By · Last updated 2026-04-10

Back to BlogLegal Tech

Spreadsheet Anonymization for GDPR and CCPA

Excel formulas reference cells containing customer names. Pivot tables cache sensitive data. Air-gapped environments are required for 67% of government.

April 10, 20268 minute read
Excel anonymizationspreadsheet GDPRpivot table redactioncell-level PII detectionformula preservation

Spreadsheets Are Not Documents

A Word file is a text stream. An Excel file is something else. Cells point to other cells. Formulas run on ranges. Pivot tables group named data. Macros move through the whole workbook. Most redaction tools treat Excel like a text document. That is the wrong model.

Here is a simple example. Column A has customer names. Column D has this formula: =VLOOKUP(A2, CustomerTable, 5, FALSE). This formula looks up the account balance by name. You replace the name in column A. You do not update the formula or the lookup table. The formula still returns the real balance for the original name. The file looks clean. It is not.

This is common in enterprise Excel files. Data lives in relationships — not just in cells. Replacing cell values without tracing those relationships leaves PII exposed.

GDPR Article 28 and External Sharing

GDPR Article 28 covers data sharing with processors. If you send personal data to a consultant, a vendor, or an auditor, you need technical safeguards in place.

Say you need to share a 50,000-row customer file with an analytics vendor. A PDF export strips formulas. It also breaks large files with complex formatting. A CSV strips formulas and pivot tables too. Neither gives the vendor a usable dataset.

The only option that works: anonymize inside the native Excel format. Replace the identifying values. Keep the structure. The vendor gets a working file. You meet the GDPR safeguard requirement.

Air-Gapped Environments

67% of government and defense procurement RFPs cite air-gapped environment requirements (DISA 2024). Defense contractors handle personnel data, logistics records, and procurement files in Excel. They cannot use cloud tools. The data cannot leave the controlled network.

The Desktop App solves this. It processes Excel files on the local machine. No network calls happen during processing. The output file never leaves the air-gapped environment. Internal teams can share clean files within the controlled network.

This meets the technical profile required for government contract compliance.

Three Levels of Cell Intelligence

Good Excel anonymization works at three levels at once.

Value level: Find and replace PII in individual cells. Names, emails, phone numbers, and national IDs are flagged using the same detection engine as document processing.

Formula level: Find cells whose formulas reference PII cells. Update those references to point to the anonymized values. Or replace the formula with its result to stop formula-based PII exposure.

Structure level: Clear pivot table data caches. Process hidden rows and columns. Handle VBA macro code that uses specific cell addresses or values.

All three levels must run together. Fixing values without fixing formulas leaves PII in place. Fixing formulas without clearing caches does the same.

This challenge spans every file format. See how format fragmentation affects PII detection for a broader view.

For teams working with structured data at API level, see GDPR data minimization in real-time APIs.

If your team runs large DSAR exports, see GDPR DSAR batch processing at scale for workflow patterns that apply here.

Sources

Ready to protect your data?

Start anonymizing PII with 285+ entity types across 48 languages.

About this page

We update this page when our platform or the law changes.

Read our founder note for how we work.

Each change shows up in the timestamp at the top.

Related reading

We follow these rules

  • GDPR (EU 2016/679).
  • ISO/IEC 27001:2022.
  • NIS2 (EU 2022/2555).
  • HIPAA safe harbor under 45 CFR § 164.514(b)(2).

Our promise

We do not sell your data.

We do not train models on your text.

We store your files in Germany.

You can delete your account at any time.

You own your work.

Where we run

Our servers live in Falkenstein, Germany.

We use Hetzner. They hold ISO 27001 certification.

All data stays in the EU.

Backups run every day.

Need help?

Email support@anonym.legal.

We reply within one business day.

How we test

We run a full check suite on every release.

Each surface gets its own sweep script and report.

Human reviewers spot-check the output each week.

We track recall and precision on a labelled set.

Bad runs block the deploy.

What we never do

  • We never sell your information to third parties.
  • We never train models on what you upload.
  • We never keep your work after you delete it.
  • We never share keys with any outside firm.
  • We never run ads inside the product.

Plans in plain words

We sell credits, not seats.

One credit covers one short job.

Long jobs use a few credits each.

You can top up at any time.

Unused credits roll over each month.

Read the plans page for current rates.

Who built this

A small team of engineers and lawyers built this.

We ship from Europe and work in the open.

Our founder note spells out why we started.

Where to start

How the parts fit

A browser add-on cleans text inside Chrome.

A Word plug-in handles drafts in Office.

A small desktop tool works on whole folders.

An agent protocol link feeds large models safely.

All four share one core engine and one rule set.

Words from our team

We started this work after a lunch about cookies.

One friend kept getting odd ads on her phone.

We asked why a court file leaked through a draft.

We sketched the first build on a napkin that week.

By month three we had a tiny demo for a friend.

She used it on her first case the next day.

Common questions we hear

Can the tool read scanned PDFs? Yes, with OCR.

Does it work on long files? Yes, in small chunks.

Can I roll my own rule set? Yes, save it as a preset.

Does it run offline? The desktop build runs offline.

Do you keep my files? No, the cloud build wipes after each run.

Will it learn from my work? No, we never train on inputs.

A short tour of the workflow

Upload a file or paste a snippet of prose.

Pick the entities you want gone from the draft.

Choose a method: replace, mask, hash, encrypt, or redact.

Press run and watch the side panel show each hit.

Skim the result and tweak any rule that misfired.

Save the cleaned file or send it to a teammate.