Audit export redaction is the removal of personal identifiers from a compliance evidence file. UK GDPR Art. 5(2) makes you responsible for demonstrating compliance, Art. 30(1) sets out the record of processing you keep for each purpose, and Art. 32(1)(d) treats regular testing and evaluation of your measures as part of security itself. anonym.plus marks names, IDs, and contacts on your device, so the review trail stays usable while the named individuals are hidden.
When this applies
Accountability is the one duty you satisfy by handing evidence to someone else. That may be a processor audit you exercise under Art. 28(3)(h), an external assurance review, or the ICO, which can serve an information notice under DPA 2018 s.142 or an assessment notice under s.146. In each case the reviewer needs the control, the timestamp, and the outcome — not the name of the administrator who clicked.
How anonym.plus handles it
- Open the export in anonym.plus on your device.
- The tool flags named staff, IDs, and contacts.
- Local OCR reads a scanned evidence page.
- Keep the control IDs and action timestamps.
- Swap or black out the confirmed items.
- Save the clean file locally.
What you need to provide
- The evidence export (CSV, PDF, DOCX, scan).
- An operator (Replace keeps the trail readable).
- Optional allow-list for control IDs.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | named staff → [WORKER] |
| Identifiers | NATIONAL_ID | staff no. 33120 → [STAFF_ID] |
| Contact | EMAIL_ADDRESS | work email → [EMAIL] |
| Dates | DATE_TIME | action 02/05 14:11 → [TIMESTAMP] |
| Organisation | ORGANIZATION | system name → [SYSTEM] |
| Location | LOCATION | office site → [SITE] |
Compliance achieved
- Serves the accountability duty in UK GDPR Art. 5(2) and the measures Art. 24(1) requires a controller to be able to demonstrate.
- Keeps the record of processing Art. 30(1) expects for each purpose in scope.
- Fits Art. 32(1)(d), the regular testing, assessing, and evaluating of security measures that an audit is.
- Supports the audit right a controller has over a processor under Art. 28(3)(h).
- Prepares evidence for an ICO information notice under DPA 2018 s.142 or an assessment notice under s.146 without exporting named staff.
Anonymise compliance audit exports offline — see plans & start free →
Limitations & cautions
A precise timestamp plus a system can still re-identify one actor with the name gone. The tool flags named items. A regulator's notice may require the record as held — redact the copy you volunteer, not evidence you are compelled to produce.
Frequently asked questions
Can I share an audit sample externally once redacted?
Yes, once names and IDs are removed and no kept field points back to a person. The control IDs and timestamps are what the reviewer needs.
Will the control IDs survive?
Yes. Allow-list the control IDs and timestamps so the trail stays while identifiers go.
What if the ICO asks for the file?
An information notice under DPA 2018 s.142 or an assessment notice under s.146 may require the record as held. Produce that; keep the redacted copy for voluntary sharing.