How anonymisation of company data works
A company's work archive is valuable because it shows how real people actually worked: how a bug was found and fixed, how a customer's problem was solved, how a project was planned. The same archive is full of personal data. Anonymisation is the step that removes the people and keeps the work.
Why anonymisation, and not just "removing names"
Under the GDPR, information about a person stops being personal data only when that person can no longer be identified, not by the buyer and not by anyone else with reasonable effort. Replacing names with codes while keeping a list of who is who is not enough. That is called pseudonymisation, and the data is still personal data.
That is why anonymisation goes further than a search-and-replace, and why the key that links replacements to real names is never handed over and is deleted together with the raw copies.
Step 1: Leave out what should never be shared
Some material is not cleaned at all. It is removed entirely before processing starts:
- HR files, payroll, contracts of employment and performance reviews;
- health information and sick-leave records;
- passwords, access keys and other secrets;
- private folders and personal mailboxes not related to work;
- confidential material that belongs to clients or partners.
Step 2: Find and replace personal details
Everything else is scanned for details that point to a person or a company:
- Names, in every form they appear. In Latvian, for example, one name can appear in seven case forms, with or without diacritics, as a nickname or as "Mr Bērziņš".
- Contact details: e-mail addresses, phone numbers, street addresses.
- Identifiers: personal ID codes, bank account numbers, car registration numbers, IP addresses.
- The company itself: its name, its domains, its clients' and suppliers' names.
Each real person gets a consistent replacement, such as "Person 14", across every file. That keeps conversations readable: you can still follow who answered whom, without knowing who they were.
A short example
Before:
After:
The working part, a customer problem, a request and a deadline, is kept. Everything that pointed to real people is gone.
Step 3: Clean code and its history
Source code needs special care. Every change in a Git repository records the author's name and e-mail address, and comments and configuration files often contain names, server addresses or access keys. The whole history is rewritten so that every author is replaced consistently and secrets are removed, while the code itself and the order of changes stay intact.
Step 4: Check the result
Automatic tools find most personal details, but not all of them. So the result is checked:
- samples are reviewed by a person, file by file;
- files are searched again for the names and details found in the first pass;
- anything uncertain is removed rather than kept.
The checks are written down in an anonymisation report that goes to the administrator and the buyer together with the dataset.
Step 5: Protect it with the licence
Even a well-anonymised dataset is protected by contract as well. The buyer's licence forbids any attempt to re-identify people or companies, and the raw copies are deleted once the anonymised dataset has been delivered.
Where it all happens
All copying and processing happens inside the EU, under a written GDPR data-processing agreement with the company. Nobody outside, including potential buyers, sees the raw material. Before an agreement is signed, a buyer sees only a one-page description with no company name and no data.
What is left at the end
After anonymisation, the dataset still shows what makes it valuable: real code and its development, real support cases, real project discussions, in real working languages. It no longer shows who the people were.
If you are handling an insolvency or a liquidation and want to know whether a company's data is worth anonymising, read what an administrator can and cannot sell or get in touch with us.
This article is general information, not legal advice.
← All articles