By · Last updated 2026-05-01

返回博客GDPR 与合规

内部员工编号同样属于个人信息

每个大型组织都有专有的内部标识,可将匿名记录与真实人员关联起来。34%的GDPR罚款涉及技术措施不足问题,而遗漏内部标识是一个被普遍忽视的合规盲区。

May 1, 20268 分钟阅读
employee ID anonymizationproprietary identifier detectionquasi-PIIGDPR custom entitiesno-code pattern builder

什么是准个人信息?

GDPR第4条涵盖任何可用于识别个人身份的数据,无需直接点名,只需通过额外步骤使识别成为可能。

内部员工编号便是典型案例。以「EMP-EU-123456」这个字符串为例,它没有指向任何人。但人力资源系统中有一张简单的映射表:EMP-EU-123456对应Maria Schmidt,慕尼黑高级工程师。任何能访问该表的人都能找到她。在GDPR框架下,这个编号属于个人数据。

同样的规则适用于其他内部代码:

  • 链接到CRM记录的客户账号
  • 链接到合同系统中客户名称的项目代码
  • 法律文件中的案件参考号
  • 链接到患者记录的医疗记录号

仅移除姓名和电子邮件是不够的。如果文件中仍保留内部标识,重新识别身份只需两步。

这一缺口为何导致罚款

34%的GDPR罚款涉及GDPR第32条规定的技术措施不足。 该数据来自DLA Piper 2025年GDPR年度报告。未能检测准识别性内部标识正属于这一类别。

EDPB在2024年处理了900余起一致性机制案件。跨境执法意味着共享数据集中的一个缺口,可能引发多个欧盟成员国的协调行动。

标准个人信息工具能够识别通用模式:姓名、电子邮件、电话号码、国家身份证号。但它们不了解您的内部编号格式——在您告知之前,没有任何工具知道。这就是缺口所在。

无代码规则构建器的工作原理

某全球物流公司需要将员工记录匿名化,用于外部审计。其员工编号格式为:EMP-[地区代码]-[6位数字],示例:EMP-EU-123456、EMP-APAC-789012、EMP-AMER-345678。

合规团队在AI规则助手中输入三个示例,AI返回:

  • 规则:EMP-[A-Z]{2,4}-\d{6}
  • 匹配全部三个示例
  • 建议实体名称:EMPLOYEE-ID
  • 建议后续步骤:使用更多地区代码测试

团队再测试10个样本,规则全部匹配。

他们将自定义实体保存至团队共享的GDPR预设,审计包中的47份文件随即完成批量处理,所有员工编号均被替换为基于职位的标签。审计机构收到的文件不再与任何个人关联。

整个过程无需工程支持,从头到尾不超过一小时。

后续影响

自定义实体保存至共享预设后,所有团队成员均使用相同配置,新员工从第一天起就能获得该保护。批量作业、API调用和手动上传均应用相同规则。

审计日志记录每份文件使用的预设,如果数据保护机构要求提供匿名化过程的证明,您可以随时调取。

自定义实体完整设置流程请参阅组织匿名化的自定义PII标识指南;跨团队一致性维护方案请参阅GDPR审计匿名化一致性预设指南

参考资料

准备好保护您的数据了吗?

开始使用 285 种实体类型在 48 种语言中匿名化 PII。

About this page

We update this page when our platform or the law changes.

Read our founder note for how we work.

Each change shows up in the timestamp at the top.

Related reading

We follow these rules

  • GDPR (EU 2016/679).
  • ISO/IEC 27001:2022.
  • NIS2 (EU 2022/2555).
  • HIPAA safe harbor under 45 CFR § 164.514(b)(2).

Our promise

We do not sell your data.

We do not train models on your text.

We store your files in Germany.

You can delete your account at any time.

You own your work.

Where we run

Our servers live in Falkenstein, Germany.

We use Hetzner. They hold ISO 27001 certification.

All data stays in the EU.

Backups run every day.

Need help?

Email support@anonym.legal.

We reply within one business day.

How we test

We run a full check suite on every release.

Each surface gets its own sweep script and report.

Human reviewers spot-check the output each week.

We track recall and precision on a labelled set.

Bad runs block the deploy.

What we never do

  • We never sell your information to third parties.
  • We never train models on what you upload.
  • We never keep your work after you delete it.
  • We never share keys with any outside firm.
  • We never run ads inside the product.

Plans in plain words

We sell credits, not seats.

One credit covers one short job.

Long jobs use a few credits each.

You can top up at any time.

Unused credits roll over each month.

Read the plans page for current rates.

Who built this

A small team of engineers and lawyers built this.

We ship from Europe and work in the open.

Our founder note spells out why we started.

Where to start

How the parts fit

A browser add-on cleans text inside Chrome.

A Word plug-in handles drafts in Office.

A small desktop tool works on whole folders.

An agent protocol link feeds large models safely.

All four share one core engine and one rule set.

Words from our team

We started this work after a lunch about cookies.

One friend kept getting odd ads on her phone.

We asked why a court file leaked through a draft.

We sketched the first build on a napkin that week.

By month three we had a tiny demo for a friend.

She used it on her first case the next day.

Common questions we hear

Can the tool read scanned PDFs? Yes, with OCR.

Does it work on long files? Yes, in small chunks.

Can I roll my own rule set? Yes, save it as a preset.

Does it run offline? The desktop build runs offline.

Do you keep my files? No, the cloud build wipes after each run.

Will it learn from my work? No, we never train on inputs.

A short tour of the workflow

Upload a file or paste a snippet of prose.

Pick the entities you want gone from the draft.

Choose a method: replace, mask, hash, encrypt, or redact.

Press run and watch the side panel show each hit.

Skim the result and tweak any rule that misfired.

Save the cleaned file or send it to a teammate.