Third-party witness materials: pseudonymise before sharing with instructed experts – UK GDPR-compliant anonymisation
Civil proceedings often involve third-party witness materials — statements, medical records, police reports — obtained from non-parties; anonym.legal pseudonymises the personal data in those materials before they are shared with instructed experts or counsel, limiting unnecessary data exposure at the analysis stage whilst preserving the factual and evidential content.
When this applies
Applies when a solicitor has obtained third-party witness materials through CPR Part 31 disclosure or otherwise and wishes to share them with an expert or counsel without transmitting more personal data than is necessary for the professional instruction.
How anonym.legal handles it
- Upload third-party witness materials (statements, records, reports) in PDF or DOCX.
- Identify which individuals must remain named in clear for the expert's purposes (e.g. the named claimant in a medical report).
- anonym.legal pseudonymises all other personal identifiers — third-party witnesses, bystanders, treating clinicians not central to the instruction.
- Factual content, medical findings, and evidential narrative are preserved in full.
- A reversible mapping is stored with EU data residency.
- Share the pseudonymised bundle with the expert; re-identify if the expert requires clear names for specific individuals.
What you provide
- Third-party witness statements, medical records, or police reports (PDF or DOCX)
- Allow-list of individuals to retain in clear
Limitations & cautions
- Whether you are entitled to share third-party materials with an expert depends on the terms of any disclosure order and data-sharing agreements — that is a legal question for the solicitor.
- Medical records may be subject to additional access restrictions; confirm data-sharing basis before processing.
FAQ
Does sharing pseudonymised medical records still require a data-sharing basis under UK GDPR?
Yes — pseudonymisation reduces risk but does not remove UK GDPR obligations entirely. You still need a lawful basis under UK GDPR Article 6 and, for special-category data, an additional condition under Article 9.
Can the expert request re-identification for specific individuals?
Yes — using the mapping key, you can selectively re-identify specific individuals for the expert without revealing the full dataset in clear.
What if the third-party materials are in hard copy only?
Scan the hard-copy documents to PDF before upload. Ensure your scanning process complies with your information-governance policy.