Talent vendor data redaction is the removal of identifiers from people records before they reach a processor. UK GDPR Article 28 governs what a controller may hand to a supplier and requires a written contract. anonym.plus marks each name on your device, so you share only what the task needs and nothing more.
When this applies
An HR team sends a file to an assessment partner. You strip the identifiers first, so the transfer honours the Article 28 duty to limit what a processor receives.
How anonym.plus handles it
- Open the file in anonym.plus on your device.
- Built-in OCR reads any scanned source page.
- The app marks names, emails, and IDs.
- Confirm the markings and keep the fields the partner needs.
- Swap each identifier for a code.
- Save the minimised set locally, then transfer it.
What you need to provide
- The source file (CSV-as-TXT, XLSX-as-TXT, PDF).
- An operator (Replace keeps needed fields readable).
- Optional alias map, held by the controller only.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | Lena Rowe → SUBJ_44 |
| Contact | EMAIL_ADDRESS | l.rowe@example.co.uk → [EMAIL] |
| Contact | PHONE_NUMBER | +44 161 496 0720 → [PHONE] |
| Org | ORGANIZATION | Finance Unit → [UNIT] |
| Identifiers | UK_NINO | QQ 12 34 56 C → [NINO] |
| Location | LOCATION | Coventry office → [SITE] |
Compliance achieved
- Supports the controller's duty under UK GDPR Article 28.
- Sends a processor only the fields the task needs.
- Offline work keeps the source set on your machine.
- AES-256-GCM guards working copies.
Anonymise talent vendor data sets offline — see plans & start free →
Limitations & cautions
Article 28 still applies if a supplier can re-identify the people. A held alias map or rich quasi-identifiers may keep the set personal in the supplier's hands. Share the map only under contract, or leave it off.
Frequently asked questions
Does Article 28 require full anonymisation?
Not always, but it requires a written contract and data minimisation. If the supplier can still re-identify people, the set stays personal and the Article 28 duties apply.
Should I share the alias map with the partner?
Only if the contract requires it. For a fully minimised transfer, leave the map with the controller.
Is the source set uploaded?
No. The app is fully offline. You control when the minimised copy goes out.