HRIS export de-identification is the removal of staff identifiers from a data extract. UK GDPR Recital 26 puts truly anonymous data outside scope, and the ICO applies a motivated-intruder test to decide whether that bar is met. anonym.plus marks names, IDs, and contacts on your device, so the table stays analysable while the identifiers go.
When this applies
A people-analytics extract carries name, NI number, salary, site, and role. Swapping names for codes is pseudonymisation as Art. 4(5) defines it, and pseudonymised data stays personal data. Where the export supports statistical work, Art. 89(1) expects safeguards such as minimisation. Section 171 of the DPA 2018 then makes it an offence to re-identify a de-identified dataset without consent.
How anonym.plus handles it
- Open the extract in anonym.plus on your device.
- The tool scans each row for the identifier set.
- It flags names, NI numbers, emails, and salary figures.
- Apply Replace with a steady label per worker.
- Confirm no direct identifier remains in any column.
- Save the clean dataset locally.
What you need to provide
- The data extract (CSV, DOCX, or PDF table).
- An operator (Replace keeps the rows joinable).
- Optional shared map so one worker maps to one alias.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | row name → [WORKER_1] |
| Identifiers | UK_NINO | NI column → [NINO] |
| Money | MONEY | salary £58,400 → [AMOUNT] |
| Contact | EMAIL_ADDRESS | work email → [EMAIL] |
| Financial | UK_BANK_NUMBER | deposit acct → [ACCOUNT] |
| Dates | DATE_TIME | DOB column → [DOB] |
Compliance achieved
- Works towards the anonymity bar in UK GDPR Recital 26, which the ICO tests with its motivated-intruder approach.
- Names the halfway house honestly: a kept map is pseudonymisation as Art. 4(5) defines it, and stays personal data.
- Supports the safeguards Art. 89(1) expects where an extract is used for statistical or research purposes.
- Serves purpose limitation under Art. 5(1)(b) when payroll data is reused for analytics.
- Reduces exposure to the re-identification offence in DPA 2018 s.171.
Anonymise HRIS exports offline — see plans & start free →
Limitations & cautions
Recital 26 counts every means reasonably likely to be used, so quasi-identifiers such as role plus site plus salary can re-identify a person after the names go. Generalise those columns too, and turn the map off for true anonymity.
Frequently asked questions
Is removing names enough to anonymise the table?
No. Recital 26 asks whether anyone could re-identify a person by means reasonably likely to be used, and role, site, and salary together often can. Generalise or drop those columns as well.
Can I keep rows joinable for analysis?
Yes, with a shared map. But that is pseudonymisation under Art. 4(5), not anonymity, so the dataset stays personal data and stays in scope. Turn the map off when you need true anonymity.
What is the risk of re-identifying a cleaned dataset?
DPA 2018 s.171 makes it an offence to knowingly or recklessly re-identify de-identified personal data without the controller's consent, so treat a cleaned export as a one-way step.