HR: anonymizing CVs, payslips and disciplinary files

Mask an HR document for its reader, not once and for all. A hiring manager needs skills, not a photo or a birth date. An auditor needs amounts, not a social security number. A disciplinary file sent outside should not name the witnesses. Keep the original and share a masked copy.

This guide follows the GDPR, with pointers from UK, French and German regulators, as of September 2026. It is not legal advice.

Where do HR documents travel, and who should see what?

Article 5(1)(c) of the GDPR limits personal data to what is necessary for the purpose. For HR files, the UK regulator, the ICO, gives a concrete example: access to employment records is limited to HR staff, and managers only get the information they need.

What identifies a candidate in a CV beyond the name?

Much more than the name. Germany's Federal Anti-Discrimination Agency ran a pilot on anonymous applications from November 2010. Eight organizations viewed 8,550 applications without identities. The pilot largely hid the first four items below. It treated the next two as indirect clues and mostly hid them too. The last two are our additions.

• Name and photo
• Date of birth or age, marital status
• Nationality and place of birth
• Sex and disability, unless a legal support scheme needs them
• Email, phone and home address
• Periods of employment: a reader can work out an age
• School names and graduation years: they hint at origin and age
• The file name, the author field and comments in a Word file

The pilot found standardized application forms worked best. Blacking out ordinary applications took time and did not scale. The ICO suggests that a designated staff member removes irrelevant information before decision-makers see the form. Replace the name with a candidate number, so HR can find Jane Example for the interview. In France, blind screening has been optional since a law of 17 August 2015, as the Conseil d'État noted on 4 November 2015.

What should you mask on a payslip?

A payslip is an identity kit. Under section 1 of the Entgeltbescheinigungsverordnung, German payslips must show the birth date, the social insurance number, the tax ID and church tax markers. A church tax line reveals religion, which Article 9 of the GDPR protects. In France, the CNIL accepts the social security number for payroll, not for general HR management.

How do you handle disciplinary and investigation files?

These files are about several people at once: the employee concerned, the person who complained, witnesses, managers. The ICO notes that witness statements usually include the personal information of more than one person. If a worker asks for a copy of their data, you cannot simply refuse because a grievance is under way. You redact what identifies third parties.

1. 1Copy the file. The original stays in a restricted HR folder.
2. 2List every person in it. Decide, reader by reader, who may be named.
3. 3Mask third parties' names, emails, phone numbers and unique job titles.
4. 4Mask indirect clues: dates, places, shifts, quoted expressions.
5. 5Use stable labels such as Witness A or [NAME1]. HR keeps the key.
6. 6Export a flattened copy, and log which version went to whom.

Article 9 of the GDPR lists health data and trade union membership among the special categories, which need extra care. A sick note stapled to a warning letter should not travel with the file. Sanctions are not in Article 9, but they can harm a career. Share them on a need-to-know basis.

How long can you keep HR documents?

Article 5(1)(e) of the GDPR says data is kept in an identifiable form no longer than necessary. It gives no figures, and neither does the ICO: you set your own periods. After that, the ICO says to erase the information or, if possible, anonymize it. A copy where HR still holds the key is only pseudonymized.

Which tools mask HR documents properly?

A black shape drawn over text does not remove it: the ICO warns that covered information stays in the file. Adobe's documentation says the Redact tool permanently removes information from a PDF and is available only in Acrobat Pro, Premium or Studio. In Word, Microsoft's Document Inspector finds comments and tracked changes.

Also ask where the file goes while you mask it. ONYRI Sanitize is a web app that detects and masks inside the browser, so the file is not uploaded. It draws black bars or, on the Pro plan, consistent labels such as [NAME1], and always exports a flattened copy. It has no detector for medical terms or company names: add them by hand. Review each item, and keep your original. Masking reduces exposure. It does not by itself make a document anonymous.