How to Anonymise Data Before Selling or Licensing Business Records

Before a business sells or licenses its digital records, personal data has to be dealt with. Most buyers, including AI developers, expect names and identifiers to be removed. Getting this right protects customers and staff, reduces legal risk and makes a deal more likely. This guide explains how to anonymise data, the difference between anonymisation and pseudonymisation under UK GDPR, and how to do it without destroying the data's usefulness.

Anonymisation vs pseudonymisation

Anonymisation

Data is anonymous when individuals can't be identified, directly or indirectly, by any means reasonably likely to be used. Truly anonymous data falls outside UK GDPR.

Pseudonymisation

Identifiers are replaced with codes, but the data could be linked back to individuals using additional information. Pseudonymised data is still personal data and UK GDPR still applies. It does, however, reduce risk.

The ICO publishes guidance on both. Most business archives prepared for licensing are pseudonymised, with strong controls, rather than fully anonymous.

Where personal data hides in business records

• email headers, signatures and bodies
• Slack and Microsoft Teams messages
• CAD title blocks and revision notes
• project-software assignees and comments
• CRM contacts and notes
• invoices, delivery addresses and phone numbers
• file metadata, such as authors and last-modified-by fields
• free-text fields and attachments

Techniques

Removal

Delete fields that aren't needed, such as phone numbers, addresses and bank details.

Consistent pseudonyms

Replace each person with a stable code or synthetic name, so threads and assignments still make sense.

Generalisation

Reduce precision, for example a full postcode to a postcode district, or an exact date to a month.

Suppression

Remove rare combinations that could identify someone, such as a unique job title in a small firm.

Redaction of free text

Use named-entity recognition tools to find names in text, then check the results by hand.

Metadata cleaning

Strip author fields and embedded properties from documents.

Keep the data useful

Over-aggressive anonymisation can destroy the links that give records their value. Preserve:

• the order of events and the relative timing
• consistent identifiers across systems
• job numbers and project codes, where they don't identify people
• document versions and references

Special category and sensitive data

Health information, trade union membership, and data about criminal offences or children should usually be excluded altogether, not just pseudonymised. HR folders and personal channels are best left out completely.

Test for re-identification

Before release, try to identify individuals in a sample using the data together with publicly available information. Consider the "motivated intruder" test described by the ICO. Small companies and specialist sectors carry a higher risk, because there are fewer people to hide among.

Contractual safeguards

A licence should:

• prohibit re-identification
• limit use to the agreed purpose
• set security requirements
• require deletion at the end of the term
• allow audit

See exclusive vs non-exclusive licences.

Document everything

Keep a record of the data you held, what you removed, the methods used, the tests performed and your reasoning. A data protection impact assessment is often appropriate.

Related reading

• Selling customer data when a company closes
• Export Slack data and Teams archives
• Insolvency data

How McKays can help

McKays helps owners and advisers judge whether records could be prepared and licensed responsibly. We start with a description, never files. See the sector guides and our privacy notice.

A practical workflow

1. Inventory: list every system and the personal data fields each holds.
2. Scope: decide what the buyer actually needs, and drop everything else.
3. Exclude: remove HR, payroll, health and personal folders or channels entirely.
4. Transform: apply consistent pseudonyms, generalisation and redaction.
5. Clean metadata: strip document properties and file author fields.
6. Test: run re-identification checks on a sample, and fix what you find.
7. Review: have a second person check the output and the method.
8. Record: document the process for your records and the buyer's due diligence.
9. Secure: keep the mapping between real identities and pseudonyms separate and access-controlled, or destroy it if it isn't needed.

Tools

Several commercial and open-source tools can detect and replace personal data in text, documents and structured data. They differ in accuracy, language support and the file types they handle. Whatever tool is used, human review and documented testing are still needed. No tool guarantees anonymity on its own.

Anonymising different record types

• Email: replace sender and recipient addresses, strip signatures, and redact names in message bodies and attachments.
• CAD files: clear title-block names, initials and approval signatures, and remove author metadata.
• Spreadsheets: check hidden sheets, comments and tracked changes as well as visible cells.
• Project software: pseudonymise assignees, commenters and watchers consistently with the email pseudonyms.
• Accounting data: remove bank details and individual customers' names, and generalise addresses.

FAQ

Is anonymised data still covered by UK GDPR?

Not if it is truly anonymous. Pseudonymised data is still personal data.

Can AI tools anonymise data?

They can help find names and identifiers at scale, but results should be checked by people and tested for re-identification.

Does anonymisation reduce value?

Not if it is done carefully. Many buyers prefer pseudonymised data that keeps its structure.

Should HR data be included?

Generally not. Exclude HR, payroll and personal records.

Who is responsible?

The data controller, meaning the company or the office-holder, stays responsible until data is properly anonymised or transferred lawfully.