Safety vendor export redaction is the removal of personal data from a file sent to a processor, in line with UK GDPR Art. 28. That article governs controller-processor duties and supports data minimisation. anonym.plus marks each identifier on your device, so the recipient gets only what the task needs.
When this applies
An EHS platform may only need counts and codes, not worker identities. You trim the personal data before the file leaves under an Art. 28 arrangement.
How anonym.plus handles it
- Open the data set in anonym.plus on your device.
- Local OCR reads any scanned attachment.
- The tool flags names, references, conditions, and contacts.
- Keep the codes and counts the platform needs.
- Swap or black out the confirmed items.
- Save the minimised file locally.
What you need to provide
- The data export (CSV, XLSX, PDF, or scan).
- An operator (Replace keeps codes readable).
- Optional batch for a multi-file export.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | Ana Solis → [WORKER] |
| Health | MEDICAL_CONDITION | injury type → [CONDITION] |
| NI number | UK_NINO | QQ 51 22 00 D → [NINO] |
| Contact | EMAIL_ADDRESS | a.solis@example.co.uk → [EMAIL] |
| Dates | DATE_TIME | case 29/03/2026 → [DATE] |
| Org | ORGANIZATION | Tyne Site 5 → [SITE] |
Compliance achieved
- Supports a handoff to a processor that must offer sufficient guarantees under UK GDPR Art. 28(1) and be bound by the written terms in Art. 28(3), with minimisation under Art. 5(1)(c) deciding what leaves at all.
- Flags the transfer question: if the platform or a sub-processor sits outside the UK, a mechanism under Art. 46, the IDTA or the ICO addendum to the EU SCCs, is needed as well.
- Keeps the duty where it belongs: reporting under RIDDOR 2013 falls on the responsible person, and the general duties in HSWA 1974 s.2 and s.3 cannot be contracted out to a vendor.
- Shrinks the exposure you would have to notify within 72 hours under Art. 33, while the processing stays listed in your record under Art. 30. The file is offline until you send it.
Anonymise safety vendor exports offline — see plans & start free →
Limitations & cautions
Art. 28 still needs a written processor contract; redaction does not replace it. A small site plus a date can re-identify a worker. Minimise both, and keep the contract in place.
Frequently asked questions
Does redaction replace a processor contract?
No. Art. 28 requires a written agreement. Minimising the data reduces what the recipient holds, but the contract still applies.
Can I keep the codes the platform uses?
Yes. Allow-list codes and counts so analytics still work while worker identifiers are removed.
Is the export uploaded by the tool?
No. The app is fully offline. You control when the minimised file is sent.