How to anonymise text: names are only the start

A name is easy to spot. A person hidden in a job title, date and unusual incident can be harder to see. Understanding how to anonymize text starts with that difference. Removing direct identifiers can reduce exposure, but it does not automatically make a passage anonymous. This guide explains the terms, shows a careful review workflow and uses a clearly illustrative scenario to expose the common traps. It helps you edit the text. It cannot certify that a given use meets the law.

Be precise about the outcome you need

Redaction removes or conceals selected information. Pseudonymisation replaces identifying details with labels or otherwise separates them from the person. Anonymisation asks a wider question: can someone still tell who the text is about? These ideas are linked. Each has a different meaning. A passage can use careful labels in place of names and still be personal data. It still needs the right care and controls.

The ICO's introduction to anonymisation uses the phrase “a person is no longer identifiable”. Its guidance also explains how other information can affect that judgement. Read the official guide for your case. An app's feature name does not decide what the law requires.

Before editing, name the purpose and audience. Are you sharing a support example with a colleague, publishing a case study or preparing an internal analysis? A detail may be safe in a small, controlled setting. In a wider group, it may reveal much more. What does the reader need? What might they already know? Check whether a shorter extract would do the job.

Look beyond names and email addresses

Start with direct details such as names and email addresses. Check account numbers and other clear IDs too. Then inspect combinations. A small team, a precise date and an unusual event can point to one person. A unique role may point to one person. Removing the name will not change that. Read the passage as a whole, not as a list of fields.

Pay attention to quoted speech and distinctive phrasing. A colleague may recognise a speaker from an unusual incident or a sentence shared elsewhere. File paths, usernames and internal URLs can reveal identity or organisational context. Check the signature and old replies too. They can keep the name you just removed from the top of the message.

Do not erase useful context indiscriminately. Instead, ask whether each detail is necessary and whether it can be expressed more broadly. A relative sequence can replace an exact date when timing order is what matters. A department category can sometimes replace a unique job title. Record the changes you made. The reader needs to know the limits of the edited account.

A worked scenario: the small-team incident

Imagine an illustrative incident summary about the only overnight supervisor at a small site. You replace the person's name with “Employee A” but retain the shift, precise date, site and unusual repair. Everyone at that site may still know who it describes. The placeholder changed the surface wording without removing the identifying combination.

Start again from the purpose. Suppose the lesson is about a poor handover note. You may not need the site, date or unusual personal detail. Preserve the sequence of decisions and the wording that caused confusion. Generalise the rest only where doing so does not change the lesson. Can people still recognise the event? If so, do not call the account anonymous just because the names are gone.

Public use may need a different route. You might give a broader lesson or use an approved composite with a clear label. Follow the process for getting permission. Do not invent a customer outcome or disguise a fictional story as observed experience. You can explain a failure mode through an explicit example without claiming that a real person supplied the story.

Table: illustrative review of an incident extract. The treatments depend on purpose and do not establish anonymity by themselves.

How should placeholders work?

Use one label per entity and keep it consistent. Keep different roles clear. Labels such as “Requester” and “Reviewer” may help the reader follow who did what. Replacing everyone with “Person” can make a sequence impossible to follow. A label can still point to one person if the role is unique. Consistent labels alone do not settle the privacy question.

Keep any mapping file separate and appropriately protected if one is needed. A mapping lets you match a label back to a person. That is one reason the text may still be personal data. Do not attach the mapping to the cleaned extract out of habit. The recipient should receive only what the purpose and approved process require.

Check repeated mentions in headings, captions, tables and quoted replies. A single missed name can undermine an otherwise careful edit. Review abbreviations and possessive forms as well as the full spelling. A search can find repeated names. A person still needs to check nicknames and clues that look nothing like the name.

Where can automated cleaning help?

Lass0's anonymisation page describes local text cleaning, and the cleaner documentation explains how to enable it. Use the cleaned version as a candidate for review. The app's current workflow retains an Original and Cleaned view; understand that retention before using it with sensitive material.

Review for missed identifiers and changed meaning. A cleaner can remove an obvious email while leaving an identifying event. A rewrite may sound better. It can still change who did what. Compare the facts, sequence, quantities and qualifications with the source. The desired output is both reduced and faithful, not merely smoother prose.

The NCSC secure AI guidance places security across the system lifecycle. For a text-sharing workflow, that wider view is useful: extraction, cleaning, storage and destination each need consideration. A local cleaning step should not become a reason to ignore the rest of the handling process.

How do I know whether enough has been removed?

Think about what the reader could work out. Include other facts they are likely to know. Could they single out a person, link the passage to another record or recognise the event? Where that judgement matters, follow the official guidance and your organisation's review process. Use the checklist as an aid. It cannot guarantee the result.

Ask a second approved person to check a large or sensitive extract. Do this when your process calls for it. Give them the purpose and audience, not just the instruction to “check names”. Ask them to look for identifying combinations and whether the text still tells a true, useful story. Record any doubts that remain. A passage with no obvious names may still reveal a person.

Share less, with a clearer purpose

Keep the edited extract separate from the original, retain only what your process requires and check the destination before sending. The clipboard privacy guide covers copies left in history and synchronisation. If the destination is an AI service, use the prompt redaction guide for the final paste review.

Begin with a non-sensitive practice passage and test your placeholder scheme. Then apply the method to real material only within the appropriate authority and controls. Ask whether each detail helps with the task. Then read the details together. Do they still point to someone? Removing a name is a start; the review must continue beyond it.

Questions, answered

Is replacing names with labels the same as anonymisation?

No. Labels can still let someone work out who a person is. A mapping file or other clues may link the text back to them. Judge what remains in the actual setting.

Can a job title identify someone without a name?

Yes. A unique role may point to one person. A place, date or unusual event can add more clues. Read the details together, not just one field at a time.

Can automated text cleaning certify an extract as anonymous?

No. It can help you edit the text. The result still depends on context and other facts the reader may know. Follow the right review process for your use.