Anonymising an assessment is the removal of identifiers that name the subject. Mental health records are special-category under UK GDPR Art. 9. anonym.plus runs on your own device, so the scores stay while the person is hidden. Practitioner psychologists in the UK are regulated by the HCPC, whose Standards of Conduct, Performance and Ethics set a professional confidentiality duty that runs alongside UK GDPR Art. 9.
When this applies
A clinical psychologist's service wants to pool test scores for a norm study across sites. Each report names the subject, a parent, and a school, which must come out first.
How anonym.plus handles it
- Open the report in anonym.plus on your device.
- Local OCR reads scanned answer sheets too.
- It flags subject and parent names, dates, and the school.
- Review each flag and keep the score tables.
- Replace each value with a label, or redact it.
- Save the result. The first copy stays on your machine.
What you need to provide
- The report (PDF, DOCX, TXT, or scan).
- An operator: Replace, Redact, or Mask.
- Optional: a key map for re-linking.
Patient data entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Subject | PERSON | Anya Kowalski → [SUBJECT_1] |
| Parent | PERSON | mother Petra → [FAMILY_1] |
| School | ORGANIZATION | Greenfield Academy → [SCHOOL] |
| Test date | DATE_TIME | Tested 12/05/2026 → [DATE] |
| Record ID | ID | Case 8842 → [CASE_ID] |
| NHS number | NHS_NUMBER | NHS 223 445 6671 → [NHS_NO] |
Compliance achieved
- Removes special-category identifiers under UK GDPR Art. 9.
- Meets the confidentiality standard in the HCPC Standards of Conduct, Performance and Ethics, the statutory rulebook practitioner psychologists work under.
- Once anonymised, the file falls outside UK GDPR under Recital 26.
- Runs offline, so no cross-border transfer occurs.
- Working files are sealed with AES-256-GCM.
Anonymise psychological assessments offline — see plans & start free →
Limitations & cautions
The law sets a high bar for true anonymisation. The tool removes named identifiers. You still confirm that a rare score pattern cannot single out one subject when combined with other records.
Frequently asked questions
When does a file leave UK GDPR scope?
When it can no longer be linked to a person by any means likely to be used. Recital 26 sets that test, and the ICO Anonymisation Code adds the motivated-intruder test on top of it. Removing names, dates, and the school is the key step toward meeting both.
Are parents and schools removed?
Yes. A named parent or school is an identifier in its own right, not just the subject's own name. The tool flags each so the subject cannot be traced through family or institution when scores are pooled across sites.
Does HCPC registration add anything beyond UK GDPR?
Yes. HCPC's Standards ask a psychologist to protect client information as a condition of staying registered, independent of what the law separately requires. A breach can trigger a fitness-to-practise referral even where no UK GDPR enforcement follows, so de-identifying pooled data protects registration status too.