Document anonymization for accounting, payroll and tax advisory firms

An accounting firm is not the data controller: it is a processor. The data in the payslips, tax forms and deeds that pass through the office belongs to the employees and customers of its client companies, and any use outside the engagement —a question to a colleague, a due diligence, a file sent to the software vendor’s support— is a transfer that must be justified or anonymized. anonimiza.do does it in seconds, in batches of one client company and one month, recognises Spanish identifiers and records every operation.

Which documents an accounting firm handles every day

For every client company and every month, the office handles:

Payslips, one per worker and month; contracts, annexes, extensions, settlements and dismissal or sanction letters.
Social Security contribution and registration documents: settlement receipts and staff lists, registrations, terminations and changes filed electronically, temporary incapacity notes.
Tax forms and their filing receipts: withholding (111 and 190), instalment payments (130 and 131), VAT (303 and 390), third-party transactions (347), income tax (100) and corporate tax (200). The tax agency receipt carries a CSV code and a barcode.
Clients’ issued and received invoices, receipts and the ledgers built from them.
Bank statements, SEPA remittances and reconciliation of collections and payments.
Accounting books, balance sheets, general ledger and annual accounts before filing.
Deeds and registry documents: incorporation and amendments, purchases, mortgage loans, powers of attorney, land registry extracts.
Identity documents supplied by the client: national ID or foreigner ID, bank ownership certificates, residence certificates, family book, disability certificates for tax deductions.
Files by speciality: inheritances (forms 650 and 651), immigration, vehicle transfers and grant justifications with payslips and contracts attached.

When you must anonymize before sharing

Filings with the tax agency, Social Security, the Companies Registry, the employment service or a court have their own legal basis and go with full data. What requires anonymization is secondary use:

Consulting an external professional

The adviser passes the file to a tax lawyer to assess an appeal, or an external employment lawyer reviews a dismissal letter. It is shared with someone who is not in the processing agreement signed with the client: either there is an authorised sub-processor, or the document goes anonymized.

Due diligence and audit

In the sale of a company, the buyer reviews in a data room the payslips, contracts and employment and tax contingencies of a workforce that is not yet theirs. They need seniority, salary and category, not identities. The same applies when an auditor or an external adviser of the client comes in.

Technical support, migrations and test environments

Sending a real payroll or accounting file to the software vendor to reproduce an incident, or loading real data into a test environment when changing programs, is the quietest leak in the sector and the least documented. Anonymize first.

Using AI tools

Pasting a clause, a dismissal letter, a tax query or a balance sheet into a language assistant to draft, summarise or compare is processing third-party data outside the engagement. The text is anonymized before pasting.

Templates, internal training and communication

Turning a deed, a payslip or a successful appeal into a reusable model for the team, a case study or a client newsletter requires that no data of the original person or company remains.

The basic copy of the contract: an anonymization required by law

Article 8.4 of the Spanish Workers’ Statute requires delivering to the workers’ representatives a basic copy of each contract with all its data “except the national identity document or foreigner identity number, the address, marital status and any other that could affect personal privacy”. It is, literally, a partial anonymization by data type, and it is monthly.

What data appears and what must not be redacted

Almost everything in an accounting document is in the catalogue of data types; the risk here is not leaving something untreated, but redacting too much:

In payslips, contributions and contracts: name, NIF or NIE, the worker’s and the company’s Social Security numbers, address, date of birth, company name and tax ID, amounts, dates, IBAN, and the CSV code and barcode of the filed contract.
In tax forms and receipts: individual and corporate tax IDs, company names, tax address, amounts, dates, CSV code and barcode. In invoices, also phone, email, website, sometimes a licence plate, and from 2027 the Verifactu QR code.
In deeds and registry extracts: names, NIF, NIE or passport of shareholders and buyers, address, marital status, amounts, the CSV code of the electronic copy and the notarial protocol barcode.
Health data that slips in through temporary incapacity notes and disability certificates: not among the 20 catalogue types, but covered with a custom type described in plain language.
What must not be redacted: legal references. A tax form or a deed is full of “article 7.p) of Law 35/2006”; a naive anonymizer deletes them and leaves the document useless. The catalogue treats them as a type separate from personal data.
File metadata: author and network path reveal the firm and the employee who produced every document that leaves the office.

How to fit it into an accounting firm’s calendar

A written office policy: what is anonymized, when and who decides, consistent with the processing agreements signed with each client.
One processing template per type of delivery —due diligence, external consultation, software support, training— so the clerk only uploads, reviews and downloads, without choosing data types each time.
Work in batches at the peaks: month-end payslips and contributions, quarterly forms in January, April, July and October, income tax in spring and annual accounts in July are uploaded as one ZIP per client company and month.
Document the sub-processing when the recipient needs identifiable data: a GDPR art. 28 agreement with the third party and the controller client’s authorisation.
Deliver through a secure channel with expiry and log the transfer —client, recipient, date, documents, technique— in the record of processing activities.
Set the retention of the processed document and demand destruction by the third party when its work ends.

What anonimiza.do brings to an accounting firm

Detects the 20 data types in the catalogue —individual and corporate NIF, NIE, passport, Social Security number, names and company names, address, phone, email, IBAN, amounts, dates, CSV codes, QR codes and barcodes— and validates NIF, NIE, Social Security and IBAN by check digit, which in an employment or tax document full of similar numbers is what prevents errors.
Treats legal references as a catalogue type of their own, separate from personal data, so a tax form or a deed keeps the legal citations that make it useful.
Custom data types described in plain language —contribution account code, cadastral reference, protocol number, file number, diagnosis in a sick-leave note— with no rules to program and nothing to train.
Spreadsheets processed column by column, batches in ZIP and OCR for whatever the client sends scanned or photographed with a phone: half the sector’s workload.
Two modes: irreversible anonymization, or reversible pseudonymization with stable tokenization that keeps each worker traceable within the batch without revealing who they are.
Removes file metadata before download —author, software, dates and path— and keeps an audit log of every document processed: the evidence of diligence you show the client or the data protection authority.
Data always in the European Union (AWS Frankfurt), with optional deployment in the AWS Spain region; Spanish National Security Framework (ENS) MEDIUM category and a data processing agreement to document the sub-processing to your clients.
Free plan of 3 documents a month with no card; Professional plan with OCR, batches and API to connect it to the practice management software.

Try for free: 3 documents a month

Frequently asked questions

If the documents are not ours but our clients’, can we put them into an external tool?

Yes, on two conditions. As a processor, the firm cannot engage another processor without the controller’s authorisation (GDPR art. 28.2 and 28.4): the authorisation must be in the agreement signed with the client, and the vendor must in turn sign a processing agreement and process the data in the EU. anonimiza.do offers both. And if the document leaves genuinely anonymized, it is no longer personal data and the problem disappears.

Does it redact data it should not, such as the amounts in a balance sheet or legal references?

You choose which data types are processed in each template: you can leave amounts untouched in a balance sheet and process them in a payslip. Legal references are a separate catalogue type and are not confused with personal data. And you review the result before downloading it.

Does it work with what the client sends us, or only with clean PDFs?

PDFs produced by the payroll or accounting software are processed directly. Supplier invoices, ID cards and receipts that arrive scanned or photographed with a phone go through OCR. Spreadsheets are processed column by column.

How long does a month-end payroll batch take and what happens to the documents afterwards?

Each document is processed in seconds and the batch is uploaded as a ZIP. Documents are stored encrypted with configurable auto-deletion —24, 48 or 72 hours, 7 days or a custom period— and once it expires they are irreversibly destroyed: no other copy of your clients’ data lives on someone else’s server.

Do we have to anonymize what we file with the tax agency, Social Security or the Registry?

No. Those filings have their own legal basis and go with full data, as does anything submitted to a court or the employment service. What gets anonymized is secondary use: external consultations, due diligence, technical support, training and AI tools.