DPA redaction is the removal of contact and supplier PII from a processing agreement. UK GDPR Art. 28(3) fixes the eight terms a controller-processor contract must contain, and Art. 28(2) governs sub-processors. Where data leaves the UK, the transfer schedule uses the ICO's IDTA or the UK Addendum, both in force since 21 March 2022 under DPA 2018 s.119A. anonym.plus keeps all of those clauses and clears only the names.
When this applies
A processing agreement names the data-protection contacts, the sub-processors, and the signatories. A transfer schedule adds a named importer and exporter for the ICO's IDTA. To share the agreement as a precedent, you clear those and keep the Art. 28 framework.
How anonym.plus handles it
- Load the file into anonym.plus on your device.
- The tool flags DPO names, contacts, and signatories.
- It catches the downstream firm list and their details.
- Confirm the flags and keep the Art. 28 clauses.
- Swap or black out the IDs.
- Save the clean precedent on your machine.
What you need to provide
- The agreement plus schedules (PDF, DOCX, or mixed).
- An operator (Replace keeps the clauses readable).
- Optional role map for [CONTROLLER] / [SUPPLIER] labels.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | DPO name → [DPO] |
| Parties | ORGANIZATION | supplier → [SUPPLIER] |
| Downstream | ORGANIZATION | firm list → [SUBPROCESSOR] |
| Contact | EMAIL_ADDRESS | dpo@firm.co.uk → [EMAIL] |
| Location | LOCATION | hosting region → [LOCATION] |
| Names | PERSON | signatory → [SIGNATORY] |
Compliance achieved
- Keeps the eight mandatory terms in UK GDPR Art. 28(3) intact.
- Preserves the sub-processor rule in UK GDPR Art. 28(2) while clearing the named firms.
- Handles the ICO IDTA and UK Addendum schedules issued under DPA 2018 s.119A.
- Strips named DPO, signatory, and downstream contacts.
- Local-only work supports UK data residency.
Anonymise data processing agreements offline — see plans & start free →
Limitations & cautions
The downstream schedule often names small firms that are easy to trace. Review that list. A hosting region or contact role can still hint at a party after direct names go, so check the schedules.
Frequently asked questions
Does this keep the Art. 28 clauses?
Yes. Only IDs change, so the processing terms, audit rights, and sub-processor rules stay word for word. UK GDPR Art. 28(3) lists eight terms the contract must contain, and a precedent missing any of them is of no use.
What happens to the international transfer schedule?
It is treated like any other schedule. The ICO's IDTA and the UK Addendum have been in force since 21 March 2022 and both name an importer and an exporter contact. Those names are flagged; the clause text stays.
Are downstream firm names removed?
Yes. The named sub-processors in the schedule are flagged along with their contacts. You can keep a generic description of the service each one performs via an allow-list.