Document anonymization for law firms
A law firm concentrates special-category data —health, union affiliation, criminal records, assets— in rulings, pleadings and case files. Anonymizing them before publishing, sharing or archiving is what lets you reuse that knowledge without breaching GDPR or attorney-client privilege. anonimiza.do does it in seconds, recognizes Spanish identifiers and keeps a record of every anonymization.
What documents a firm handles
A typical firm handles daily:
- Client files, with all personal, financial and family information.
- Pleadings detailing facts, evidentiary documents and third-party data.
- Rulings and decisions from all jurisdictions.
- Contracts, wills and legal instruments from clients and third parties.
- Communications with opposing parties and their representatives.
- Expert, medical and financial reports submitted as evidence.
- Staff data and opposing parties' data, if the firm focuses on labor or HR matters.
When anonymization is essential
On top of GDPR comes the duty of attorney-client privilege set by the bar code of ethics and the Organic Law of the Judiciary. Six recurring situations demand real anonymization:
Publishing rulings on the firm's website
Uploading a ruling with the client's data, even to show a judicial victory, is processing personal data without legal basis. Only anonymized rulings get published, removing also the contextual data that allows re-identification: small locality, specific date, specific company.
Consulting a case with a colleague
Sending the complete file by email or messaging is a transfer without legal basis. Consulting cases with colleagues requires prior anonymization, unless there is a documented engagement or co-defense relationship.
Training and lectures
Using real cases in internal training, lectures or publications is useful, but the cases must remain completely anonymized: no attendee —let alone an internet search— should be able to re-identify the client by cross-referencing data.
Sending files to experts or witnesses
The medical, financial or technical expert does not need all the client's personal data to issue a report. The file sent should contain only the data necessary for their function; the rest is anonymized.
Archiving closed cases
After closure the firm has retention obligations —10 years from the last action, for professional liability— but also minimization obligations. Assess whether the file should be anonymized for statistical use or internal case law.
Disclosing documents to the opposing party or third parties
In proceedings with multiple parties —class actions, mediation, arbitration— documents containing data of third parties not directly involved are anonymized before transfer.
What data must be anonymized in a pleading or a ruling
A pleading or a ruling contains several levels of identifiable data:
- Direct identifiers of parties and representatives: names and surnames, national ID, NIE, passport, address, bar membership number of the lawyer and the court representative.
- Third parties mentioned: witnesses, experts, family members of the client or the opposing party, employees, coworkers, neighbors.
- Contextual identifiers: exact location and date of the events, employer, medical center, license plate, policy or bank account number.
- Especially sensitive data: diagnoses, details of violence, abuse or discrimination, sexual orientation, union or political affiliation, criminal records.
Recommended workflow for a firm
- A written internal policy on what is anonymized and when, approved by the managing partner or the firm DPO.
- Anonymized templates for recurring uses: marketing, training, consultations.
- An automated tool that processes rulings and pleadings before they leave the firm for any use other than the judicial process.
- Training for the whole team —lawyers, associates, administration— on what real anonymization is and what it is not.
- A register of anonymizations to demonstrate diligence in case of a complaint.
What anonimiza.do brings to a law firm
- It detects the 20 data types of the catalogue across seven families —personal identification, contact details, financial, technical, administrative and temporal data, and graphic codes— and validates NIF, NIE, Social Security and IBAN by their check digit.
- Your own data types described in plain language, such as «case file reference», with no rules to program and nothing to train.
- Built-in OCR for scanned rulings and pleadings, and batch processing.
- Two modes depending on the use: irreversible anonymization or reversible pseudonymization.
- An audit log for every processed document: the evidence of diligence in case of a complaint.
- Data always in the European Union (AWS Frankfurt), with an optional deployment in the AWS region in Spain; Spanish National Security Framework (ENS) MEDIUM category and a data processing agreement.
- Free plan with 3 documents a month and no card; Professional plan with OCR and API.
Try for free: 3 documents a month
Frequently asked questions
Can I publish rulings I won on my website for marketing?
Yes, but fully anonymized. It is not enough to replace «John Doe» with «J.D.»; any contextual data allowing identification must be removed: small locality, specific company, exact date, singular amount.
Do I have to anonymize the pleadings I submit to court?
No. Filing before a judicial body is covered by procedural legal basis; what must be anonymized is subsequent dissemination for other purposes: website, training, consultation.
Must I sign a processing agreement with the experts I send files to?
Yes, whenever you send them personal data for their professional service. The processing agreement documents who is controller and who is processor, and the data protection authority requires it in an inspection.
Can I use ChatGPT or other LLMs to analyze a client's pleading?
Only if you anonymize the pleading first or if the provider signs a GDPR processing agreement with EU servers. The free or consumer version of these services does not allow sending client personal data without breaching GDPR.
How long should I retain client files?
At least 10 years from the last action, for professional liability limitation and the bar code of ethics. Beyond that, consider anonymizing them for internal statistical use.