Accountants and finance teams: anonymizing invoices and bank statements

Before a financial document leaves your team, mask what points to a person or a deal. Keep what the reader needs to check the numbers. On invoices, that means names, addresses, bank details and sole traders' tax numbers. On bank statements, it also means the names and references in each transaction line. Always work on a copy.

This guide follows the EU GDPR, with UK pointers, as of September 2026. It is not legal advice.

Who asks for your financial documents, and what do they need?

Article 5(1)(c) of the GDPR limits personal data to what is necessary for the purpose. So ask one question: what must this reader check? The answer changes from one reader to the next.

Which identifiers hide in invoices, statements and payroll exports?

Invoices carry identifiers by law. Article 226 of the EU VAT Directive lists what a VAT invoice must show. That includes the full name and address of the seller and the customer, and the seller's VAT number. In some cases, such as intra-EU supplies of goods, the customer's VAT number appears too.

Is company data personal data?

Not in principle. Recital 14 of the GDPR says the regulation does not cover data about legal persons, including their name, legal form and contact details. But the ICO, the UK regulator, says information about sole traders, employees, partners and company directors may be personal data when it relates to them as individuals.

Sole traders are the trap. GOV.UK says a sole trader's invoice must include their name. Take an invoice from Jane Example, a freelance bookkeeper. Her trading name, VAT number and bank details all point to her. Treat them as personal data.

Why can a partly masked IBAN still identify someone?

An IBAN has a fixed structure. The Deutsche Bundesbank says a German IBAN has 22 characters: DE, two check digits, an eight-digit bank sort code and a ten-digit account number. According to the Banque de France, a French IBAN has 27 characters, including a bank code and a branch code. The start names the bank. The end holds the account.

• Hiding only the middle can leave the bank, the branch and part of the account visible.
• Two copies masked in different places can be pieced back into the full number.
• The holder's name printed next to a masked IBAN defeats the masking.
• The same IBAN often sits in payment terms, reminders and statements. Mask every copy.

What does PCI DSS say about masking card numbers?

PCI DSS is the card industry's security standard. According to the PCI Security Standards Council's FAQ 1492 (April 2024), requirement 3.4.1 allows no more than the BIN and the last four digits on screens and reports, unless a documented business need justifies more. The BIN is the first six digits, or eight for some card brands, as the Council explained in 2021.

FAQ 1146 separates two ideas. Masking hides digits on display, and a masked number could be unmasked. Truncation removes digits for good. FAQ 1091 warns that access to different truncated formats of the same card number greatly increases the ability to rebuild it. So show only the digits the reader needs, often none, in one format everywhere.

How do you keep a masked document useful?

1. Copy the file. Mask the copy, never the original.
2. Ask the reader what they must check: totals, VAT, dates or layout.
3. Mask what identifies people: names, addresses, IBANs, card and tax numbers.
4. Keep amounts, dates, VAT rates and line structure if the reader recomputes them.
5. Replace counterparties with consistent labels, such as Supplier A.
6. If an amount is itself confidential, mask it wherever it can be worked out.
7. Export a flattened copy, such as an image-only PDF, then try to copy text from the masked areas.

Watch the VAT line. You hide a net amount but leave a 20% rate and €9,750 of VAT. Anyone can work out the net: €48,750. A contract price may also sit in a total, a payment line and a reminder. Mask every one.

Keep the original anyway. In the UK, HMRC says businesses must generally keep VAT records for at least 6 years. A masked copy does not replace that duty. Once exported, it cannot be turned back into the original.

Which tools mask financial documents properly?

A black shape drawn over a PDF does not remove the text. The ICO lists this as an ineffective technique to avoid. Adobe's documentation says the Redact tool in Acrobat Pro, Premium or Studio permanently removes content and can remove hidden data such as metadata. For payroll exports in Excel, Microsoft says Document Inspector removes hidden rows and columns, except in a table header, a list header or a PivotTable, which it unhides instead. Better still, delete the columns you do not share.

ONYRI Sanitize is one option for PDFs, Word files and scans. Detection and masking run inside the browser, so the file is not uploaded, and the export is always flattened. It looks for IBANs, BICs, card numbers checked with the Luhn algorithm, VAT and tax numbers, and amounts with a currency. The Pro plan adds token mode, with consistent labels. Company names are detected only with a legal form attached (SAS, SARL, Ltd, Inc.…); salaries as such still have no detector. Add missing terms yourself, then review the preview before downloading.

Frequently asked questions

Sources & references