1)(c) and the minimum-necessary rule in 45 CFR §164.502(b).