Is an anonymised document still covered by GDPR?

If anonymisation is effective and people can no longer be identified by reasonably likely means, no. If data has only been pseudonymised, for example names replaced by codes with a lookup table, it is still personal data.

Do I need a DPIA to anonymise documents?

Not always. It depends on the processing as a whole: publishing sensitive data or handling special category data at scale will often require one. Article 35 and the ICO’s DPIA guidance help you decide.

Are initials enough instead of a full name?

Usually not. Initials combined with a job title, a date or a town often identify the person. It is safer to remove the name or use a neutral pseudonym and then review the context.

Who should review the anonymisation?

Someone other than the person who did it, at least on a sample. For documents that will be published or contain sensitive data, review the whole document.

GDPR anonymisation checklist for documents

Before you start: purpose, lawful basis and risk

Anonymisation is itself a form of processing personal data. Before opening the first file, write down why you are doing it, who will receive the output and what level of re-identification risk is acceptable in that context. Sharing a report with an auditor under a confidentiality agreement is very different from publishing it on an open website.

Before you start

The purpose is written down (publication, sharing with a third party, research, training…).
You know the lawful basis for the original processing and have checked that anonymising is compatible with it.
You have considered whether the overall processing needs a data protection impact assessment under Article 35, for example where special category data is involved at scale.
You have decided whether pseudonymisation is enough (reversible, still personal data) or whether you need irreversible anonymisation.
There is an inventory of direct and indirect identifiers for this type of document.
You have applied data minimisation: anything not needed for the purpose comes out, even if it is not a name.
One person owns the task and a second reviewer is assigned.

Indirect identifiers people often miss

Unique job titles (“the head teacher of the only primary school in the village”), family relationships and nicknames.
Exact dates of birth, admission, accident or dismissal combined with a location.
Addresses, postcodes, vehicle registrations, case numbers or policy numbers.
Very specific amounts, such as an unusual settlement figure.
Handwritten signatures, stamps, QR codes and verification codes that link back to the original.
Text in headers, footers, comments, tracked changes and file properties.

During: method, allow list and consistency

The practical rule is to treat the same thing the same way. If “John Smith” (fictitious) appears on page 2 as “Mr Smith” and on page 14 as “J.S.”, all three mentions must be removed or replaced by the same pseudonym. The ICO’s anonymisation guidance stresses that the approach should be documented and repeatable, not based on whoever happens to be redacting that day.

During the process

The technique is chosen and justified: suppression (irreversible redaction), generalisation (year instead of full date) or consistent substitution.
There is an allow list of terms that must stay visible (the organisation’s name, officials acting in their public role, legislation cited).
All variants of a name are treated the same throughout the document and across documents in the same file.
Special category data (health, ethnic origin, sexual orientation, beliefs, genetic or biometric data) and criminal offence data get extra scrutiny.
Scanned documents go through OCR before searching; anything OCR cannot read (handwriting, stamps) is covered by drawing areas.
Images, charts and embedded tables are checked as well as the body text.
Redaction removes the underlying content; no black rectangles laid on top and no white text.

After: verification and accountability

Article 5(2) makes the controller responsible for compliance and able to demonstrate it. In practice that means the final version is checked with simple but systematic tests, and borderline decisions are written down with the reason. The ICO’s guidance on disclosing documents securely adds hidden rows, worksheets and filters in spreadsheets to the list.

Final verification

Search test: names, ID numbers and email addresses from your inventory are searched for in the final file and none are found.
Copy test: text under each redaction is selected and pasted into an editor; nothing comes out.
Metadata removed: author, title, revision history, comments and earlier versions (see how to remove metadata from a PDF).
The file name contains no personal data (“Appeal_Smith_J.pdf” gives away what the content hides).
A second reviewer has checked a sample or the whole document, depending on risk.
Residual re-identification risk has been assessed against what is already public.
Decisions are logged, and the original is kept under restricted access or deleted according to its retention period.

Decision log template

Print this table or copy it into your tracking sheet. The examples are fictitious; what matters is that each row says what was done, why, and who checked it.

Anonymisation decision log (fictitious example)
Date	Document or batch	Data item or category	Decision	Reason	Owner / reviewer
03/11/2026	Decision 45/2026	Appellant’s name	Remove	Private individual, no public role	A.M. / L.R.
03/11/2026	Decision 45/2026	Name of signing head of service	Keep	Acting in official capacity	A.M. / L.R.
04/11/2026	Clinical reports batch	Admission date	Generalise to month and year	Needed for study; exact date identifies	P.S. / L.R.
04/11/2026	Clinical reports batch	Diagnosis	Keep	Research purpose; rest anonymised	P.S. / DPO

Where Anonimatum fits in

Anonimatum combines its own AI, running on EU servers, with patterns for ID numbers, IBANs or phone numbers, an allow list and manual areas, and shows a preview so a person can review before the irreversible redaction is applied. It also runs OCR on scans, strips metadata, supports consistent pseudonymisation and keeps a group audit log. It does not replace human review or your decision log; it makes both faster. See it in the PDF anonymiser.

GDPR document anonymisation checklist