DBS disclosure file redaction is the removal of identifiers from a criminal-record certificate. Police Act 1997 s.113A covers a standard certificate and s.113B an enhanced one, while UK GDPR Art. 10 lets an employer process the result only under DPA 2018 s.10(5) and a Sch. 1 condition. anonym.plus marks names, the NI number, and dates on your device.
When this applies
The certificate belongs to the applicant, and the DBS Code of Practice limits how far its content may travel inside an employer. Most convictions become spent under the Rehabilitation of Offenders Act 1974, and s.4(2) means they need not be disclosed unless the role sits in the 1975 Exceptions Order. A hiring manager needs a suitability decision, not the history behind it.
How anonym.plus handles it
- Open the certificate in anonym.plus on your device.
- Local OCR reads a scanned disclosure page.
- The tool flags names, NI numbers, and dates.
- Review history entries with extra care.
- Swap or black out the confirmed items.
- Save the clean file locally.
What you need to provide
- The certificate (PDF, DOCX, or scan).
- An operator (Redact suits sensitive history).
- Optional allow-list for the certificate heading.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | subject K. Owens → [SUBJECT] |
| Identifiers | UK_NINO | QQ 33 77 12 C → [NINO] |
| Dates | DATE_TIME | DOB 1983 → [DOB] |
| Location | LOCATION | prior address → [ADDRESS] |
| Identifiers | UK_DRIVER_LICENSE | OWENS753109K9 → [LICENCE] |
| Contact | PHONE_NUMBER | +44 121 496 7711 → [PHONE] |
Compliance achieved
- Covers standard and enhanced certificates issued under Police Act 1997 s.113A and s.113B.
- Supports the handling limits in the DBS Code of Practice, which restricts how far certificate content travels inside an employer.
- Respects Rehabilitation of Offenders Act 1974 s.4(2), under which a spent conviction need not be disclosed outside the 1975 Exceptions Order.
- Fits UK GDPR Art. 10, which allows criminal-offence data only with the authority DPA 2018 s.10(5) and Sch. 1 Part 3 provide.
- Offline work keeps the disclosure off any server.
Anonymise DBS disclosure files offline — see plans & start free →
Limitations & cautions
The DBS Code of Practice and UK GDPR govern retention and access, and redaction changes neither. The tool removes identifiers; it does not set your handling policy or judge whether a role falls inside the 1975 Exceptions Order.
Frequently asked questions
Does redaction meet my handling duties?
No. The DBS Code of Practice and Art. 10 govern who may see a certificate and how long you keep it. Redaction only shields identifiers in a shared copy, so follow the handling rules separately.
Which lawful basis covers a criminal-record check?
Art. 10 needs authority in domestic law, which DPA 2018 s.10(5) and a Schedule 1 condition supply. Part 3 of that Schedule carries the additional conditions for criminal-convictions data.
Can it read a scanned certificate?
Yes. Local OCR reads the image, so identifiers on a scanned disclosure are flagged.