FOI response redaction is the removal of personal data before a public release. Section 40(1) of the Freedom of Information Act 2000 gives an absolute exemption for the requester's own personal information, which a public authority handles as a subject access request instead; s.40(2) separately exempts a third party's personal data where release would breach the data protection principles, a test the Data Protection Act 2018 updated. anonym.plus blacks out what s.40(2) covers.
When this applies
A public authority must release records under an FOI request. The files hold home addresses, phone numbers, and other third-party personal details that s.40(2) lets it withhold.
How anonym.plus handles it
- Open the responsive files in anonym.plus on your device.
- Local OCR reads scanned pages, so it catches printed text too.
- The tool flags names, addresses, phones, and IDs.
- Black out each item that s.40(2) covers.
- Save the releasable copy on your device.
What you need to provide
- The responsive files (PDF, DOCX, or scans).
- Redact (black box) for public release.
- Optional log of each withholding for the response letter.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | private citizen → [REDACTED] |
| Location | LOCATION | home address → [REDACTED] |
| Contact | PHONE_NUMBER | personal mobile → [REDACTED] |
| Contact | EMAIL_ADDRESS | personal email → [REDACTED] |
| Identifiers | UK_NINO | QQ 12 34 56 C → [REDACTED] |
| Dates | DATE_TIME | date of birth → [REDACTED] |
Compliance achieved
- Supports withholding what a third party is entitled to keep private under FOIA 2000 s.40(2).
- Keeps the requester's own-record route under s.40(1) separate from this third-party exemption.
- Black-box redaction removes the text, not just hides it.
- Local OCR reads scanned pages so image text is caught.
- Runs offline — the record never leaves the authority's device.
Anonymise FOI responses offline — see plans & start free →
Limitations & cautions
Section 40(2) turns on the data protection principles and a fairness test. The tool finds personal data; the officer still decides which items to withhold. Indirect clues in narrative may need a manual call.
Frequently asked questions
What is the difference between s.40(1) and s.40(2)?
Section 40(1) is an absolute exemption covering the requester's own personal information — that request is handled as a subject access request, not an ordinary FOI disclosure. Section 40(2) is the one that matters for redaction: it exempts a third party's personal data where release would breach the data protection principles.
Does the black box truly remove the text?
Yes. The Redact operator deletes the underlying text, not just covers it, so the released copy holds no hidden records.
Can I keep a record of each withholding?
Yes. The tool can log each redacted item, which helps you cite the exemption in the response letter.