IPO due-diligence redaction is the removal of personal data from verification and review material. UK GDPR Recital 26 puts truly anonymous data outside the regulation altogether, which is the cleanest answer when a binder passes to banks, reporting accountants and counsel. Where data must stay, the sharing runs on the legitimate-interests basis in Art. 6(1)(f). anonym.plus marks each identifier on your machine, so the verification record stays useful while individuals stay unnamed.
When this applies
A diligence binder collects HR files, contracts and emails. Employment records carry special-category data, and every new adviser who reads them widens the exposure. You trim the identifiers before access is granted.
How anonym.plus handles it
- Open the binder in anonym.plus on your device.
- Local OCR reads scanned HR and contract pages.
- The tool flags names, IDs, and contact details.
- Turn the name map OFF for true anonymity.
- Swap or black out the confirmed identifiers.
- Save the clean material locally.
What you need to provide
- The diligence files (PDF, DOCX, scan, mixed).
- An operator (Redact suits true anonymisation).
- Optional batch for a large binder.
PII & financial identifiers detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | employee A. Okafor → [PERSON] |
| Identifiers | UK_NINO | National Insurance no. → [NINO] |
| Contact | EMAIL_ADDRESS | staff@example.co.uk → [EMAIL] |
| Money | MONEY | salary £90k → [AMOUNT] |
| Location | LOCATION | branch town → [CITY] |
| Dates | DATE_TIME | DOB 1988 → [DOB] |
Compliance achieved
- Aims at the anonymity threshold in UK GDPR Recital 26 — outside scope only when re-identification is not reasonably likely.
- Where data must stay, disclosure to advisers rests on UK GDPR Art. 6(1)(f) and a documented legitimate-interests assessment.
- HR files carry special categories: UK GDPR Art. 9(2)(b) with the employment condition in DPA 2018 Sch. 1 Part 1 para. 1 and its appropriate-policy-document duty.
- Cuts the Art. 14 problem at source — you owe no indirect-collection notice for data a bidder never receives.
- Verification evidence for the sponsor under the UK Listing Rules stays intact.
Anonymise due-diligence files offline — see plans & start free →
Limitations & cautions
Recital 26 treats data as anonymous only if no one can re-identify it by any likely means. A rare role plus a town can still single someone out. Review free-text notes, and keep the map off when true anonymity is the goal.
Frequently asked questions
When is diligence material truly anonymous under Recital 26?
When re-identification is no longer possible by any reasonably likely means. Turn the name map off and remove indirect clues, not just names.
What is the lawful basis if some data must stay?
Usually the legitimate interests of the parties under UK GDPR Art. 6(1)(f), recorded in a legitimate-interests assessment. Employment records add Art. 9(2)(b) and DPA 2018 Sch. 1 Part 1 para. 1.
Does the binder leave my machine?
No. The app is fully offline, so the review record stays in your deal room.