Reference response redaction is the removal of personal identifiers from a written employment referral. The confidential-reference exemption in DPA 2018 Sch. 2 Part 4 para 24 restricts subject access to one given, or to be given, for employment purposes — in the hands of the giver and the receiver alike. anonym.plus marks the former worker and contacts on your device, so the assessment wording stays usable while the named individual is hidden.
When this applies
A referral of this kind is an opinion with legal consequences. Spring v Guardian Assurance plc [1995] 2 AC 296 established that the giver owes the subject a duty of care, and UK GDPR Art. 5(1)(d) requires the personal data in it to be accurate and kept up to date. Once that reply is reused as a template or an audit sample, the subject's identity adds nothing and the requester's adds less.
How anonym.plus handles it
- Open the reply in anonym.plus on your device.
- The tool flags the former worker and contacts.
- Local OCR reads a scanned letter.
- Keep the factual assessment wording intact.
- Swap or black out the confirmed items.
- Save the clean copy locally.
What you need to provide
- The referee reply (PDF, DOCX, or scan).
- An operator (Replace keeps the prose readable).
- Optional name map across linked replies.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | former worker → [SUBJECT] |
| Names | PERSON | requester → [REQUESTER] |
| Contact | EMAIL_ADDRESS | hr@example.co.uk → [EMAIL] |
| Contact | PHONE_NUMBER | +44 117 496 0044 → [PHONE] |
| Dates | DATE_TIME | tenure 2019-2024 → [DATES] |
| NRP | NRP | job title → [TITLE] |
Compliance achieved
- Works with the confidential-reference restriction in DPA 2018 Sch. 2 Part 4 para 24, which covers one given or to be given for employment purposes.
- Keeps the assessment accurate as UK GDPR Art. 5(1)(d) requires, and as the duty of care in Spring v Guardian Assurance plc [1995] 2 AC 296 expects.
- Removes the requester and any third party named, whose rights UK GDPR Art. 15(4) weighs on disclosure.
- Works towards the anonymity bar in UK GDPR Recital 26 once the reply becomes a template.
- Offline work keeps the reply inside your HR team.
Anonymise reference responses offline — see plans & start free →
Limitations & cautions
A short tenure plus a rare role can re-identify the subject even with no name. The tool flags named items. The para 24 restriction limits subject access to the reply; it does not decide whether the content was fair or accurate, so read the assessment yourself before reusing it.
Frequently asked questions
Can a referee reply be reused once redacted?
Yes, as a template, once the subject's identifiers are removed and no unique fact points back to them. A live referral must still be accurate and fair.
Does the confidential-reference exemption cover the receiver too?
DPA 2018 Sch. 2 Part 4 para 24 covers one given or to be given in confidence for employment purposes, in the hands of the giver and the recipient. It restricts subject access; it is not a reason to keep an inaccurate assessment.
Is the reply uploaded?
No. The app is fully offline, so the letter stays on your device.