Data-room anonymization is the removal of personal data from files opened to bidders. Once the output is truly anonymous (GDPR Recital 26), it falls outside GDPR. A second risk runs alongside it: some bidders are rivals, and competition law limits what a rival may see before closing. anonym.plus does both jobs on your own device.
When this applies
A rival joins the bidder list for your sale. Competition law bars sharing current prices, named customers, and pay data with a competitor before closing. Clean each file before that bidder gets access.
How anonym.plus handles it
- Open the file (PDF, DOCX, or scan) in anonym.plus on your device.
- Local OCR reads scanned exhibits, so printed text is caught too.
- The tool flags names, emails, IDs, and account numbers.
- Check each flag and keep the deal terms that bidders need.
- Swap each value for a steady label, or black it out.
- Save the clean copy. The source never leaves your machine.
What you need to provide
- The file (PDF, DOCX, TXT, or image scan).
- An operator: Replace (swap), Redact (remove), or Mask (partial).
- Optional: turn the reversible map off for true anonymity.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | Maria Schneider → [PERSON_1] |
| Contact | EMAIL_ADDRESS | m.s@target.com → [EMAIL] |
| Identifiers | US_SSN / NATIONAL_ID | 078-05-1120 → [ID] |
| Finance | IBAN_CODE | DE89 3704 0044 → [ACCOUNT] |
| Location | LOCATION | 12 Hauptstrasse → [ADDRESS] |
| Dates | DATE_TIME | born 03/11/1980 → [DATE] |
Compliance achieved
- True anonymity puts the output beyond GDPR by GDPR Recital 26.
- Supports clean-team practice where a bidder is also a rival (Art. 101 TFEU limits what competitors may exchange).
- Meets the three tests in WP29 Opinion 05/2014: singling out, linkability, inference.
- Local work keeps deal data inside the firm — no cloud, zero-knowledge.
Anonymize data-room files offline — see plans & start free →
Limitations & cautions
True anonymity is a high bar. A rare mix of facts — a niche role plus a small site — can still re-identify after IDs go. Review the residual risk, and keep no re-link map before you treat the result as anonymous.
Frequently asked questions
Why does a rival bidder change the redaction plan?
Competition law limits what rivals exchange before a deal closes. Current pricing, named customers, and pay data are the sensitive fields. A clean-team copy shares the terms and hides those details.
When does a data-room file fall outside GDPR?
When no one can reasonably re-identify the person. WP29 Opinion 05/2014 tests singling out, linkability, and inference. Pass all three, keep no key, and Recital 26 takes the file out of scope.
Can it read scanned exhibits?
Yes. Local OCR pulls text from scanned pages, so IDs in image files are caught.