ChatGPT for Tax Preparers: How to Redact a Return Before You Paste

Remove every identifier that points to a person (names, ID numbers, addresses, account numbers, employer names, dates of birth), delete the text underneath with a true redaction tool, replace each with a placeholder such as PERSON-A, and keep the figures. Check the saved file by copying all of it into a blank note before you paste anything into ChatGPT.

The step most people get wrong is the middle one. A black rectangle drawn over a PDF is a picture sitting on top of text; the text is still there to be selected, searched and pasted. Genuine redaction deletes the characters, and your own test, not the tool's say-so, is what proves it worked.

Follow me on Instagram@sagnikteaches

What counts as taxpayer information in a return

The obvious fields are only half of it. A return is a document built to identify one household or one business, and identification can come from a name, from a combination of small details, or from the file itself. Treat anything on the list below as identifying until you have decided otherwise.

Connect on LinkedInSagnik Bhattacharya

Two things catch preparers out. First, the file name: "Smith-J-2025-return-final.pdf" is itself a disclosure, and the name travels with the upload into the chat and its history. Second, indirect identifiers. "A dentist who sold a practice for $1.2 million in a small community" may be recognisable without a single name on the page. If your client is the only one a stranger could plausibly match, round the figures or generalise the occupation.

Subscribe on YouTube@sagnikteaches

Decide first whether this return should go near a chatbot

Redaction is the second control, not the first. The first is permission. Before the technique matters, three questions need a yes:

• Does your engagement letter or privacy notice allow you to use third-party tools to prepare the return? If not, fix the letter before you upload anything, and read the tutorial on consent clauses for AI tools for the wording to consider.
• Is the account you are using one your firm controls? A personal free account on a staff member's phone is not. A business plan is the baseline: ChatGPT Business and Claude Team, like Microsoft 365 Copilot and Gemini in Workspace, do not train on business content by default, whereas consumer plans can be set not to train but rely on each user remembering to set it.
• Does your written security plan mention AI tools? The security plan template for tax preparers shows where they belong.

If the answer to any is no, the safest redaction is not uploading. Everything below assumes you have a yes to all three and want to reduce risk further.

The business plan baseline, with training off and nothing stored

Set up the account before you touch a client file, and do it once for the whole practice.

1. Use a business workspace. ChatGPT Business needs at least two seats, so a sole preparer pays for two or accepts an individual plan. On an individual plan, open the data controls and switch off the option that lets your chats improve the model. Labels change, so read the screen rather than trusting a screenshot from last year.
2. Know the retention rule. A temporary chat in ChatGPT stays out of your history, but OpenAI may keep a copy for up to 30 days for safety purposes. On Claude's individual plans, Anthropic says it may keep de-identified chats for up to five years when model improvement is switched on, and deleted chats leave its back-end storage within 30 days. A deletion button does not mean instant erasure, so redaction still matters.
3. Turn off memory for client work, or keep client questions in a ChatGPT Project set to project-only memory, with no client facts in its files, so one client's details cannot surface in another conversation.
4. Lock the account. Single sign-on or two-step sign-in, one named user per seat, and removal of leavers the day they go. OpenAI's own pages describe an owner's view of members' private chats on ChatGPT Business differently, so never plan to recover a leaver's work from the workspace: saving each answer to the client file is part of the routine.
5. Write one line in your procedures: "Client files are redacted before upload; the placeholder key stays in the client folder."

That last line is the point of the rest of this tutorial. None of the settings above is a substitute for it, and none can be shown to a client as easily as a visible habit.

Redacting a PDF so the text is actually gone

PDFs arrive in three shapes, and each needs a different method.

A PDF from your tax software (text-based)

This has a text layer. Use a redaction feature, such as Redact a PDF in Acrobat Pro or the equivalent in a PDF editor you trust, not a highlight, shape or "black pen" annotation. The tool should mark the areas, then apply the redactions, which deletes the characters under the marks. Then:

1. Search for each client surname, the first five digits of the tax ID, the street name and the bank name. Mark every hit, not only the first, because headers repeat on every page.
2. Apply redactions and save under a new, neutral name such as "REDACTED-A-return.pdf".
3. Run the sanitise step to remove metadata, comments, hidden layers and other hidden content. In Acrobat Pro the option sits in the same Redact a PDF tool, and the Apply step also offers to sanitise the file as it saves.
4. Run the copy test (below).

A scanned PDF (an image)

A scan has no text to delete, but it often has an invisible text layer added by OCR (optical character recognition), which is the part that leaks. Open it and press select-all: if text highlights, the layer exists. Either redact the image regions and run OCR again after redaction, or print to a fresh image-only file. Apply the redaction on the page image itself, then export again as a flat image PDF.

A screenshot or phone photo

Crop first, then cover. Cropping removes the pixels; a sticker or drawing tool on a phone is often a removable layer in the original. Export as a new image, and check that the camera's location data and file name are not carried along.

The copy test that proves it

Open the saved redacted file in a different viewer from the one you used to redact it. Press select-all, copy, and paste into a blank note. Then use the viewer's search box for the surname, the street and the first digits of every ID. Nothing should appear. If a name appears in the note, the black box was cosmetic. Do not argue with the file; delete it and redo the redaction.

Placeholders that keep the answer useful

An answer is only worth having if the model can still reason about who is who. A blank bar over every name makes "who is the dependant, and who is the payer?" unanswerable. Replace each identifier with a stable label instead, and keep the same label throughout the document and every follow-up message.

Keep the key (PERSON-A is the real client) in the client folder on your own system, in a file that never goes into any chat, Project or knowledge store. When the answer comes back, you paste it into your working paper and swap the real names in there.

A full redaction, start to finish, on one invented return

Here is an illustration with made-up data: a married couple, one employed and one self-employed, with a rental house, filing jointly. The preparer wants to know whether the pattern of quarterly estimated payments led to an underpayment penalty and whether the rental loss is limited.

The raw file is a 14-page PDF from the tax software, with the surname in every footer and a bank account on page 2. The preparer's steps, with illustrative timings:

1. Search and mark, 3 minutes. Hits: the surname 31 times, the street name 9 times, the employer 4 times, the bank 2 times, the first digits of two ID numbers 28 times.
2. Apply redactions and sanitise, 1 minute. The tool reports 74 items removed plus metadata.
3. Write the key. A redaction tool only blanks; it does not substitute. So the preparer types a one-page cover note: "PERSON-A is the self-employed spouse; EMPLOYER-1 pays PERSON-B." That cover note goes into the chat alongside the redacted PDF, and it contains no real identifiers.
4. Copy test, 2 minutes. One hit remains: the employer name appears again inside a wage statement scanned as an image with an OCR layer. The preparer redacts that region and runs the test a second time. It passes.
5. Total: about 10 minutes, for a return that would take 30 or more minutes to question properly. The saving comes from the answer to a real question, so the routine pays for itself on anything complex and not on a simple wage-only return.

The question sent, with the redacted file and the cover note:

You are helping a tax preparer. All names, IDs and addresses are replaced with placeholders. Use only the attached redacted return and the cover note.

1. Check whether the figures on the estimated-payment lines suggest an underpayment penalty, and show the arithmetic.
2. Explain which limits could restrict the rental loss and what facts I must confirm with the client.
3. List anything you cannot tell from this file instead of guessing.

Answer in numbered points, with the page number you used for each figure.

The sample reply (illustrative) came back with a clear calculation for question 1, a list of three limits for question 2 and a "cannot tell" list that included the client's participation in the rental. It also asked for the prior-year balance, which the preparer realised was missing from the file. That last point is typical: the model finds the gap in the file faster than a tired human at 7pm. The preparer then verified every figure against the return and the software's own diagnostics, because the draft is a prompt for checking, not a result.

Before and after: the same question, two ways

This is the same query written carelessly, then with the routine applied.

Before: "Here's the Hendricks 2025 return, they're asking about the rental, can you check the depreciation? Account ending 4471 got the refund."

After: "Attached is a redacted return with placeholders. RENTAL-1 is a house bought in 2019 and let all year. Check the depreciation schedule on page 9 for method and recovery period, show the arithmetic and flag anything I should confirm with the client."

The second prompt contains no name and no account fragment. It is also better. The model is told the purchase year, the page and the output shape, so it has less room to wander. A common outcome of redaction is not a worse answer but a sharper one, because you have been forced to decide which facts the question needs.

Spreadsheets, emails and notes need the same treatment

Preparers rarely paste only returns. A few other file types to prepare differently:

• Excel and CSV. Delete columns you do not need rather than hiding them. Hidden sheets, comments and named ranges survive a "Save as", so copy the numbers you need into a new workbook. For bulk work, cleaning messy data covers find-and-replace habits: replace with your placeholder key, then filter each column for the real surname to confirm none survived.
• Client emails. Strip signatures, the address block, the thread history and the reply chain. A forwarded chain often carries three other people's names.
• Interview and meeting notes. Notes drift into personal detail: a health problem behind a medical deduction, a divorce behind a filing-status change. Summarise to the tax relevance ("PERSON-B had unreimbursed medical costs of $7,400") before you paste.
• Notices and letters. They contain the reference number that lets anyone look the case up. Remove the reference as well as the name.

Four redaction mistakes, and how each one shows up

The cosmetic box. You pasted a redacted PDF and the model's answer says "your client Maria". The text layer survived. Delete the chat, redo the file, and make the copy test a step nobody skips.

The leaking file name. The upload shows its name in the chat and in history. Rename to a neutral label before choosing the file, never after.

Placeholders that collapse. If you replace both spouses with "CLIENT", the answer says "the client's wages" and you cannot tell whose. Use A and B, and keep the labels identical across messages.

The small-cell client. A self-employed vet with one sale of a farm in the year does not become anonymous because the name is gone. When a combination of occupation, place and a unique transaction would let anyone guess, generalise the occupation ("a self-employed professional") and round the unusual figure, and note in the file that you did.

A checklist you can paste into your procedures

Edit the wording, keep the structure, and file it with the working papers so that anyone reviewing your file can see the routine happened.

1. Written permission on file for AI tools (engagement letter clause or client consent): yes or no, and the date.
2. Account used: firm business account, named user, training off or business default.
3. File renamed neutrally before upload.
4. Names, ID numbers, addresses, bank details, employer names, dates of birth, property identifiers removed or replaced.
5. Redaction applied with a tool that deletes text; metadata sanitised.
6. Copy test run in a second viewer: passed, with initials.
7. Placeholder key stored in the client folder only.
8. AI output checked line by line against the return and the software before use.
9. Chat deleted after the answer is saved to the file, if your policy requires it.

The initials on step 6 matter. If a client ever asks what you did with their data, a signed line beats a recollection.

When the answer needs something you redacted

Sometimes the real question depends on a redacted fact: whether an employer is a related party, or whether a property sits somewhere with particular rules. Do not put the detail back. Ask the model for a conditional answer instead: "Give me the answer if EMPLOYER-1 is related to PERSON-A, and the answer if it is not." Then apply the correct branch yourself. You keep the identifier out of the chat and the model's reasoning stays useful.

For wording that clients see, such as emails explaining a refund delay, you can work the other way round: ask for a template with brackets, and add the real details in your mail client. That is the approach in the prompt set for tax preparer emails and checklists, and it needs no redaction at all because no client data is pasted.

Making the routine stick in a busy practice

A routine that takes ten minutes is a routine that gets skipped at 6pm in a rush week. Three things help. Make redaction a staff job with a named owner for the week, not an optional extra for whoever is asking. Keep a saved cover-note template and a standard prompt in a shared Project, so nobody composes from scratch. And review five random files a month against the checklist, which takes under half an hour and catches drift early. The tutorial on using AI through busy season covers how to fit the routine into the calendar.

If you would rather map these steps to your own workflow with someone, that is what my AI implementation consultation is for.

Redaction questions preparers ask

Is a black box drawn over a PDF enough?

No. A black rectangle added as an annotation leaves the text underneath, and anyone can select, copy or search it. Use a redaction tool that removes the underlying text, then flatten the file and test it by pressing select-all and pasting into a blank note. If anything readable appears, start again.

Can I skip redaction on a business plan with training off?

A business plan that does not train on your content lowers one risk, but your engagement letter, your data-security policy and the client's consent still decide what you may upload. Redacting is cheap insurance, and it often gives a better answer because the model sees only the numbers.

Do I need to redact the numbers too?

Usually not. Amounts are what the question is about. Redact the identifiers that point to a person: names, ID numbers, addresses, account numbers, employer names and dates of birth. Round or shift figures only when the amounts alone would make a rare client recognisable.

Should the placeholder key live in ChatGPT?

No. Keep the key that links placeholders to real names in the client file on your own systems, never in the chat or a Project. Paste the answer back into your working paper and swap the real details in locally.

What if the client refuses any AI use?

Then you do not upload anything about them. Record the refusal in the file, work the return the usual way and use AI only on invented practice data or on general tax questions with no client facts in them.

Further reads

• Form 8867 Due Diligence With AI: Interview Notes and Checklists — Interview notes and due diligence checklists with AI.
• AI Engagement Letters for Accountants: Faster Drafts, Clear Scope — Engagement letter wording that covers AI use.
• 7 AI Mistakes That Put an Accounting Firm's Client Trust at Risk — Seven AI mistakes that cost a firm client trust.
• AI Readiness Checklist for Accountants, Solicitors, Consultants — Check your firm is ready before wider AI use.
• Best AI Note Taker for Accountants: Which Fits a Small Practice? — Note takers compared on cost and data retention.
• Tax Preparation AI Software: TaxDome, Canopy and ChatGPT Compared — TaxDome, Canopy and ChatGPT sit in different product categories. Compare their AI, their cost models and the consent step before return data goes in.
• AI Tax Organiser: Build One That Chases Missing Documents — Turn a prior-year return into a client document list, track uploads row by row, and send reminders that name exactly what is still missing.
• AI Tax Return Review vs Software Diagnostics: What Each One Catches — Ten planted errors and two decoys on one sample return show what diagnostics catch, what an AI review adds and what both still miss.
• Credit Repair Software With AI: Dispute Letters and Client Tracking — How a credit repair business can draft dispute letters and track every client case with AI, with the legal limits and a review step on each letter.
• How Accountants Can Use ChatGPT Effectively: Review Notes and Memos — Redact first, then use three prompt patterns for review notes, technical memos and client replies, with a source-check routine for every draft.
• Tax Services AI for a Small Practice: Intake, Chasing and Review Notes — A three-part workflow for a small tax practice: intake checklist, document-chasing emails and reviewer notes, with a named person owning each step.
• Tax Workpaper Prep With AI: Tie the Return Back to Source Documents — How AI can draft a source-to-return tie-out schedule for a tax return, and the reviewer checklist that proves each figure before sign-off.
• Using AI in Financial Planning: Tax Return Data Into a Client Plan — A planner's source-to-plan workflow for tax-return figures, with a checked example and a client question log.
• Client Tax Organiser: Build One With AI and Send It by Portal — A conditional tax organiser example with client questions, portal instructions, staged reminders and a completeness review.
• AI for Speech Therapy Reports: Draft, De-Identify, Review — De-identification and review steps first, then AI drafting of an evaluation report from assessment notes, with a worked example and sign-off list.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: OpenAI ChatGPT Business pricing and enterprise privacy pages, OpenAI help on temporary chats and Projects, Claude pricing and Anthropic privacy centre, Microsoft 365 Copilot privacy documentation, Google Workspace generative AI privacy hub, Adobe Acrobat Pro help on redaction and sanitising.