By · Last updated 2026-05-29

Back to BlogGDPR & Compliance

Anonymization Presets End Inconsistency

When 8 paralegals independently configure PII anonymization, inconsistency is inevitable. GDPR auditors look for systematic, consistent application of.

May 29, 20266 minute read
GDPR auditprivacy configurationanonymization consistencyteam compliancepresets

Anonymization Presets End Inconsistency

A legal team processes client files with eight paralegals. Each one has a different idea of what "anonymize PII" means:

  • Paralegal A: redacts names, ignores addresses
  • Paralegal B: replaces names with pseudonyms, redacts everything else
  • Paralegal C: redacts names and emails, forgets phone numbers
  • Paralegal D: follows the procedure doc from 2022, updated twice since

The files look uniform. They are not. An audit finds the same PII types handled in different ways across work from the same week and same case type.

This is setup drift. It is a GDPR failure that does not require a data breach to trigger a fine.

Why Auditors Focus on Consistency

GDPR Article 5(2) requires controllers to prove compliance. Not just to achieve it — to prove it. That means showing a systematic process with real evidence.

A DPA auditor checking PII practices looks for three things:

  1. Written procedure: Which PII types must you detect, and how must you handle them?
  2. Tool setup: Do your active tool settings match that procedure?
  3. Applied evidence: Are files processed in line with the procedure?

When different staff produce different outputs for the same file type, showing compliance is not possible. The auditor cannot confirm the procedure was followed.

GDPR Articles 24 and 32 require technical controls that are systematic and verifiable. Variable per-person settings do not meet that standard.

Why Setup Drift Happens

Setup drift occurs when several conditions meet at once:

No approved profile exists. Staff pick settings based on their own reading of the rules.

Training is vague. "Use the PII tool" without naming which types to detect or which method to apply is not enough.

Too many options. With 285+ entity types available, staff face choice fatigue when no approved profile guides them.

Procedures stay on paper. A written checklist cannot stop a team member from making different choices in the tool.

Staff turnover. New hires build their own setup from scratch rather than inheriting a tested and approved profile.

Presets as Technical Controls

Shared presets fix setup drift at the technical level.

Encode the compliance choice. Instead of telling staff "redact names, addresses, phone numbers, and national IDs using the Redact method," create a preset called "Client Review — GDPR Standard" with those exact settings. The decision is made once. It is applied every time.

Remove per-person choices. The operator's job becomes: select the preset, upload files, download output. No settings to pick. No PII types to select. No method to decide.

Share across the team. One preset goes to all staff. New hires get the same setup from day one. Turnover does not reset the standard.

Name each preset for its task:

  • "Client Review — GDPR Standard"
  • "HIPAA Safe Harbor — Clinical Records"
  • "FOIA Response — Exemption 6"
  • "Internal HR Records — EU Payroll"

Staff select the preset that fits their task. They do not build a setup from scratch.

Eight paralegals. Inconsistent PII handling. Audit finding. Here is the fix:

Step 1: Define the approved settings. Privacy counsel defines PII types and methods for each file category. This decision is made once by the right person.

Step 2: Create named presets.

  • "Client Review — GDPR": names, addresses, phone numbers, national IDs — Redact
  • "HR Files": names, dates of birth, salary data, addresses — Pseudonymize
  • "Third-Party Mail": names, emails, phone numbers — Replace

Step 3: Share the library. All eight paralegals get access. Old ad-hoc settings are deleted.

Step 4: Update the procedure. "For client file review: apply the 'Client Review — GDPR' preset." One line replaces pages of guidance.

Step 5: Create an audit trail. Processing logs record which preset was applied and when. The auditor sees the preset name, its exact settings, and the date of last review. Compliance is provable.

The compliance manager no longer audits per-person settings. The preset is the control.

Compliance Templates: Starting Points

Pre-built templates cut initial setup work for common frameworks.

GDPR Standard: Names, addresses, national IDs, emails, phone numbers, dates of birth. Redact method for full data reduction.

HIPAA Safe Harbor: All 18 PHI identifier types detectable in text. Date handling keeps year only.

FOIA Exemption 6: Names, home addresses, personal emails, personal phone numbers. Redact with black-bar output.

PCI-DSS: Credit card numbers (all major brands), CVV patterns, PIN numbers. Redact method.

These are starting points. Teams add custom PII types — internal identifiers, site-specific formats — to complete their approved profile.

For how preset governance works across remote teams, see remote work GDPR platform inconsistency and setup drift as a GDPR compliance risk. ML teams can use the same approach — see reproducible privacy presets for ML training data.

Conclusion

GDPR compliance is not just about correct PII handling on a given day. It is about showing a systematic and consistent process across all work. Setup drift is an audit risk. It can trigger a fine without any data breach.

Shared presets encode compliance choices at the technical level. The audit trail shows which preset was applied. The output is uniform because the setup is uniform.

Good intentions do not survive staff turnover and daily work pressure. Presets do.

Sources

Ready to protect your data?

Start anonymizing PII with 285+ entity types across 48 languages.

About this page

We update this page when our platform or the law changes.

Read our founder note for how we work.

Each change shows up in the timestamp at the top.

Related reading

We follow these rules

  • GDPR (EU 2016/679).
  • ISO/IEC 27001:2022.
  • NIS2 (EU 2022/2555).
  • HIPAA safe harbor under 45 CFR § 164.514(b)(2).

Our promise

We do not sell your data.

We do not train models on your text.

We store your files in Germany.

You can delete your account at any time.

You own your work.

Where we run

Our servers live in Falkenstein, Germany.

We use Hetzner. They hold ISO 27001 certification.

All data stays in the EU.

Backups run every day.

Need help?

Email support@anonym.legal.

We reply within one business day.

How we test

We run a full check suite on every release.

Each surface gets its own sweep script and report.

Human reviewers spot-check the output each week.

We track recall and precision on a labelled set.

Bad runs block the deploy.

What we never do

  • We never sell your information to third parties.
  • We never train models on what you upload.
  • We never keep your work after you delete it.
  • We never share keys with any outside firm.
  • We never run ads inside the product.

Plans in plain words

We sell credits, not seats.

One credit covers one short job.

Long jobs use a few credits each.

You can top up at any time.

Unused credits roll over each month.

Read the plans page for current rates.

Who built this

A small team of engineers and lawyers built this.

We ship from Europe and work in the open.

Our founder note spells out why we started.

Where to start

How the parts fit

A browser add-on cleans text inside Chrome.

A Word plug-in handles drafts in Office.

A small desktop tool works on whole folders.

An agent protocol link feeds large models safely.

All four share one core engine and one rule set.

Words from our team

We started this work after a lunch about cookies.

One friend kept getting odd ads on her phone.

We asked why a court file leaked through a draft.

We sketched the first build on a napkin that week.

By month three we had a tiny demo for a friend.

She used it on her first case the next day.

Common questions we hear

Can the tool read scanned PDFs? Yes, with OCR.

Does it work on long files? Yes, in small chunks.

Can I roll my own rule set? Yes, save it as a preset.

Does it run offline? The desktop build runs offline.

Do you keep my files? No, the cloud build wipes after each run.

Will it learn from my work? No, we never train on inputs.

A short tour of the workflow

Upload a file or paste a snippet of prose.

Pick the entities you want gone from the draft.

Choose a method: replace, mask, hash, encrypt, or redact.

Press run and watch the side panel show each hit.

Skim the result and tweak any rule that misfired.

Save the cleaned file or send it to a teammate.