Subject access redaction is the removal of third-party identifiers from a dossier released under UK GDPR Art. 15 and the DPA 2018. The article gives a worker the right to a copy of their own data. anonym.plus marks others' names and IDs on your device, so the file stays useful while third-party data goes.
When this applies
A worker's dossier often names colleagues, reviewers, and other third parties. You must shield those before you disclose it on a subject access request.
How anonym.plus handles it
- Open the requested dossier in anonym.plus on your device.
- Local OCR reads scanned review and note pages.
- The tool flags third-party names and IDs.
- Keep the requesting worker's own data intact.
- Swap or black out the confirmed items.
- Save the clean copy locally.
What you need to provide
- The requested dossier (PDF, DOCX, mixed scans).
- An operator (Replace keeps it readable).
- Optional allow-list for the requester's own name.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | colleague named → [THIRD_PARTY] |
| Names | PERSON | reviewer named → [REVIEWER] |
| Identifiers | UK_NINO | third-party NINO → [NINO] |
| Contact | EMAIL_ADDRESS | manager email → [EMAIL] |
| Contact | PHONE_NUMBER | +44 20 7946 0147 → [PHONE] |
| Dates | DATE_TIME | review date → [DATE] |
Compliance achieved
- Supports a worker's access right under UK GDPR Art. 15 & DPA 2018.
- Shields third parties named in the dossier before disclosure.
- Offline work keeps it inside your team — nothing leaves the building.
Anonymise subject access disclosures offline — see plans & start free →
Limitations & cautions
Art. 15 and the DPA 2018 exemptions govern what a worker may see and what stays shielded. The tool removes identifiers; it does not decide what the exemptions require. Check the DPA 2018 schedules and counsel.
Frequently asked questions
Whose data should I redact before disclosure?
Usually third parties, since Art. 15 gives the worker access to their own data. anonym.plus flags colleagues and reviewers for review.
Can I keep the requester's own data?
Yes. Allow-list the requester's name so their data stays while others' identifiers are removed.
Is the dossier uploaded?
No. The app is fully offline, so it stays on your machine.