Anonymisation or your own AI infrastructure: what protects data when using AI

What are the three approaches?

Anyone who wants to use AI with personal data faces an architecture decision. Three approaches are common, and they solve different problems:

• Pseudonymisation or anonymisation proxy: Software between your staff and a public language model detects names, addresses or file numbers, replaces them with placeholders and puts them back into the answer. The model itself stays with the third-party provider. How this works technically is explained in the guide Pseudonymisation proxy.
• AI security gateway (DLP, data loss prevention): It detects sensitive details when public AI services are accessed and blocks or reports them, usually without restoring them in the answer.
• Confidential inference (confidential computing): The model runs at the provider in a hardware-protected environment, a trusted execution environment (TEE). The operator of the infrastructure is not supposed to have access to the plain text. More in the guide Confidential computing for AI.
• Your own AI infrastructure: Platform and AI model run on a server at your organisation or in the environment of a provider that you bring in through a data processing agreement and, where applicable, an agreement under § 203 StGB (German Criminal Code, professional secrecy). The data is not disguised; it does not leave this setting.

Who sees the plain text with each approach?

The most important question for data protection and professional secrecy is where plain text exists.

Feature	Proxy in front of a third-party model	Confidential inference	Your own AI infrastructure
Where does the model run?	At the model provider	At the provider, in protected hardware	In your environment or at the provider brought in by contract
Who sees plain text?	Your organisation; the proxy provider if the proxy does not run at your site	Your organisation; according to the manufacturer, not the operator	Your organisation and the operator brought in, within the data processing agreement and permissions
What reaches the model?	Disguised text with all details that were not detected or not replaced	The complete text, encrypted all the way into the protected environment	The complete text
What you rely on	Detection quality, contracts with the proxy and model providers	Hardware, firmware, attestation and the provider’s implementation	Operator, contracts, permissions and logs
Quality of answers	Can drop if replaced details are needed for understanding	Depends on the model	Depends on the model

What remains to be done legally?

For your organisation, the data remains personal data whichever approach you choose. Under Art. 4(5) GDPR, pseudonymised data is data that can no longer be attributed to a person without additional information kept separately; it remains personal data for whoever holds the key. You therefore still need a legal basis, for health data an exception under Art. 9(2) GDPR, and usually a data protection impact assessment.

The situation for the recipient is open. On 4 September 2025, the Court of Justice of the European Union ruled that pseudonymised data is not personal data in every case and for every party (C-413/23 P). Whether a model provider may treat the data as anonymous depends on the means of identification realistically available to it. If it processes the data on your behalf, the draft of the European data protection authorities says your perspective applies: the data is then personal data for the provider too. The draft (Guidelines 02/2026 on anonymisation, consultation until 30 October 2026) tests anonymity against three criteria: singling out a person, linking with other data and inference. The French CNIL uses the same three criteria. Details are in the guide Is pseudonymised AI use GDPR-compliant?, and the consequences for transfers to the US in the guide Third-country transfers.

Which approach fits which purpose?

• Proxy: useful for texts in which a few easily recognisable details identify a person, such as general correspondence, templates or research without personal reference. With free text containing rare diagnoses, locations or life circumstances, proving anonymity becomes hard, and the answer suffers when important details are missing (loss of context).
• Confidential inference: useful if you want to use a provider’s model and technically exclude its operating staff. It does not remove the personal reference; contracts, legal basis and third-country questions remain.
• Your own AI infrastructure: useful if patient, citizen or social data is to go into the AI in full, for example for doctor’s letters or administrative decisions. To do this, you operate the model yourself or have it operated by a provider that you review like any other processor.

An example, expressly made up: a hospital has the case “Maria Müller, 43, Starnberg, rare metabolic disorder” summarised. The proxy replaces the name with “PATIENT_17”. Age, place and rare diagnosis together can still make the person identifiable. For such texts, the proxy remains one building block but does not replace the review of the recipient.

Which questions should you answer before deciding?

1. Which data is to go into the AI, and how sensitive is it?
2. Do the tasks need details that a proxy would replace?
3. Who sees plain text where, and which contracts do you need for this?
4. What role does the model provider have (processor or independent recipient), and which contracts follow from this?
5. What does operation cost over several years, with all parties involved?

The Datenschutzkonferenz (the German data protection conference) requires a case-by-case review even where masking is applied upstream. For the proxy, the checklist with evidence for patient data helps; for the providers, the market overview.

How does this work with basebox?

basebox is your own AI infrastructure in the sense of the third approach: platform and AI model run on a server dedicated to you, without an internet connection if you wish, or in our cloud in the Munich-East data centre. In the cloud, each organisation gets its own virtual environment with its own account management; the AI model runs on servers operated by us and is shared, and a model for your organisation alone is available on request. By default, basebox sends your data to no AI model of another provider. An external model is only available as a separate app that you explicitly have set up; it runs on Google Vertex in the EU, without training, with logging for abuse detection by Google for up to 30 days (details).

That is why you do not have to anonymise the data for basebox beforehand, and the tasks keep their full context. basebox is not a tool for disguising data. This is a different architecture decision from a proxy in front of a third-party model; which approach fits depends on your data and use cases. The platform includes apps you can share without sharing data, connectors to existing systems, permissions from your directory service and logs.

In the cloud, basebox costs €490 per person per year from 5 people, less with more people; 20 million tokens per person per year are included. With the server, you buy the hardware once and pay one licence per server; anyone may sign in. The calculator works out your price. The data processing agreement, the agreement under § 203 StGB and templates for the data protection impact assessment are on the Security page.

Not legal advice: This article gives an overview. The legal position on anonymisation is partly open: Guidelines 02/2026 are a draft under consultation, and the consequences of judgment C-413/23 P are still being discussed. Review your use case with your data protection officer. Research as of 11 October 2026.