Guide · How-to guide · Email
How to anonymise emails and their attachments
Anonimatum Team
In short
Anonymising an email means treating the headers, subject, body, signature, quoted messages and every attachment together, with the same treatment for the same data. Anything that cannot be anonymised is not released.
Emails are, by a distance, the documents with the most third-party data per page. A single forwarded message carries the addresses of everyone in copy, the sender's signature with their mobile number, three earlier replies quoted with their own headers and two attachments that are complete documents in their own right. When that email has to go to someone else, every one of those layers needs checking.
This guide explains where personal data sits in an .eml file or an Outlook .msg, why printing to PDF and redacting often leaves gaps, how to handle attachments and how to do it with Anonimatum. The examples are fictitious: an internal thread mentioning the National Insurance number QQ 12 34 56 C of an invented employee and, in a US subsidiary's reply, the SSN 123-45-6789.
Step by step
Export the emails
Save each message as .eml or Outlook .msg, with its attachments. Export the relevant replies and forwards too.
Set the criteria
Decide what comes out (third parties, phone numbers, addresses, identifiers) and what must stay visible, such as the requester's data.
Upload the emails
Upload the .eml or .msg files to Anonimatum; if they belong to one matter, group them in a case file with a shared map.
Configure detection
Pick a template or enable the GDPR option, addresses and patterns for email and phone, add custom identifier patterns and whitelist what must stay visible.
Review and apply
Review the proposed matches in headers, subject, body, signatures and quoted messages, correct as needed and anonymise.
Download the ZIP
Download the ZIP with the email and attachments as PDF and, if needed, the rebuilt .eml.
Check the attachments
Compare the original attachments with the ZIP, handle any withheld ones separately and log the release.
When emails need anonymising
- Subject access requests. Article 15 of the UK GDPR and the EU GDPR gives people a right to a copy of their data, but paragraph 4 makes clear that this must not adversely affect the rights and freedoms of others. When the copy includes emails, colleagues', customers' and other third parties' data has to come out; the requester's own data stays in. We cover this in handling data subject access requests.
- Litigation and disclosure. Producing a thread as evidence does not mean exposing people who are not parties: personal phone numbers, third parties' addresses or health details mentioned in passing.
- Internal investigations and whistleblowing. When building a case file or sharing it with external advisers, witnesses' and whistleblowers' identities need protecting.
- Training, audit or testing. Using real emails as examples means removing or replacing anything that could identify someone first.
Where personal data sits in an email
| Part | What it contains | Typical risk |
|---|---|---|
| Headers | From, To, Cc, Reply-To, date, message identifiers, relay servers | Third parties' addresses and full names in the From field |
| Subject | Often the name of the case or person | “Sickness absence – John Smith” gives the content away unopened |
| Body | Message text, in HTML and sometimes in plain text too | Redacting one version and forgetting the other |
| Signature | Name, job title, mobile, address, sometimes a photo | Repeated in every reply in the thread |
| Quoted messages | Earlier replies and forwards with their own headers | People no longer in copy still appear |
| Attachments | PDF, Word, Excel, images and attached emails | Each attachment is a full document with its own metadata |
One detail is easy to miss: the same data appears several times in different forms. “Laura Green” in the From field, “laura.green@example.co.uk” in the header, “Laura” in the greeting and “L. Green” in the signature. If you pseudonymise, all of those must get the same substitute or the result will not make sense.
Why printing to PDF and redacting is not enough
The usual manual method is to open the email, print it to PDF and redact. That works for a single message, but it has limits:
- Attachments are left out. Printing the email only captures the body; every attachment has to be opened, converted and handled separately, and it is easy to miss one.
- You do not see the full headers. The PDF shows From, To and Subject, but the original .eml holds more fields; if the original file is ever released, they go with it.
- Threads multiply the work. In a thread of ten replies, the same signature appears ten times.
- Black boxes on a badly produced PDF can leave the text underneath; our guide to anonymising a PDF explains how to avoid that.
How to do it in Anonimatum
Since version 1.9.0, Anonimatum accepts .eml and Outlook .msg emails with their attachments. Headers, subject, body and supported attachments are anonymised, and the same data gets the same substitute wherever it appears. The result is a ZIP with the email and attachments as PDF and, if you ask for it, the rebuilt .eml. Attachments that cannot be anonymised are never included in the output.
- Detection combines Anonimatum's own AI, run on servers in the EU without sending text to external language models, with patterns for email addresses, phone numbers or IBANs; add a custom pattern for identifiers such as NI numbers or SSNs.
- In a SAR response, whitelist the requester's name and email address so their own data stays visible.
- If the emails belong to one matter, group them in a case file with a shared map: the same colleague gets the same pseudonym in every message. More on this technique in pseudonymisation.
Checks before release
Before sending the anonymised emails
- I compared the original attachments with the ZIP and know what was withheld.
- I searched the output for third parties' names, NI numbers and phone numbers: zero hits.
- Signatures and quoted messages in the thread were treated the same as the main message.
- For a SAR, the requester's own data is still visible.
- If I am releasing the rebuilt .eml, I checked its headers.
- I logged what was released, to whom and when.
For more on balancing the right of access against third parties' rights, read our article on answering access requests without revealing third parties.
Frequently asked questions
What happens to attachments that cannot be anonymised?
They are never included in the output. Compare the attachment lists and decide whether to handle them another way or record that they were withheld.
In what format is the anonymised email delivered?
As a ZIP with the email and attachments as PDF and, on request, the rebuilt .eml.
Are headers and subject lines anonymised too?
Yes. Headers, subject, body and supported attachments are processed, and the same data gets the same substitute wherever it appears.
In a SAR, should the requester's own data be redacted?
No. The requester is entitled to their own data; what you protect is third parties' data. Add their name and address to the whitelist.
Anonymise emails with their attachments
See the plans and start anonymising .eml and Outlook .msg files with a preview, consistent substitutes and AI that runs in the EU.