Census de-identification is the removal of staff PII from a workforce data set. Health, union, and similar fields are special-category data under UK GDPR Art. 9(1), usable in employment only through a condition such as Art. 9(2)(b) with a DPA 2018 Sch. 1 safeguard. anonym.plus runs locally and keeps the headcount math a buyer needs.
When this applies
A workforce census lists each employee with pay, role, and sometimes health or union data. On a business or asset sale, TUPE 2006 reg. 11 makes the seller give the buyer employee liability information not less than 28 days before the transfer. Everything beyond that set can be de-identified for the data room.
How anonym.plus handles it
- Point anonym.plus at the census file on your device.
- It scans ID columns and any free-text note fields.
- Special-category fields under Art. 9 get extra care.
- Swap staff for steady labels to keep joined rows.
- Save the clean data set on your device.
What you need to provide
- The census (XLSX, CSV, or export).
- A column map for known ID and sensitive fields.
- Replace with the map off for true anonymity.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | employee_name → [STAFF_n] |
| Identifiers | UK_NINO | NI number → [ID] |
| Health | MEDICAL_LICENSE | leave reason → [SENSITIVE] |
| Contact | EMAIL_ADDRESS | work email → [EMAIL] |
| Dates | DATE_TIME | hire date → [DATE] |
| Location | LOCATION | home address → [ADDRESS] |
Compliance achieved
- Strips special-category staff fields caught by UK GDPR Art. 9(1).
- Keeps the identified set narrow to what TUPE 2006 reg. 11 actually requires.
- Supports a risk assessment where UK GDPR Art. 35(3)(b) calls for a DPIA.
- Local-only work supports UK data residency.
Anonymise employee census files offline — see plans & start free →
Limitations & cautions
TUPE reg. 11 bites on a business or asset transfer, not on a plain share sale, and the employee liability information it lists must be given in identified form — you cannot anonymise that part away. Art. 9 fields carry the highest residual risk: a rare role in a small team can re-identify even after IDs go.
Frequently asked questions
Why is census data special under UK GDPR?
It can hold health, union, or similar Art. 9(1) data, which needs a lawful condition and a safeguard. Making the shared copy anonymous drops that burden for headcount and cost work.
Does this replace the TUPE reg. 11 disclosure?
No. On a business transfer the seller must still give employee liability information not less than 28 days before it happens, in identified form. De-identification applies to the wider census you put in the data room.
Can rows stay linkable after the swap?
Yes. A steady label map keeps each employee's rows joined while no real identity is left.