Nine-box grid anonymisation is the removal of identifiers from a potential-versus-performance chart so no one is named. A cell placement is a prediction about a person, and UK GDPR Article 4(4) calls that profiling. Where a system places people with no human judgement and the outcome matters, Article 22 and section 14 of the Data Protection Act 2018 add safeguards. anonym.plus marks each name on your device, so the placements stay clear while the staff stay private.
When this applies
Leaders calibrate the chart across a team, and the grid then feeds who gets development money. You anonymise the names first, so the debate is about the cell and not the face.
How anonym.plus handles it
- Open the chart in anonym.plus on your device.
- Built-in OCR reads a scanned slide.
- The app marks names placed in each cell.
- Confirm the markings and keep the axis labels.
- Swap each name for a cell code.
- Save the cleaned copy locally.
What you need to provide
- The chart (PPTX-as-TXT, PDF, XLSX-as-TXT).
- An operator (Replace keeps cells legible).
- Optional alias map, OFF for true anonymity.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | Nora Iqbal → CELL9_2 |
| Org | ORGANIZATION | Platform Team → [TEAM] |
| Contact | EMAIL_ADDRESS | n.iqbal@example.co.uk → [EMAIL] |
| Dates | DATE_TIME | rated 2025 → [DATE] |
| Location | LOCATION | Leeds site → [SITE] |
| Demographic | NRP | returner group → [GROUP] |
Compliance achieved
- Treats a potential rating as profiling under UK GDPR Art. 4(4).
- Flags the safeguards in UK GDPR Art. 22 and DPA 2018 s.14 if a placement is produced by a system alone and carries real consequences.
- Signals the DPIA trigger for systematic evaluation in UK GDPR Art. 35(3)(a).
- Aims at the anonymity test in UK GDPR Recital 26, offline, with AES-256-GCM on working copies.
Anonymise nine-box grids offline — see plans & start free →
Limitations & cautions
A near-empty cell gives it away. If only one person sits in the top tier, the placement alone identifies them. Aggregate or suppress thin cells before sharing.
Frequently asked questions
Can a single-person cell still identify someone?
Yes. A lone placement is easy to trace, so Recital 26 anonymity may need you to suppress or merge thin cells.
When does Article 22 apply to a talent grid?
When the decision is based solely on automated processing and has legal or similarly significant effects. A manager who genuinely reviews and can override the placement takes it outside Article 22, but keep evidence of that human role. Section 14 of the DPA 2018 sets out the notification and reconsideration safeguards where automated decisions are permitted.
Do we need a DPIA for this?
Assess it. Article 35(3)(a) singles out systematic and extensive evaluation of personal aspects based on automated processing where decisions follow. Talent scoring across a workforce often reaches that bar.
Is the chart uploaded?
No. The desktop app runs locally, so the slide stays on your machine.