Drug and alcohol test result redaction is the removal of donor data from a testing record, which is special category health data under UK GDPR Art. 9 and the DPA 2018. Lawful workplace testing needs a clear basis and tight controls. anonym.plus marks each identifier on your device, so the outcome stays clear while the tested person is shielded.
When this applies
A laboratory report names the donor, the specimen reference, and the result. You trim the identifiers Art. 9 guards before a copy moves to an allowed recipient.
How anonym.plus handles it
- Open the result in anonym.plus on your device.
- Local OCR reads a scanned lab page.
- The tool flags the donor, the NI number, and contacts.
- Keep the specimen reference and the outcome line.
- Swap or black out the confirmed items.
- Save the clean copy locally.
What you need to provide
- The testing record (PDF, DOCX, or scan).
- An operator (Replace keeps the outcome readable).
- Optional allow-list for the specimen reference.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | Carl Innes → [DONOR] |
| NI number | UK_NINO | QQ 74 12 99 A → [NINO] |
| Health | MEDICAL_CONDITION | prescribed medicine → [CONDITION] |
| Dates | DATE_TIME | DOB 1987 → [DOB] |
| Contact | PHONE_NUMBER | +44 7700 900119 → [PHONE] |
| NHS Number | UK_NHS | 208 551 1907 → [NHS_NO] |
Compliance achieved
- Treats the result as data concerning health, defined in UK GDPR Art. 4(15) and barred from processing by Art. 9(1) unless a condition applies; at work that is usually Art. 9(2)(b) with DPA 2018 Sch. 1 Pt. 1 para. 1, rather than consent, which is rarely freely given where there is an imbalance of power (Art. 7(4)).
- Ties the testing to a real safety rationale: the general duties in HSWA 1974 s.2(1) and s.3(1), the employee's own duty in s.7, the occupier duty in Misuse of Drugs Act 1971 s.8, and, for safety-critical transport roles, the drink and drugs offences in Transport and Works Act 1992 Part II.
- Supports the impact assessment UK GDPR Art. 35(3)(b) expects for large-scale health data, and the ICO's guidance on monitoring workers; testing also engages private life under Art. 8 ECHR through the Human Rights Act 1998.
- Keeps the chain-of-custody reference so the result stays auditable, and runs offline so donor data never reaches a server.
Anonymise drug and alcohol test results offline — see plans & start free →
Limitations & cautions
Art. 9 and the DPA 2018 set who may hold a result and on what basis. The tool removes identifiers; it does not decide lawful processing. Confirm your basis and recipients with the DPO or counsel.
Frequently asked questions
On what basis can an employer hold a test result?
Art. 9(1) bars it unless a condition applies. At work that is usually Art. 9(2)(b) with DPA 2018 Sch. 1 Pt. 1 para. 1 and an appropriate policy document, resting on a written testing policy and the safety duties in HSWA 1974 s.2 and s.3. Consent is a weak footing because Art. 7(4) treats it as rarely freely given at work. The tool flags identifiers; the lawful basis is yours to set.
Can I keep the specimen reference?
Yes. Allow-list it so the chain-of-custody reference stays while donor identifiers are removed.
Is the result uploaded?
No. The app runs locally with no cloud step, so donor data stays on your machine.