GDPR & compliance
Anonymisation guidance by country: what European regulators say
Europe shares one legal test for anonymous data, but each regulator adds its own guidance. Ten of them, dated and sourced, applied to one document.
Read articleNational ID numbers in documents: the rules country by country
France’s NIR, Belgium’s national number, the Dutch BSN, the German tax ID: each follows national rules. A sourced table for 8 countries, with masking tips.
Read articleAnonymising documents under UK GDPR: what the ICO's guidance says
The ICO says a masked document is anonymous only if the risk of identifying anyone is sufficiently remote for its reader. How it applies that test, as of October 2026.
Read articleDe-identified data in North America: California, US states and Québec
Masking alone does not make a document deidentified in North America. The CCPA, Virginia, Québec and federal Canada compared, as of October 2026.
Read articleAnonymising Documents in Switzerland Under the Revised FADP
The revised FADP has applied since 1 September 2023. Here is what it means for a Swiss salary statement, payslip, rental file or medical report, and what to mask.
Read articleISO 27001 and SOC 2 audits: what to mask in the evidence you hand over
An over-masked sample can be rejected, and an unmasked one exposes data. Here is what to hide and what to keep in ISO 27001 and SOC 2 audit evidence.
Read articleTrade Secrets: What to Mask Before Sharing a Document With a Partner
A trade secret only stays protected if you treat it like one. Here is what usually counts, and what to mask in a document before it leaves your company.
Read articleClinical trial documents: anonymising reports before publication
Sponsors must anonymise clinical study reports before EMA or CTIS publishes them. What EMA's guidance actually asks for, and where it gets hard.
Read articleIs Pseudonymised Data Still Personal Data Under GDPR?
A 2025 EU ruling says pseudonymised data can stop being personal data for a recipient who cannot re-identify anyone. Here is what changes, and what does not.
Read articleHIPAA Safe Harbor: the 18 identifiers to remove from a medical document
Eighteen fields, one federal rule. See exactly what Safe Harbor asks you to remove from a discharge summary or a scanned lab report, and why GDPR asks a different question.
Read articleHealth, religion, union membership: special category data in documents
Health, religion and union status hide in ordinary paperwork. Here is the Article 9 and 10 list, where it turns up, and how to mask it properly.
Read articleSending Documents Outside the EU: Should You Anonymize First?
GDPR Chapter Five governs sending documents outside the EU. Here is what counts as a transfer, what US adequacy covers, and how to decide before you upload a file.
Read articleFreedom of information requests: what to redact before releasing documents
Disclosure comes first, but personal data is the exception every legal system protects. Here is a plain routine for deciding what to redact, and how to prove it, before you release a document.
Read articleWhistleblower reports: how to protect identities in documents
A whistleblower report must protect the reporter, the accused, and anyone else it names. Learn what counts as an indirect identifier before you share a file.
Read articleAnonymise or delete? Document retention under the GDPR
Article 5(1)(e) GDPR limits how long you keep documents. The three options at the end of retention, and why a masked copy usually still counts as personal data.
Read articlePublishing court decisions and public records: what must be masked
Each court system hides names in its own way. Here is what France, Germany, the EU Court of Justice, the UK and the US remove, and what that means when you share a decision.
Read articleSubject access requests: how to redact other people's data
A subject access request gives a person a copy of their own data, not other people's. Here is what to mask, what to leave in, and how to log each decision.
Read articleYou sent an unredacted document by mistake: what to do now
The file is gone, and it still shows names, pay or bank details. Here is a calm playbook, step by step: contain, assess, notify if needed, document, fix.
Read articleGDPR data minimisation, applied to documents
Data minimisation is not only about forms and databases. It applies to every PDF, Word file and scan you send, keep or upload. Here is how to apply it.
Read articleThe three tests of anonymisation (singling out, linkability, inference), explained
Regulators test anonymisation with three questions: can someone single a person out, link their records or infer facts about them? What that means for a PDF or a Word file.
Read article
Mask a document without uploading it
ONYRI Sanitize finds names, identifiers, bank details and secrets in a PDF, a Word file or a scan, and masks them in your browser. You check the preview, then download a flattened copy.