Loan application redaction is the removal of personal data from a credit application form. UK GDPR Art. 5(1)(c) limits collection to what is adequate and relevant, and DPA 2018 s.3(2) sets the test for what still counts as personal data. The same form usually also serves the customer due diligence the Money Laundering Regulations 2017 require at onboarding. anonym.plus marks each item on your own device, so the form stays usable while the protected fields go.
When this applies
An application lists the applicant's National Insurance number, salary, account details, and the ID document collected for anti-money-laundering checks. You must clear the personal fields before a copy passes to a broker, a partner, or a training set — the original due-diligence record stays with your compliance file.
How anonym.plus handles it
- Open the form in anonym.plus on your workstation.
- Local OCR reads any scanned wage slip attached to it.
- The tool flags NI numbers, account details, and contacts.
- Confirm each flag and clear any field caught by mistake.
- Replace each item with a label, or black it out.
- Save the clean copy. The original never leaves your device.
What you need to provide
- The application (PDF, DOCX, or TXT).
- An operator: Replace (swap), Redact (black out), or Mask (partial).
- Optional: an alias map if you must re-link the applicant later.
PII & financial identifiers detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Identifiers | UK_NINO | QQ 12 34 56 C → [NINO] |
| Names | PERSON | Eleanor Whitfield → [APPLICANT] |
| Financial | UK_BANK_NUMBER | acct 4412 9087 → [ACCOUNT] |
| Money | MONEY | salary £94,200 → [AMOUNT] |
| Contact | EMAIL_ADDRESS | e.whitfield@example.co.uk → [EMAIL] |
| Location | LOCATION | 12 Pine Road, Leeds → [ADDRESS] |
Compliance achieved
- Supports data minimisation under UK GDPR Art. 5(1)(c) and the identifiability test in DPA 2018 s.3(2).
- The Money Laundering Regulations 2017 require customer due diligence at onboarding (reg. 27/28); redacting a working copy does not touch the CDD record itself, which reg. 40 keeps for five years.
- Runs offline, so applicant data never reaches a third party by accident.
- Covers 340+ PII types, well past the core identity fields, with AES-256-GCM at rest.
Anonymise loan applications offline — see plans & start free →
Limitations & cautions
The tool flags named items, but it cannot judge when a free-text note re-identifies an applicant, and it does not replace the CDD record the Money Laundering Regulations 2017 require you to keep. Read the remarks and notes sections yourself before you share a redacted copy.
Frequently asked questions
What personal data sits on a typical credit application?
Usually a name, a National Insurance number, an income figure, an address, and account details, plus the ID document collected for anti-money-laundering checks. UK GDPR treats each field as personal data, and anonym.plus flags them so you can apply the minimisation principle in Art. 5(1)(c) before you share a copy.
Does this keep applicant data private?
Yes. Work runs on your own device with no cloud step. Nothing is uploaded, so the applicant's data stays inside your firm, and the redaction itself does not touch the customer due diligence record the Money Laundering Regulations 2017 require you to retain separately.
Will the form still read correctly after the swap?
Yes. The Replace operator drops a steady label in place of each item, so the document still flows and no longer names a real person, while the fields your file needs for review stay in place.