Talent vendor data redaction is the removal of identifiers from people records before they reach a processor. GDPR Article 28 governs what a controller may hand to a supplier. anonym.plus marks each name on your device, so you share only what the contract needs and nothing more.
When this applies
An HR team sends a file to an assessment partner. You strip the identifiers first, so the transfer honours the Article 28 duty to limit what a processor receives.
How anonym.plus handles it
- Open the file in anonym.plus on your device.
- Local OCR reads any scanned source page.
- The tool flags names, emails, and IDs.
- Confirm the flags and keep the fields the partner needs.
- Replace each identifier with a code.
- Save the minimised set locally, then transfer it.
What you need to provide
- The source file (CSV-as-TXT, XLSX-as-TXT, PDF).
- An operator (Replace keeps needed fields readable).
- Optional name map, held by the controller only.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | Lena Roth → SUBJ_44 |
| Contact | EMAIL_ADDRESS | l.roth@firm.com → [EMAIL] |
| Contact | PHONE_NUMBER | (089) 555 2231 → [PHONE] |
| Org | ORGANIZATION | Finance Unit → [UNIT] |
| Dates | DATE_TIME | DOB 1990 → [AGE-BAND] |
| Location | LOCATION | Cologne office → [SITE] |
Compliance achieved
- Supports the controller's duty under GDPR Article 28.
- Sends a processor only the fields the task needs.
- Offline work keeps the source set on your machine.
- AES-256-GCM guards working copies.
Anonymize talent vendor data sets offline — see plans & start free →
Limitations & cautions
Article 28 still applies if a vendor can re-identify the people. A held name map or rich quasi-identifiers may keep the set personal in the vendor's hands. Share the map only under contract, or leave it off.
Frequently asked questions
Does Article 28 require full anonymisation?
Not always, but it requires a contract and minimisation. If the vendor can still re-identify people, the set stays personal and the Article 28 duties apply.
Should I share the name map with the partner?
Only if the contract requires it. For a fully minimised transfer, leave the map with the controller.
Is the source set uploaded?
No. The app is fully offline. You control when the minimised copy goes out.