Regulatory response redaction is the removal of personal data from a submission to a regulator such as the Information Commissioner's Office. Where the ICO issues an information notice under DPA 2018 s.142, or an enforcement notice under s.146, the response has to stay truthful and complete — clearing only removes personal data the notice does not itself require, and once that data is genuinely anonymous under UK GDPR Recital 26 it sits outside scope. anonym.plus runs on your device and keeps the facts and argument whole.
When this applies
The Information Commissioner's Office, or another regulator, asks for documents on a short deadline. The package holds staff and customer names that are not needed to answer the specific question it raises.
How anonym.plus handles it
- Load the package into anonym.plus on your device.
- The tool scans every file for names, contacts, and IDs.
- Steady labels keep the same person consistent across documents.
- Review the summary and tune the flags.
- Save the clean package on your device.
What you need to provide
- The package as PDF, DOCX, or a folder of files.
- An operator (Replace keeps the response readable).
- Optional label map to keep one person steady.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | account owner → [CUSTOMER_1] |
| Names | PERSON | case officer → [STAFF] |
| Contact | EMAIL_ADDRESS | contact email → [EMAIL] |
| Dates | DATE_TIME | filed 02/03/2026 → [DATE] |
| Identifiers | UK_NINO | customer no. → [ID] |
| Location | LOCATION | branch address → [ADDRESS] |
Compliance achieved
- Anonymous output falls outside scope by UK GDPR Recital 26.
- Clears only what a DPA 2018 s.142 information notice, or its s.146 enforcement counterpart, does not itself require in the clear.
- Local work keeps the submission inside your firm until you send it.
- On-device AES-256-GCM guards the working files.
- Special category data under UK GDPR Art. 9 is flagged too.
Anonymise regulatory responses offline — see plans & start free →
Limitations & cautions
A DPA 2018 s.142 notice, or another regulator's equivalent power, compels a truthful and complete answer to what it asks. Clear only what the demand does not require — over-clearing can itself draw a follow-up demand.
Frequently asked questions
Can I redact a response to an ICO information notice?
Only the parts it does not require. A DPA 2018 s.142 information notice compels a truthful, complete answer to what it actually asks. You should remove personal data it does not call for, never narrow the substance of your answer.
Will the argument survive the swap?
Yes. Only personal data changes. The facts, dates of events, and reasoning stay in place.
Can I keep one person consistent across files?
Yes. A shared label map maps the same person to one alias across every file in the set.