Subject access redaction is the removal of third-party identifiers from a dossier released under UK GDPR Art. 15. The worker is entitled to their own data, while Art. 15(4) says a copy must not adversely affect the rights and freedoms of others. anonym.plus marks other people's names and IDs on your device, so the disclosure stays useful without exposing colleagues.
When this applies
Art. 12(3) gives you one month to respond, extendable by two further months for a complex request. A personnel file that names reviewers, complainants, and colleagues has to be worked through in that window. Schedule 2 Part 3 of the DPA 2018 carries the restriction that protects information about another individual, which is what most of that work turns on.
How anonym.plus handles it
- Open the requested dossier in anonym.plus on your device.
- Local OCR reads scanned review and note pages.
- The tool flags third-party names and IDs.
- Keep the requesting worker's own data intact.
- Swap or black out the confirmed items.
- Save the clean copy locally.
What you need to provide
- The requested dossier (PDF, DOCX, mixed scans).
- An operator (Replace keeps it readable).
- Optional allow-list for the requester's own name.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | colleague named → [THIRD_PARTY] |
| Names | PERSON | reviewer named → [REVIEWER] |
| Identifiers | UK_NINO | third-party NINO → [NINO] |
| Contact | EMAIL_ADDRESS | manager email → [EMAIL] |
| Contact | PHONE_NUMBER | +44 20 7946 0147 → [PHONE] |
| Dates | DATE_TIME | review date → [DATE] |
Compliance achieved
- Supports a worker's right to a copy of their own data under UK GDPR Art. 15(1) and Art. 15(3).
- Applies Art. 15(4), under which the copy must not adversely affect the rights and freedoms of others.
- Works with the restriction protecting information about another individual in DPA 2018 Sch. 2 Part 3.
- Helps you meet the one-month deadline in UK GDPR Art. 12(3), extendable by two further months for a complex request.
- Offline work keeps the dossier inside your team — nothing leaves the building.
Anonymise subject access disclosures offline — see plans & start free →
Limitations & cautions
The exemptions decide what a worker may see, and the tool does not apply them. It removes identifiers you select. Whether to disclose without a third party's consent is a judgement for you, on the DPA 2018 schedules and ICO guidance.
Frequently asked questions
Whose data should I redact before disclosure?
Usually third parties. Art. 15 entitles the worker to their own data, and Art. 15(4) limits a copy that would harm others' rights, so colleagues and reviewers are the usual candidates.
How long do I have to respond?
Art. 12(3) sets one month from receipt, extendable by two further months where the request is complex or there are several. Tell the requester about any extension within that first month.
Must I always remove a third party's name?
Not always. DPA 2018 Sch. 2 Part 3 lets you weigh whether it is reasonable to disclose without that person's consent. The tool flags the names; the balancing decision stays yours.