Translating a confidential document: what to mask before you use a translator
Before you upload a contract or medical report to a translator, learn what to mask, why consistent labels help, and when a certified translation is required.
Before you translate a confidential document online, mask the names, numbers and signatures that identify someone. Most online translators send your file to a server you do not control. A masked copy keeps the meaning and hides who it is about.
This matters for a work contract sent to a foreign office, a medical report shared with a specialist abroad, or a court filing a client asks you to check. Jane Example, an HR manager, once pasted a full employee contract into a translator to check a German clause. The names, salary and address went with it.
What happens when you upload a document to a translator?
Most online translators are cloud services. Your file leaves your device, is processed on the vendor's servers, and comes back translated. What happens to the file after that depends on the vendor, the plan you use, and sometimes the country where the servers sit.
DeepL's privacy policy says that on its version without a subscription, uploaded text and documents are processed "for a limited period of time to train and improve" its translation engine. On a paid plan, DeepL says texts are deleted once the service is delivered and are not used to improve its models. Document translation itself runs on DeepL's own infrastructure in the European Economic Area for both products, according to DeepL's own privacy documentation, checked in September 2026.
Google Cloud Translation is a separate, paid product for developers and businesses, not a plan upgrade of Google Translate itself. In its own documentation, checked in September 2026, Google states that it does not use customer content to train or improve its translation features. That guarantee covers this separate business product only. Google's general privacy policy, not this specific guarantee, covers the ordinary Google Translate site most people use for a quick document. So treat an informal upload there with more care.
Does the plan you choose change what happens to your document?
The pattern repeats across vendors. A subscription often buys a written promise that your content will not train the model, and sometimes a guarantee that data stays inside the EU. A version without a subscription rarely offers either promise in writing. Read the vendor's own privacy page before you decide, not a summary of it.
| Document | Mask before you translate | Keep for meaning |
|---|---|---|
| Employment contract | Names, address, salary, national insurance or social security number | Job title, clauses, notice periods |
| Medical report | Patient name, date of birth, patient ID, doctor's signature | Diagnosis terms, test results, treatment plan |
| Court filing | Parties' full names, case reference, home addresses | Legal argument, dates of events, statute references |
| Business contract | Signatory names, bank details (IBAN), company registration numbers | Contract terms, deliverables, prices |
What should you mask before you translate a document?
Mask anything that names a person or points to one account. That means full names, home addresses, phone numbers, national ID or passport numbers, and signatures. It also means account numbers such as an IBAN, a case or file reference tied to one person, and a photo or a stamp that shows a face.
- Full names of every person named in the document
- Home address, phone number and email address
- National ID, passport, social security or tax number
- Bank details such as an IBAN or a card number
- Signatures, stamps and photos
- Any case, file or employee reference number tied to one person
Why do consistent labels keep the translation readable?
A plain black bar over every name breaks the sentence structure a translator needs. Consistent labels fix that problem. ONYRI Sanitize's Token mode is a Pro feature. It replaces each name or number with a steady tag such as [NAME1], right in the browser, so grammar and pronouns still make sense. The export is always a flattened PDF, so the translator reads page images, not editable text. Review the preview first.
When do you need a certified or sworn translation instead?
A masked copy is never a substitute for an official translation. Courts, immigration offices and some employers require a certified or sworn translation of the full, unmasked original, often stamped by an authorized translator. Under EU rules, some public documents no longer need a translation at all if a multilingual standard form travels with them. That is according to the European Commission's e-Justice Portal, checked in September 2026. Outside that case, ask the receiving authority first.
Masking before translation is a good habit for internal checks, drafts and anything that never needs a stamp. For anything official, send the full document to a professional bound by confidentiality, and skip the online translator altogether.
Frequently asked questions
- Can I just paste the text instead of uploading the file?
- Yes, but the risk is the same. Pasted text still leaves your device and reaches the same servers as an uploaded file. Mask names and numbers in the text first, or paste one section at a time and skip anything personal.
- Is a paid translator plan automatically GDPR compliant for work documents?
- No plan is automatically compliant on its own. Article 28 of the GDPR still requires a written contract with the translator as a processor. The ICO's guide to controllers and processors says a controller remains responsible for the compliance of its processors. A subscription does not replace that check.
- What about a signature or a stamp on a scanned page?
- Cover it before you send the page. A signature identifies someone as clearly as a name does, and OCR sometimes reads it as odd characters that confuse the translation anyway. Mask it with a solid block and describe it in a note instead, such as 'signed by the account holder.'
- Does masking change the length of a document?
- Barely. A black bar or a label takes about the same space as the text it covers, so page counts and layout usually stay close to the original. A long title or address replaced by a short label can even make a page easier to read.
- What if the receiving country is outside the EU?
- Ask first whether a certified human translation is required. A transfer of personal data outside the EEA needs its own safeguard under GDPR rules, separate from the masking question. Masking still helps for anything you are allowed to send electronically, such as a draft for internal review.
Sources & references
- Privacy policy — DeepL SE
- Data usage FAQ, Cloud Translation — Google Cloud
- A guide to controllers and processors — Information Commissioner's Office (ICO)
- Public documents (EU Regulation 2016/1191) — European Commission — e-Justice Portal
Mask a document without uploading it
ONYRI Sanitize finds names, identifiers, bank details and secrets in a PDF, a Word file or a scan, and masks them in your browser. You check the preview, then download a flattened copy.