Practical guides
Guides, checklists and comparisons for document anonymization
Step-by-step instructions for each format, checklists for before you publish or share a document, and comparisons to help you choose a method. All with fictitious examples and references to UK and EU rules.
Guide
How to anonymise emails and their attachments
Anonymising an email means treating the headers, subject, body, signature, quoted messages and every attachment together, with the same treatment for the same data. Anything that cannot be anonymised is not released.
ReadHow to anonymise images: document photos, screenshots and metadata
Anonymising an image means permanently covering the text, faces, signatures and number plates that identify someone, and removing EXIF metadata, including GPS location. Pixelating or scribbling on your phone is not always enough.
ReadHow to anonymise a spreadsheet so the data cannot be pieced back together
Anonymising a spreadsheet means deciding what to do with each column (keep, redact, replace or pseudonymise), clearing hidden sheets and columns, formulas and pivot tables, and checking that no combination of columns identifies anyone.
ReadHow to anonymise a PDF without leaving data under the black box
Anonymising a PDF means permanently removing personal data from what you see, from the text layer and from the metadata. Drawing a black box or highlighting in black is not enough: the text stays in the file and can be copied.
ReadHow to anonymise a scanned PDF: OCR, zones and review
A scanned PDF is an image: without OCR there is no text in which to find names or ID numbers. Recognise the text first, detect the data, cover signatures and stamps with zones, then check both the image and the text layer.
ReadHow to anonymise a Word document without leaving data behind
Anonymising a Word file means removing personal data from the visible text and from what you cannot see: tracked changes, comments, headers, properties, hidden text and embedded objects. To keep it editable, replace the data rather than cover it.
Read
Checklist
GDPR document anonymisation checklist
A three-stage checklist (before, during, after) for anonymising documents properly, recording each decision and being able to show the ICO or any EU regulator how you did it, as the accountability principle in Article 5(2) requires.
ReadChecklist: before you publish documents online
Before you upload a decision, report or FOI response to a website or open data portal, check which personal data must go, what can stay under FOIA and UK GDPR, and what is hiding in signatures, codes, metadata and file names.
Read
Comparison
Manual or automated anonymisation: which to use and when
Manual anonymisation works for a handful of simple documents; automated tools bring speed and consistency at volume. Neither removes the need for human review, so the most effective approach is usually hybrid: the tool proposes, a person decides.
ReadFree online PDF tools or professional tools: what changes with confidential documents
For a flyer, a free PDF tool is fine. For a contract, a payslip or a case file, what matters is where the file is processed, how long it is kept, what the terms say and whether redaction actually removes the text.
ReadIn-house or EU-hosted AI vs external generative AI: what changes when documents contain personal data
With in-house or EU-hosted AI, the document stays inside the agreed perimeter. With an external chatbot or API you have to deal with international transfers, a processor contract, professional confidentiality and whatever the provider does with your input.
Read