A fraud analytics dataset feeds the models a team builds to spot scams. UK GDPR Recital 26 puts data outside the regulation only when nobody can be singled out again. Keep a key that re-links rows and the result is pseudonymous under Art. 4(5), so it stays in scope. anonym.plus removes names, accounts, and contacts across the set on your device.
When this applies
The ICO's motivated-intruder test is the practical way to check a rare combination. DPA 2018 s.171 makes re-identifying a de-identified dataset a criminal offence. Large-scale model work often needs an impact assessment under UK GDPR Art. 35. A vendor or a training run needs the signal, not the people.
How anonym.plus handles it
- Point anonym.plus at the dataset on your machine.
- It scans each row for names, accounts, and contacts.
- Local OCR reads any scanned source pages.
- Turn the name map OFF for true anonymity.
- Replace each identifier with a steady label.
- Save the clean dataset locally.
What you need to provide
- The dataset export (CSV-to-PDF, DOCX, or mixed).
- An operator (Replace, with the name map off).
- Batch mode for up to 20 files at once.
PII & financial identifiers detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | row name → [PERSON_1] |
| Financial | UK_BANK_NUMBER | accounts → [ACCOUNT] |
| Identifiers | UK_NINO | NINOs → [NINO] |
| Contact | EMAIL_ADDRESS | emails → [EMAIL] |
| Money | MONEY | txn amounts → [AMOUNT] |
| Dates | DATE_TIME | timestamps → [DATE] |
Compliance achieved
- Anonymity is judged on UK GDPR Recital 26 and the wording of DPA 2018 s.3(2).
- Keep the map and the output is pseudonymous under UK GDPR Art. 4(5), so it stays in scope.
- DPA 2018 s.171 makes re-identifying a de-identified dataset a criminal offence.
- Large-scale model work often needs an impact assessment under UK GDPR Art. 35.
- The ICO's motivated-intruder test checks whether a rare combination still singles someone out.
Anonymise fraud analytics datasets offline — see plans & start free →
Limitations & cautions
Recital 26 says the data stays personal while anyone can re-identify it. Masking direct fields is not enough when rare combinations single someone out. Keep the name map off and test for re-identification before you share.
Frequently asked questions
When is the dataset truly anonymous under UK GDPR?
Recital 26 says only when nobody can be singled out. Remove direct fields, turn off the map, and test rare combinations with the ICO's motivated-intruder test.
Can a model still learn from a cleaned set?
Yes. Steady labels preserve patterns and amounts, so the signal survives while identities do not.
How is this different from pseudonymisation?
UK GDPR Art. 4(5) calls data pseudonymous when a separate key can still re-link it, and that data stays in scope. Anonymous output has no such key.