Pseudonymising PSC Register Extracts Under the Companies Act 2006 – UK GDPR-compliant anonymisation per Companies Act 2006
The Persons with Significant Control (PSC) register, maintained under Companies Act 2006 Part 21A since 6 April 2016, records names, addresses, and nature of control of individuals exercising significant influence over a UK company. Any individual holding 25 percent or more of shares or voting rights must be entered; over 5.3 million companies are registered. anonym.legal pseudonymises PSC extracts so advisers assess ownership structures without exposing named individuals.
When this applies
This task applies when a PSC register extract is shared with potential investors, lenders, or M&A advisers as part of an initial ownership-structure review, and those parties do not yet have a legitimate basis under the Companies Act 2006 to inspect the full register or require personal data of the named PSCs. According to UK GDPR Art. 5(1)(c), sharing more personal data than necessary — even from a public register — remains a breach if no lawful basis exists for the specific transfer.
How anonym.legal handles it
- Upload the PSC register extract (typically a Companies House printout or certified extract).
- The engine identifies the PSC name, service address, date of birth, and any other personal identifiers in the extract.
- Each PSC is pseudonymised consistently; the nature of control, date of registration, and percentage ownership thresholds are preserved.
- A mapping table is produced with UK/EU data residency.
- Release the pseudonymised extract for preliminary ownership-structure review.
- Full re-identification is available to parties with lawful inspection rights under the Companies Act 2006.
What you provide
- PSC register extract (Companies House printout or certified extract)
- Corporate structure chart referencing PSC individuals (if available)
Limitations & cautions
- The PSC register is a public register; PSC information is available via Companies House for over 5.3 million companies as at 2024. Pseudonymisation is appropriate for preliminary review; it does not prevent public access to the original register.
- Date-of-birth information on the public register is partially suppressed by Companies House. The tool pseudonymises any date-of-birth data present in the extract provided.
- The tool does not provide legal advice on who qualifies as a PSC under the Companies Act 2006 Part 21A or the 25 percent ownership threshold for registration.
FAQ
Is PSC information already public — why pseudonymise it?
PSC information is publicly available via Companies House, but sharing an extract directly with advisers processes that personal data under UK GDPR. Pseudonymising at the preliminary stage satisfies the data-minimisation principle until formal due diligence with a full lawful basis is underway.
Does the tool handle PSC registers for multiple group companies?
Yes. Upload extracts for all group entities in a batch. The engine tracks individuals who appear as PSCs in multiple group companies and assigns consistent pseudonyms across all extracts.
What happens to the nature-of-control description?
The nature-of-control description (e.g. 'Ownership of shares — more than 75%') is preserved in clear text. Only the PSC's personal identifiers are pseudonymised.
Can this workflow be combined with the data-room anonymisation workflow?
Yes. PSC register extracts pseudonymised here can be added to the main data-room batch, where the same pseudonyms are applied consistently across the broader corpus. Data rooms commonly hold 500 to 5,000 documents per deal, and PSC extracts for group companies can account for dozens of those cases.
What did the Economic Crime and Corporate Transparency Act 2023 change for PSC registers?
According to ECCTA 2023, Companies House received enhanced powers to query and reject information from November 2023 onwards, including PSC register data. The Act also introduced identity verification requirements for directors and PSCs. Pseudonymisation is for preliminary review only; Companies House filings must use verified real identities.