By · Last updated 2026-04-10

返回博客法律科技

面向GDPR与CCPA的电子表格结构化数据匿名化

Excel公式会引用包含客户姓名的单元格,数据透视表缓存敏感数据,67%的政府采购合同要求气隙环境。本文介绍如何在原生Excel格式中实现合规级匿名化。

April 10, 20268 分钟阅读
Excel anonymizationspreadsheet GDPRpivot table redactioncell-level PII detectionformula preservation

电子表格不是普通文档

Word文件本质上是文本流,而Excel文件则截然不同:单元格相互引用,公式作用于数据范围,数据透视表汇总命名数据,宏则遍历整个工作簿。大多数脱敏工具将Excel当作文本文档处理——这是错误的模型。

举一个简单的例子。A列存储客户姓名,D列包含以下公式:=VLOOKUP(A2, CustomerTable, 5, FALSE)。该公式通过姓名查找账户余额。您替换了A列中的姓名,但没有更新公式或查询表。公式仍然返回原始姓名对应的真实余额。文件看上去已经脱敏,实则并非如此。

这种情况在企业Excel文件中十分普遍。数据存在于关联关系中,而不仅仅存在于单元格里。仅替换单元格数值而不追踪这些关联关系,个人信息依然处于暴露状态。

GDPR第28条与外部数据共享

GDPR第28条规范了与数据处理方的数据共享。向顾问、供应商或审计师发送个人数据时,您需要采取相应的技术保障措施。

假设您需要将一份50,000行的客户文件共享给数据分析供应商。导出为PDF会剥离公式,还会破坏包含复杂格式的大型文件;导出为CSV同样会剥离公式和数据透视表。两种方式都无法为供应商提供可用的数据集。

唯一可行的方案:在原生Excel格式内实现匿名化——替换识别性数值,保留文件结构。供应商获得可正常使用的文件,您满足GDPR的技术保障要求。

气隙环境

67%的政府和国防采购招标文件明确要求气隙环境(美国国防信息系统局,2024年)。国防承包商在Excel中处理人员数据、物流记录和采购文件,既无法使用云端工具,数据也不得离开受控网络。

桌面应用程序解决了这一问题:它在本地设备上处理Excel文件,处理过程中不发生任何网络请求,输出文件始终留在气隙环境内,内部团队可在受控网络内共享脱敏后的文件。

这一方案满足政府合同合规所需的技术要求。

三个层次的单元格智能处理

优质的Excel匿名化需要同时在三个层次上运作。

数值层: 检测并替换单个单元格中的个人信息。姓名、电子邮件、电话号码和身份证件号码使用与文档处理相同的检测引擎进行标记。

公式层: 识别公式引用了含有个人信息单元格的情况,将这些引用更新为指向匿名化后的数值;或将公式替换为其计算结果,从根本上杜绝基于公式的个人信息泄露。

结构层: 清除数据透视表的数据缓存,处理隐藏的行和列,处理使用了特定单元格地址或数值的VBA宏代码。

三个层次必须同步运行。仅修复数值而不修复公式,个人信息依然留存;修复公式而不清除缓存,同样如此。

这一挑战跨越所有文件格式。请参阅文件格式碎片化如何影响个人信息检测,获取更全面的视角。

对于在API层面处理结构化数据的团队,请参阅实时API中的GDPR数据最小化

如果您的团队需要处理大批量DSAR数据导出,请参阅GDPR DSAR批量处理规模化方案,了解适用于此场景的工作流模式。

数据来源

准备好保护您的数据了吗?

开始使用 285 种实体类型在 48 种语言中匿名化 PII。

About this page

We update this page when our platform or the law changes.

Read our founder note for how we work.

Each change shows up in the timestamp at the top.

Related reading

We follow these rules

  • GDPR (EU 2016/679).
  • ISO/IEC 27001:2022.
  • NIS2 (EU 2022/2555).
  • HIPAA safe harbor under 45 CFR § 164.514(b)(2).

Our promise

We do not sell your data.

We do not train models on your text.

We store your files in Germany.

You can delete your account at any time.

You own your work.

Where we run

Our servers live in Falkenstein, Germany.

We use Hetzner. They hold ISO 27001 certification.

All data stays in the EU.

Backups run every day.

Need help?

Email support@anonym.legal.

We reply within one business day.

How we test

We run a full check suite on every release.

Each surface gets its own sweep script and report.

Human reviewers spot-check the output each week.

We track recall and precision on a labelled set.

Bad runs block the deploy.

What we never do

  • We never sell your information to third parties.
  • We never train models on what you upload.
  • We never keep your work after you delete it.
  • We never share keys with any outside firm.
  • We never run ads inside the product.

Plans in plain words

We sell credits, not seats.

One credit covers one short job.

Long jobs use a few credits each.

You can top up at any time.

Unused credits roll over each month.

Read the plans page for current rates.

Who built this

A small team of engineers and lawyers built this.

We ship from Europe and work in the open.

Our founder note spells out why we started.

Where to start

How the parts fit

A browser add-on cleans text inside Chrome.

A Word plug-in handles drafts in Office.

A small desktop tool works on whole folders.

An agent protocol link feeds large models safely.

All four share one core engine and one rule set.

Words from our team

We started this work after a lunch about cookies.

One friend kept getting odd ads on her phone.

We asked why a court file leaked through a draft.

We sketched the first build on a napkin that week.

By month three we had a tiny demo for a friend.

She used it on her first case the next day.

Common questions we hear

Can the tool read scanned PDFs? Yes, with OCR.

Does it work on long files? Yes, in small chunks.

Can I roll my own rule set? Yes, save it as a preset.

Does it run offline? The desktop build runs offline.

Do you keep my files? No, the cloud build wipes after each run.

Will it learn from my work? No, we never train on inputs.

A short tour of the workflow

Upload a file or paste a snippet of prose.

Pick the entities you want gone from the draft.

Choose a method: replace, mask, hash, encrypt, or redact.

Press run and watch the side panel show each hit.

Skim the result and tweak any rule that misfired.

Save the cleaned file or send it to a teammate.