Checklist · Publication checklist
Checklist: before you publish documents online
Anonimatum Team
In short
Before you upload a decision, report or FOI response to a website or open data portal, check which personal data must go, what can stay under FOIA and UK GDPR, and what is hiding in signatures, codes, metadata and file names.
Publishing is the most irreversible way to disclose data: once a PDF is on a public website it can be indexed, downloaded and reused within hours. That is why the check before publication needs to be stricter than when you send a document to a single recipient.
This checklist works for decisions, minutes, contracts, reports, judgments, FOI disclosure logs and open datasets. It separates what you should always remove, what can usually stay (such as the name of a senior official acting in their public role) and the technical details that often give away what the text was meant to hide.
The legal framework in the UK
The Freedom of Information Act 2000 gives a general right of access to information held by public authorities and requires them to have a publication scheme. Personal data is handled through section 40: information about third parties is exempt where disclosure would breach the data protection principles in UK GDPR and the Data Protection Act 2018. In practice, that means asking whether publication is necessary for a legitimate interest and whether it is fair to the people named.
Anything released under FOIA is effectively released to the world, not just to the requester. Apply data minimisation before you publish: if a detail is not needed for transparency, take it out. The ICO’s guidance on disclosing documents securely, published after high-profile accidental releases, focuses on exactly the hidden data covered below.
What to remove before publishing
Data that must go
- Names, ID numbers, home addresses, phone numbers and emails of private individuals (requesters, complainants, witnesses, children).
- Health, disability, ethnic origin, religion, sex life, trade union membership and any reference to criminal allegations or offences.
- Signs of vulnerability: benefits, domestic abuse, care needs, income.
- Bank details, vehicle registrations, property references and case numbers that could locate a person.
- Personal contact details of staff (mobile numbers, home addresses).
- Indirect identifiers that together point to someone: a unique job title, an exact date, a street, an age.
- Photos of people and scanned identity documents in appendices.
What can usually stay (with care)
Not every name is a secret. Transparency means knowing who decides, signs or spends money on behalf of a public body. The ICO’s approach looks at seniority, whether the role is public-facing and what the person would reasonably expect. Record each judgement call.
- Names and job titles of senior officials and decision-makers acting in their official capacity.
- Details of companies and other legal persons, which are not personal data; take care with sole traders.
- Names of junior staff only where they have a public-facing role and no specific risk exists.
- Amounts of grants, contracts or senior salaries where publication is required or expected.
Dates, signatures and codes
Things that slip through
- Dates of birth and very specific dates linked to private individuals: remove or generalise.
- Scanned handwritten signatures: they add nothing to transparency and help forgers; replace with “signed”.
- Document verification codes or links that let anyone retrieve the original, often unredacted, version.
- QR codes and digital signature panels whose certificate shows the signer’s name and details.
- Reference and case numbers that, combined with other details, identify the person concerned.
The file itself: metadata, layers and name
Technical file check
- Redaction is real: copying the text under a black box returns nothing (any tool to redact a PDF online must remove content, not cover it).
- Metadata cleaned: author, organisation, title, revision history and comments; see how to remove metadata from a PDF.
- No layers, annotations, fillable form fields or embedded attachments containing data.
- Spreadsheets have no hidden rows, columns, worksheets or pivot caches; publish as CSV or PDF where possible.
- Neutral file name: “Decision_45-2026.pdf”, not “Decision_Smith_John.pdf”.
- Scanned documents are OCR’d before review so that searches actually find the data.
Final check and record
Before you press publish, a second person reviews the final file and logs any borderline decisions (for example, why a head of service’s name was kept). Our GDPR anonymisation checklist includes a decision log template for this.
Anonimatum detects names, ID numbers, addresses, IBANs, QR codes and digital stamps or signatures, lets you allow-list officials who should stay visible, runs OCR on scans and strips metadata, always with a preview and human review before the irreversible redaction.
Frequently asked questions
Should we redact the names of staff?
Not automatically. Senior officials and people in public-facing roles can usually be named in connection with their work. Junior staff are often redacted, and anyone can be redacted where disclosure would put them at risk.
Is a FOI disclosure the same as publication?
Effectively, yes. Information released under FOIA is treated as disclosure to the world, so apply the same checks as for publishing on your website.
Why are verification codes risky?
Because anyone with the code or link may be able to retrieve the original signed document, which is usually not redacted. Remove them from the published version or control what they point to.
Does this checklist work for court judgments?
As a baseline, yes, although courts and tribunals have their own anonymisation rules and practices. The principles of removal, consistency and final verification are the same.
Publishing documents every week?
See the plans and start preparing decisions, minutes and appendices for publication with detection, allow lists and review before release.