Recruitment vendor data redaction is the removal of personal information from a file bound for a processor. UK GDPR Art. 28(3) sets out what a processor contract with a recruitment vendor must cover, and reg. 19 of the Conduct of Employment Agencies and Employment Businesses Regulations 2003 separately expects an agency to get a work-seeker's consent before passing their details to a client. anonym.plus marks identifiers on your device, so a vendor receives only the minimum the role requires.
When this applies
An agency brief or shortlist often carries more personal detail than a vendor needs, and reg. 19's consent expectation does not cover data volunteered beyond what the work-seeker agreed to share. You trim the extra identifiers before the handoff, keeping both the Art. 28 contract terms and the agency-conduct rule in view.
How anonym.plus handles it
- Open the file in anonym.plus on your device.
- Built-in OCR reads a scanned shortlist page.
- The app marks names, contacts, and references.
- Confirm each marking and keep role-relevant fields.
- Swap or black out the confirmed identifiers.
- Save the minimised file locally.
What you need to provide
- The vendor-bound file (PDF, DOCX, CSV).
- An operator (Replace keeps the brief readable).
- Optional batch for a full shortlist.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | shortlisted Bauer → [CANDIDATE] |
| Contact | EMAIL_ADDRESS | bauer@example.co.uk → [EMAIL] |
| Contact | PHONE_NUMBER | +44 121 496 3310 → [PHONE] |
| Identifiers | UK_NINO | QQ 12 34 56 C → [NINO] |
| Location | LOCATION | home town → [LOCATION] |
| Org | ORGANIZATION | current firm → [EMPLOYER] |
Compliance achieved
- Supports the processor-contract terms in UK GDPR Art. 28(3).
- Keeps within the work-seeker consent expected by reg. 19, Conduct of Employment Agencies and Employment Businesses Regulations 2003.
- Shares only the fields the role and contract require.
- Offline work keeps candidate detail off any server.
Anonymise recruitment vendor files offline — see plans & start free →
Limitations & cautions
Article 28 requires a written processor contract and safeguards this app does not provide, and reg. 19 consent covers only what the work-seeker actually agreed to share. It minimises fields only. Keep a compliant data-processing agreement and confirm consent scope with the vendor.
Frequently asked questions
What must an Art. 28 processor contract with a recruitment vendor cover?
Article 28(3) requires terms on the subject matter, duration, and nature of processing, plus safeguards such as confidentiality and assistance with data-subject requests. anonym.plus supports the minimisation side by trimming fields before sharing, not the contract itself.
Does an agency need consent to pass on my details?
Reg. 19 of the 2003 Conduct Regulations generally expects a work-seeker's consent before an agency passes their information to a client. Extra fields beyond that consent should not travel with the file at all.
Is the file uploaded before it reaches the vendor?
No. The app runs locally, so candidate detail stays with you until you choose to send the minimised file.