Census de-identification is the removal of staff PII from a workforce data set. Health and union fields are special-category data under GDPR Art. 9(1), and Art. 88 lets each member state add its own employment rules. US employers keep medical records in separate confidential files for the same reason.
When this applies
A buyer wants headcount and pay math before it prices the deal. The same file carries sick-leave notes and union flags. Cut those fields before the census leaves HR.
How anonym.plus handles it
- Point anonym.plus at the census file on your device.
- It scans ID columns and any free-text note fields.
- Special-category fields under Art. 9 get extra care.
- Swap staff for steady labels to keep joined rows.
- Save the clean data set on your device.
What you need to provide
- The census (XLSX, CSV, or export).
- A column map for known ID and sensitive fields.
- Replace with the map off for true anonymity.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | employee_name → [STAFF_n] |
| Identifiers | NATIONAL_ID | social no. → [ID] |
| Special category | NRP | union or belief note → [SENSITIVE] |
| Contact | EMAIL_ADDRESS | work email → [EMAIL] |
| Dates | DATE_TIME | hire date → [DATE] |
| Location | LOCATION | home address → [ADDRESS] |
Compliance achieved
- Strips the special-category fields listed in GDPR Art. 9(1).
- Respects the employment rules member states set under Art. 88.
- Keeps medical entries out of the shared copy, as US separate-file rules expect.
- True anonymity puts the data set beyond GDPR by Recital 26.
Anonymize employee census files offline — see plans & start free →
Limitations & cautions
Art. 9 fields like health or union status carry the highest risk. A rare role plus a small team can re-identify even after IDs go. Weigh the residual risk and keep no re-link key for true anonymity.
Frequently asked questions
Which census fields count as special category?
Health, sick leave, disability, union membership, and anything revealing race or belief. Art. 9(1) lists them. Each needs its own exception, so most deals drop them instead.
Can I still give a buyer the pay bands?
Yes. Bands, headcount, and cost totals stay. Swap the names and IDs, then widen any band that would single one person out.
Does it handle both columns and free text?
Yes. Tidy ID columns and inline note fields are both checked on your device.