Pseudonymising OASys Offender Management Assessments – UK GDPR-compliant anonymisation per DPA 2018
An OASys (Offender Assessment System) report is a structured assessment of an offender's criminogenic needs, risk of serious harm, and sentence-management requirements across twelve domains, used by the Probation Service and HMPPS since 2001. OASys covers over 85,000 prisoners and around 250,000 people on community supervision, carrying substantial special-category data under UK GDPR Art. 9 and Art. 10. anonym.legal pseudonymises offender identifiers to enable quality-assurance review.
When this applies
This task applies when OASys assessments are reviewed by probation quality-assurance teams, training supervisors, or research bodies analysing risk-assessment methodology, and those reviewers require the assessment data but not the offender's personal identifiers; the data is criminal-conviction data under UK GDPR Art. 10 and special-category data under Art. 9.
How anonym.legal handles it
- Upload the OASys assessment report (PDF or structured export).
- The engine identifies the offender's name, date of birth, CRN (case reference number), and any named third parties — victims, family members, or co-defendants — in the narrative sections.
- All personal identifiers are pseudonymised consistently across the twelve domain sections.
- Domain scores, risk-of-serious-harm ratings, sentence-plan objectives, and intervention recommendations are preserved in clear text.
- A reversible mapping table is produced with UK data residency.
- The pseudonymised assessment is released for quality-assurance or training review.
What you provide
- OASys assessment report (all domains)
- Sentence plan or supervision record linked to the OASys assessment
Limitations & cautions
- OASys data is operationally sensitive criminal-conviction data under UK GDPR Art. 10 — even pseudonymised assessments should be shared only within the authorised training or quality-assurance cohort; unlawful disclosure risks UK GDPR Art. 83 penalties.
- The tool pseudonymises personal identifiers but does not validate the accuracy of the risk-assessment scores or domain ratings — assessment quality review requires specialist probation expertise.
- Unlawful disclosure of OASys data risks enforcement action; UK GDPR fines reach up to £17.5 million or 4% of annual global turnover under DPA 2018 s.157.
FAQ
Are victim references in the OASys assessment pseudonymised?
Yes. Named victims appearing in OASys narrative sections are detected and pseudonymised with distinct pseudonyms, preserving the victim-offender relationship context without disclosing real identities.
Can pseudonymised OASys data be used in academic criminology research?
Yes, subject to appropriate ethical approvals, data-sharing agreements with HMPPS or the Probation Service, and compliance with DPA 2018 requirements for research processing. The pseudonymised data satisfies data-minimisation obligations for the research context.
Does the tool handle OASys updates and re-assessments in a longitudinal series?
Yes. Upload the full longitudinal series in a batch; the engine assigns the same pseudonym to the offender across all assessment versions, preserving longitudinal coherence.