Care-plan anonymisation removes personal data from a care and support plan until no one can reasonably re-identify the person, at which point UK GDPR Recital 26 places the copy outside the regulation. The document is statutory: Care Act 2014 s.25 governs it, and where the person lacks capacity it also records a best-interests decision made under Mental Capacity Act 2005 s.4. anonym.plus works on your device and keeps the goals and steps that make it useful for service design.
When this applies
Such documents drive service planning and staff training, but they are special-category health data under UK GDPR Art. 9(1). Make a copy genuinely anonymous and the Art. 9 condition requirement falls away for those secondary uses.
How anonym.plus handles it
- Open a copy of the document in anonym.plus on a local device.
- It finds patient, carer, and contact identifiers.
- Swap them with the reversible map turned off for true anonymity.
- Confirm no re-link key is left behind.
- Save the clean file on your device.
What you need to provide
- A copy of the file (DOCX, PDF, or EPR export).
- Replace with the map off for full anonymity.
- Optional language setting.
Patient data entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | patient & key worker → [NAME] |
| Dates | DATE_TIME | review date → [DATE] |
| Location | LOCATION | home address → [ADDRESS] |
| Contact | PHONE_NUMBER | carer phone → [PHONE] |
| NHS Number | UK_NHS | NHS 943 476 5919 → [NHS_NO] |
| Relatives | PERSON | family carer → [CARER] |
Compliance achieved
- This is a statutory document under Care Act 2014 s.25 — the goals and steps stay, the identities go.
- Where the person lacks capacity, the file records a best-interests decision under Mental Capacity Act 2005 s.4, itself health data.
- Strips the special category health data described in UK GDPR Art. 9(1).
- With no re-link key kept, UK GDPR Recital 26 puts the result outside the regulation.
- The original plan stays in place, held under DPA 2018 Schedule 1, Part 1, paragraph 2.
- On-device work supports NHS data-residency expectations.
Anonymise care plans offline — see plans & start free →
Limitations & cautions
Care plans hold a great deal of personal detail. Even with identifiers gone, an unusual combination of condition, locality, and support package can re-identify someone. Weigh the residual risk and keep no re-link key before you treat the result as anonymous. Never anonymise the statutory plan itself — Care Act 2014 s.25 requires the local authority to keep it.
Frequently asked questions
When is a care plan truly anonymous under UK GDPR?
When no one could reasonably re-identify the person from it. That means no retained key, and low residual risk from everything left in the text. Only then does UK GDPR Recital 26 take the copy out of scope, and the judgement is yours to make and to document.
Can I anonymise the statutory plan itself?
No. The plan prepared under Care Act 2014 s.25 is a statutory record the local authority must keep and share with the person it concerns. Anonymise an exported copy for service design or training and leave the original intact.
Can I still use the goals and steps?
Yes. Goals, outcomes, and the step-by-step support text all stay, because none of them identify anyone on their own. Only the personal identifiers around them change, which is what makes the copy useful for pathway design.