A DSAR response is the package you give a person who asks for their data under UK GDPR Art. 15. Art. 12(3) gives you one calendar month to reply, extendable by a further two months only where the request is complex or you have received several from the same person — the clock does not stop while you review. Before you send the reply, you must hide PII that belongs to other people. anonym.plus marks that data on your own device, so nothing leaves your machine while the deadline runs.
When this applies
A subject files a data subject access request (DSAR). Your reply gathers emails, notes, and forms that name colleagues and other customers too, and the one-month Art. 12(3) clock is already running against the date the request came in.
How anonym.plus handles it
- Open the gathered files in anonym.plus on your device.
- Local OCR reads scanned pages, so it catches printed text too.
- The tool flags names, emails, phone numbers, and IDs.
- Keep the subject's own data; mark third-party PII for removal.
- Black out or swap each flagged item, then review the result.
- Save the clean pack. The source never leaves your machine.
What you need to provide
- The gathered files (PDF, DOCX, TXT, email export, or scan).
- An operator: Redact (remove), Replace (swap), or Mask (partial).
- Optional allow-list to keep the subject's own identifiers.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | Margaret Hughes → [THIRD_PARTY] |
| Contact | EMAIL_ADDRESS | j.walker@example.co.uk → [EMAIL] |
| Contact | PHONE_NUMBER | +44 20 7946 0958 → [PHONE] |
| Identifiers | UK_NINO | QQ 12 34 56 C → [ID] |
| Location | LOCATION | 14 Elm Road, Leeds → [ADDRESS] |
| Accounts | UK_BANK | sort 20-00-00, a/c 12345678 → [ACCOUNT] |
Compliance achieved
- Supports a lawful reply under UK GDPR Art. 15 access rights.
- Prepares the pack against the one-month reply window in UK GDPR Art. 12(3), extendable by two months only for complex or repeat requests.
- Hides other people's PII so disclosure stays within the law.
- Runs offline; the subject file is guarded with AES-256-GCM.
- Reads 48 languages, so records in any tongue are covered.
Anonymise DSAR responses offline — see plans & start free →
Limitations & cautions
The tool flags PII; you decide what to release. Art. 15 gives the subject their own data, not a free pass to others' details. Whether a name is truly third-party is a legal call, and it has to be made inside the Art. 12(3) window, not after it. Review each flag before you send the pack.
Frequently asked questions
What must I redact in a DSAR reply?
Hand the subject their own personal data. Remove PII that belongs to other people, unless they have agreed or it is reasonable to disclose without it. anonym.plus flags both categories so a human makes the final call on each one before the pack goes out.
How long do I have to reply?
One calendar month from the request under UK GDPR Art. 12(3), running from receipt, not from when you start work on it. You can add two further months only if the request is complex or the person has made several requests, and you must tell them within the first month that you are doing so.
Does this send my files to a server?
No. The app runs on your own device with no cloud step. The subject's data never leaves your machine, which keeps the disclosure under your control and off any third-party server.
Can it read scanned letters in the pack?
Yes. Local OCR reads scanned pages, so PII in image files is caught alongside typed text, which matters when the file includes photocopied forms or a scanned letter from years earlier.