Why Documents Are Harder to Anonymize Than Databases
A database has columns you can drop. A document has none: names and numbers hide in sentences, tables, footers, scans and file metadata instead.
A database is easy to anonymize because every name lives inside a labeled column. A document has no columns. A name, a phone number, or a signature can sit inside a sentence, a table, a footer, or a scanned image. Each one has to be found on its own.
Take a client spreadsheet next to a letter sent to one client. In the spreadsheet, deleting the name column removes every name at once. In the letter, Jane Example's name sits in the greeting, in the mailing address, and again in the signature: three separate spots.
What is the difference between structured and unstructured data?
Structured data has a fixed shape: rows and columns, like a spreadsheet. Every value carries a label, so a program can delete the phone-number column without reading a single row. Unstructured data has no such shape. A letter or a scanned form is free text and images, with nothing that says this is a phone number. Someone has to read it to know what is inside.
| Question | In a database | In a document |
|---|---|---|
| Where does a name live? | In one column, used by every row | Scattered in sentences, tables, headers, a signature |
| How do you remove it everywhere? | Drop the whole column, once | Find every occurrence, on every page |
| What technique applies? | Generalize or suppress a field, for all rows | Detect it in free text, then mask it |
| What if you miss one? | A skipped row still leaves the column safe | One missed mention can still identify the file |
Where do identifiers hide in a document?
A data protection officer working on a database can list every column in minutes and decide what to drop. A document offers no such list: the same name or number can turn up in several places at once, without warning.
- Body text: a name, phone number or address, inside an ordinary sentence.
- Tables inside the file: payroll, client lists, appointment schedules.
- Headers and footers: a case reference or a client's name, on every page.
- Signatures and handwritten notes: on a scanned page or a photographed form.
- File metadata: the author's name, saved automatically by Word or a PDF tool.
- Pasted images and screenshots: a photo, or a chart with visible labels.
Why does dropping a column not work on a letter?
Dropping the name column in a database view is one operation that covers every record at once. A letter has no name field to drop. The word Jane can appear in the greeting, again when she is thanked for her order, and once more in the signature block. Each mention sits among ordinary words, so it must be found every time it shows up.
How do generalization and suppression work on a paragraph of text?
Generalization trades an exact figure for a range. Suppression removes a value outright. The Article 29 Working Party's 2014 opinion on anonymisation techniques is still cited by EU regulators today. It names generalization and randomization as the two main technique families for structured data. Applied to a document, the same ideas work on sentences instead of spreadsheet cells.
- Born March 3, 1990, in Lyon becomes Born in the 1990s, in France: two facts made general.
- Account holder: Jane Example, age 47 becomes Account holder: [name masked], age 40 to 49.
- An exact salary becomes a bracket, such as between EUR 40,000 and 50,000 a year.
- A street address becomes a city name, dropping the house number and postcode.
What does a sound process for anonymizing documents look like?
A workable process follows five steps: detect, review, remove, flatten, verify. Skip the review step and false confidence creeps in. Skip flattening and a masked file still holds its original text underneath. One more distinction matters: replacing a name with a label, like NAME1, is pseudonymization, not anonymization, because the pattern stays traceable. The UK's ICO draws the same line for structured data.
- Detect: scan every page for names, numbers, dates and other values a rule set treats as sensitive.
- Review: check the list of matches page by page, since a detector can miss things or flag something harmless.
- Remove or mask: black out or replace each confirmed value, in text, tables, headers and footers alike.
- Flatten: turn masked pages into images, or a rasterized PDF, so no text layer survives underneath.
- Verify: open the result and check nothing sensitive is still selectable, copyable, or left in the file's properties.
ONYRI Sanitize is built around this exact document problem, not the database one. It reads the text inside a PDF, a Word file or a scan in the browser. It places masks on the real page layout and exports flattened pages with no text underneath. Its limit: it reads text, not pictures, so a logo or a face is not analyzed automatically — mask it by hand with the “Draw an area” tool.
None of this makes document anonymization impossible. It makes it a process, not a single click. Treat a document the way a careful editor treats a manuscript. Read every page, mark every instance, and check the copy before it leaves your hands.
Frequently asked questions
Can I remove every name from a document the same way I delete a column in a spreadsheet?
No. A spreadsheet keeps each name in its own column, so deleting it removes every value at once. A document has no columns. A name can sit in a sentence, a table, a footer or a signature, and each occurrence has to be found on its own.
Does covering text with a black box in a PDF actually remove it?
Only if the page is turned into a flat image afterward. Many tools just draw a shape over the text, and the words are still there underneath, ready to be copied. The UK's National Archives warns that redaction can leave traces of what was removed inside the file's data.
What makes a database easier to anonymize than a Word document or a scan?
A database groups similar values together, so one rule, like dropping a column, protects every record at once. A document mixes free text, tables, images and metadata in one file. The same identifier can appear in several forms, so one rule will not catch them all.
Do generalization and suppression work the same way on a paragraph as on a spreadsheet column?
The idea is the same, but the target changes. On a column, generalization rounds every value in one pass, such as replacing exact ages with age ranges. On a paragraph, the same rounding has to happen sentence by sentence, wherever the age or address is written.
Are scanned pages and photographed documents anonymized the same way as typed text?
No. A typed PDF already has a text layer a program can search directly. A scan is only an image, so the text first has to be read with on-device optical character recognition. The result depends on scan quality, and handwriting is often not read at all.
Sources & references
- Opinion 05/2014 on Anonymisation Techniques (WP216)Article 29 Data Protection Working Party (European Commission archive)
- Redaction Toolkit: editing exempt information from paper and electronic documents (2022)The National Archives, UK
- Pseudonymisation guidanceInformation Commissioner's Office (ICO), UK