Payroll batch redaction is the removal of personal identifiers from many wage files in one local run. UK GDPR Art. 5(1)(e) says personal data should stay in identifiable form no longer than the purpose needs. That is what a folder of old period files quietly breaks. anonym.plus processes up to 20 files at a time on your device, with a shared map so one worker keeps one alias.
When this applies
Retention periods in payroll do not all match. PAYE records are expected on file for three years after the end of the tax year. National Minimum Wage Act 1998 s.9 documentation runs six years from 1 April 2021. Working time records under reg. 9 run two. A period folder that nobody prunes ends up holding the longest of those clocks for everything in it.
How anonym.plus handles it
- Point anonym.plus at the period folder on your machine.
- It scans each file for names, NI numbers, and amounts.
- Local OCR reads any scanned pages in the set.
- A shared map keeps repeat workers steady.
- Review the summary and fix low-confidence flags.
- Save the clean set locally.
What you need to provide
- A folder of files (PDF, XLSX, mixed).
- The shared map turned on for steady results.
- An operator (Replace works well for a period set).
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | worker across files → [STAFF_1] |
| Identifiers | UK_NINO | NI numbers → [NINO] |
| Financial | MONEY | amounts → [AMOUNT] |
| Financial | UK_BANK_NUMBER | accounts → [ACCOUNT] |
| Dates | DATE_TIME | pay dates → [DATE] |
| Contact | EMAIL_ADDRESS | emails → [EMAIL] |
Compliance achieved
- Serves storage limitation under UK GDPR Art. 5(1)(e) by de-identifying files whose purpose has passed.
- Evidences accountability under UK GDPR Art. 5(2) and the record of processing in Art. 30(1).
- Applies a technical measure of the kind UK GDPR Art. 32(1)(a) names across a whole folder at once.
- Keeps the re-identification offence in DPA 2018 s.171 in view — turn the shared map off where a set must stay anonymous.
- Respects the competing clocks: three years for PAYE records, six years under NMWA 1998 s.9, and two years under WTR 1998 reg. 9.
Anonymise payroll batch sets offline — see plans & start free →
Limitations & cautions
A batch run does not decide retention. It de-identifies what you point it at, so work out which clock applies before you clean a folder. A mixed set of scans and native files leans on OCR, so review low-confidence flags.
Frequently asked questions
Which retention clock applies to a payroll folder?
More than one. PAYE records are expected for three years after the end of the tax year, minimum wage pay documentation for six years from 1 April 2021, and working time records for two years under reg. 9.
How does a batch run keep one worker consistent?
A shared map logs each person once, so the same worker carries the same alias in every file. Turn it off when the folder must be genuinely anonymous.
How many files does one run handle?
Up to 20 per batch, processed locally with OCR for scans. Nothing is uploaded at any point in the run.