Redacted exhibits under CPR Part 31: pseudonymise non-party data in disclosed exhibits – UK GDPR-compliant anonymisation per CPR Part 31
Exhibits disclosed under CPR Part 31 — invoices, correspondence, records — frequently contain personal data about individuals who are not parties to the proceedings; anonym.legal pseudonymises those non-party identifiers within exhibits before disclosure, enabling proportionate compliance with disclosure obligations whilst protecting third-party personal data under UK GDPR.
When this applies
Applies when a solicitor is preparing exhibits for disclosure under CPR Part 31 and the exhibits contain personal data about individuals who are not parties — for example, customer records in a commercial dispute or HR records in an employment claim.
How anonym.legal handles it
- Upload the exhibit documents — invoices, emails, records — in PDF or DOCX format.
- Configure the party-names allow-list for the case parties.
- anonym.legal identifies and pseudonymises non-party names, addresses, account references, and other personal identifiers across all exhibits.
- Substantive content — dates, amounts, subject matter — is preserved so the evidential value of the exhibit is maintained.
- A reversible mapping is stored with EU data residency.
- Consider whether your disclosure statement should note that exhibits have been prepared with third-party data pseudonymised in accordance with UK GDPR data-minimisation principles.
What you provide
- Exhibit documents (PDF or DOCX)
- Party-names allow-list
Limitations & cautions
- Decisions on which documents are disclosable and whether any redaction is permissible under CPR Part 31 must be made by a qualified solicitor.
- Irrelevant redaction of substantive content may constitute a breach of disclosure obligations — only personal-identifier data should be pseudonymised, not substantive evidence.
FAQ
Is pseudonymising non-party personal data in disclosed exhibits permissible under CPR?
Proportionate pseudonymisation of non-party personal data is consistent with data-minimisation principles under UK GDPR Article 5. Whether it is permissible in any given case under CPR Part 31 should be confirmed with the court or agreed with the other side.
Can I pseudonymise personal data that is also part of the substantive evidence?
If the identity of a non-party is itself material to the issues in dispute, pseudonymisation may not be appropriate for that individual. Use the party-names allow-list or manually exclude individuals whose identities are evidentially material.
What if the exhibit is a spreadsheet with thousands of rows?
anonym.legal processes large spreadsheets at row level, identifying personal-identifier columns and pseudonymising all relevant cells consistently across the dataset.