EU GDPR · UK GDPR · ICO and EDPB guidance
Anonymizing documents for GDPR and UK GDPR compliance
The GDPR does not require anonymization as such, but it makes it almost unavoidable: the data minimization principle in Article 5(1)(c) means every document you share, publish or hand over should contain only the personal data its purpose needs. And Recital 26 places truly anonymous information outside the Regulation, which makes anonymization the safest way to reuse documents.
In Spain, plans are arranged with our sales team.
Since Brexit, organizations in the UK work under the UK GDPR and the Data Protection Act 2018, which keep the same principles; many also fall under the EU GDPR when they serve people in the EU. On both sides the message from regulators is consistent: the ICO's anonymisation guidance asks you to assess identifiability, for example with the «motivated intruder» test, and the EDPB reminds organizations that pseudonymized data is still personal data. Removing names is rarely enough on its own.
Anonimatum is the technical tool to carry out those decisions: it detects personal data with its own AI in the EU, lets you review it before redacting and genuinely removes the text. Save the configuration as a template and every document gets the same treatment. The legal basis and the decision on what to disclose remain yours as the controller.
An anonymization procedure you can justify
- 1
Define the purpose
Decide why the document is going out (publication, an FOI disclosure, sharing with a third party or a reply to a data subject) and which data that purpose really needs.
- 2
Set up detection
Start from a template or use the AI option «GDPR anonymization», add your own patterns for formats such as customer, case or staff reference numbers, and whitelist what must stay visible.
- 3
Assess re-identification
In the preview, look beyond names and ID numbers: job titles, dates or specific details can also reveal who is being discussed.
- 4
Apply and repeat
Download the redacted document and save the configuration as a template so the next ones are handled the same way.
Fictitious document
Before and after: a copy provided for a subject access request
Fictitious complaint file. The complainant asks for a copy of her data (Article 15 UK GDPR): her details stay, third parties' details are hidden.
Complaint reference CR-2026-0412
Complainant: Anna Bell, customer no. 0000-1234
Facts: on 12 May the complainant reported a billing error
to Daniel Shaw, customer service adviser.
Witness to the call: Patricia Lane, tel. 07700 900000
Internal report signed by George Nash, quality manager
Outcome: complaint upheld and the May charge refunded.
Complaint reference CR-2026-0412
Complainant: Anna Bell, customer no. 0000-1234
Facts: on 12 May the complainant reported a billing error
to (redacted), customer service adviser.
Witness to the call: (redacted), tel. (redacted)
Internal report signed by (redacted), quality manager
Outcome: complaint upheld and the May charge refunded.
The complainant's details stay visible because the copy is for her; staff and the witness are hidden so as not to affect the rights of others, as Article 15(4) of the UK GDPR and the EU GDPR require.
Where anonymization fits into everyday GDPR work
Minimization when sharing
Whenever a document goes to a supplier, an expert or another department, leave only the data that purpose needs.
Publication and FOI disclosures
Reports, contracts and minutes released under transparency duties or an FOI request, with amounts, dates and public roles visible and private individuals hidden.
Data subject requests
When providing a copy of a file in response to an access request, hide third parties who appear alongside the requester.
Internal reuse
Contract templates, training material or statistics built from real documents, without carrying over personal data that is no longer needed.
Anonymization and the GDPR: frequently asked questions
Is anonymized data still subject to the GDPR?
Not if the anonymization is effective: Recital 26 of both the EU GDPR and the UK GDPR excludes anonymous information. Pseudonymized data, on the other hand, is still personal data because it can be attributed to a person using additional information.
What do the ICO and the EDPB say about anonymization?
The ICO's anonymisation and pseudonymisation guidance asks you to assess identifiability in context, including the «motivated intruder» test, and to review it over time. The EDPB stresses in its pseudonymisation guidelines that pseudonymized data remains personal data. Both point the same way: deleting names alone is not enough.
Does Anonimatum guarantee compliance on its own?
No. It is a technical tool aligned with data minimization that processes documents in the EU and lets you review before applying. What is published or disclosed, and on what legal basis, is the controller's decision.
What is Politeia Soft's role?
Politeia Soft acts as processor when it handles your documents in the European Union, with no external language model APIs. It also holds Spain's ENS security certification (a Spanish public-sector scheme) at MEDIUM level, with Anonimatum within its scope.
How can a UK or EU organization get started?
Individual professionals can subscribe to Anonimatum Pro online. For teams, batch volumes, shared templates or API access, tell us your volume and document types and we will send you a proposal, or ask for a demo with fictitious documents.
Anonymize with GDPR criteria and full control
Ask for a demo or a proposal for your organization and we will show you the workflow with documents like the ones you handle every day.
Try it in the appNot in Spain?