Payroll journal redaction is the removal of staff personal data from a wage run. Some of it is special-category data under UK GDPR Art. 9(1). A trade-union subscription deducted under TULRCA 1992 s.68 reveals union membership, because that deduction needs the worker's own authorisation. Art. 9(2)(b) allows employment processing, resting on the condition in DPA 2018 Sch. 1 Pt. 1 para. 1. anonym.plus marks each identifier on your device, so the totals stay.
When this applies
A wage run lists each worker's NI number, bank line, and deduction codes that can reveal union or health status. ERA 1996 s.8 requires the worker's own itemised pay statement to show every deduction, so the codes are real and specific. You strip them before any analysis leaves payroll.
How anonym.plus handles it
- Open the wage run in anonym.plus on your device.
- The app marks names, NI numbers, and bank lines.
- It also marks deduction codes that reveal sensitive status.
- Keep gross, net, and PAYE subtotals intact.
- Replace or black out the confirmed identifiers.
- Save the clean run locally.
What you need to provide
- The wage run (CSV, XLSX, or PDF).
- An operator (Redact suits sensitive deduction codes).
- Optional allow-list for pay-period dates.
PII & financial identifiers detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | worker Joy Akhtar → [EMPLOYEE] |
| Identifiers | UK_NINO | QQ 33 77 12 D → [NINO] |
| Financial | UK_BANK_NUMBER | deposit acct 5521 → [ACCOUNT] |
| Sort code | UK_SORT_CODE | 30-00-00 → [SORT] |
| Money | MONEY | net £3,140 → [AMOUNT] |
| Contact | EMAIL_ADDRESS | j.akhtar@example.co.uk → [EMAIL] |
Compliance achieved
- Removes entries restricted by UK GDPR Art. 9(1), such as union or health deductions.
- Recognises that a check-off deduction under TULRCA 1992 s.68 needs the worker's authorisation, and so reveals membership.
- Employment processing rests on UK GDPR Art. 9(2)(b) with the condition in DPA 2018 Sch. 1 Pt. 1 para. 1; redaction narrows what travels beyond payroll.
- Does not touch the itemised statement ERA 1996 s.8 gives the worker, or the records PAYE Regulations 2003 reg. 97 requires. Offline work keeps wage data off any server.
Anonymise payroll journals offline — see plans & start free →
Limitations & cautions
Article 9 covers data revealing health, beliefs, or union membership. A deduction code can imply such status indirectly, so confirm the meaning of each before you share. The worker's own s.8 statement must still show every deduction in full. The app marks coded fields, not intent.
Frequently asked questions
What makes payroll data special-category?
Codes that reveal union dues, health plans, or religious observance fall under UK GDPR Art. 9(1). A check-off subscription authorised under TULRCA 1992 s.68 is the clearest case, because the deduction cannot happen without the worker's consent to it. anonym.plus marks those entries alongside names and bank lines.
Will the pay subtotals survive?
Yes. Allow-list the gross, net, and PAYE columns. Only personal and sensitive entries are marked, so the run still reconciles.
Does this change what a payslip must show?
No. ERA 1996 s.8 entitles the worker to an itemised pay statement listing every deduction, and that is a separate document. Redaction applies to the analysis copy you share, never to the statement the worker receives.