Open-Source Document Anonymization with LibreOffice
EU governments are moving to open-source software. Italy, France, Germany, and Spain have formal policies for it. Germany's Schleswig-Holstein moved 25,000 government PCs to LibreOffice in 2024. The French Gendarmerie runs 77,000+ workstations on GendBuntu. That is a Linux build with LibreOffice.
These agencies need GDPR-compliant anonymization. But most PII tools only work with Microsoft Office. That leaves a gap.
anonym.legal's LibreOffice Extension fills this gap. It detects 267+ entity types in Writer, Calc, and Impress. It runs on Windows, macOS, and Linux.
Why Open Source Suits the Public Sector
No vendor lock-in
Microsoft 365 costs money every year. LibreOffice is free. For agencies with many desktops, this is a big saving. But cost is not the only reason.
Open-source code can be checked. Any agency can read how it works. For bodies that hold citizen files, this is a legal need. It is not a choice.
Data stays in the EU
anonym.legal runs on Hetzner servers in Germany. No files leave the EU. With LibreOffice, there are no Microsoft cloud links. The whole workflow stays in one place.
Privacy by design
GDPR Article 25 asks for privacy built into every step. Copying text into an outside tool does not meet this rule. The extension works inside the editor. Removing personal details is part of the editing step. No extra apps are needed. No copy-paste risk.
Three Real-World Uses
Government DSAR responses
Citizens can ask for their records. Agencies must send them. But they must also hide any other person's details first.
With the extension:
- Open the reply in Writer
- Click Analyze
- Check the preview — keep the citizen's own details, remove all others
- Apply and send
The preview is key. DSARs need selective removal, not full blanket masking. Each entity can be accepted or skipped one by one.
University research files
Research teams must remove names before sharing study results. A project may include:
- Calc sheets with names and contact details
- Writer transcripts with quotes from study subjects
- Impress slides with case details for a talk
One extension handles all three file types. Presets keep the same rules across the whole project.
Court document redaction
Courts that publish rulings must remove names, addresses, and other personal details. The extension has three modes:
- Replace: Names become PERSON_1, PERSON_2 — the same label each time
- Redact: Addresses are fully removed
- Mask: Partial hiding for dates or case numbers where some context must stay
Writer keeps all formatting. Headers, footers, and numbered lists remain after any changes.
How to Deploy
Single user:
- Download the
.oxtfrom anonym.legal/api/download/libreoffice - Double-click and install
- Restart LibreOffice
IT team rollout:
Share the .oxt via a network drive, Ansible, or SCCM. LibreOffice can install extensions from the command line with no user prompts. Teams can share presets through one anonym.legal account. This keeps rules the same for every user in the group.
GDPR Compliance Table
| GDPR Rule | How It Is Met |
|---|---|
| Article 5(1)(c) — Data minimization | Only found PII is changed; all other text stays the same |
| Article 25 — Privacy by design | Removal runs inside the editor, not in a separate tool |
| Article 32 — Security | AES-256-GCM, zero-knowledge auth, ISO 27001 servers |
| Recital 26 — Anonymization | Replace, Redact, and Mask take content out of GDPR scope |
| Article 4(5) — Pseudonymization | Encrypt mode gives reversible pseudonymization |
| BDSG Section 22 | Detection covers health, biometric, and ethnic origin fields |
Get Started
- Download the extension — free
- Sign up at anonym.legal — free tier: 200 tokens per month
- Read the full docs
Paid plans start at EUR 3 per month for 1,000 tokens. Higher volumes are also available.
For agencies that handle many requests at once, see GDPR DSAR Batch Processing at Scale.
When This Approach Has Limits
Keeping the whole workflow inside the editor, on EU servers, with open-source code that agencies can audit is a genuine fit for public-sector privacy-by-design obligations, but limits remain worth stating plainly.
EU custody control is not detection quality. Running on Hetzner servers in Germany under ISO 27001 keeps citizen records inside the EU and answers the location question well. It does not change what the detection engine finds. Sovereignty over where data sits is separate from accuracy over what gets removed. A name the engine fails to flag stays in the document whether the server is in Frankfurt or anywhere else. Location control and detection completeness are different guarantees, and only the second determines whether a published court ruling actually contains no personal data.
Selective DSAR redaction raises the stakes on misses. DSAR responses require keeping the requesting citizen's own details while removing every other person's. That per-entity judgment is exactly where detection accuracy bounds the result. A third party named only in free text, or a quasi-identifier like a small-town address combined with a role, can re-identify someone even after obvious names are gone. The output may be pseudonymized rather than anonymized, and in a regulated DSAR that distinction has direct legal consequences for the agency.
The compliance table maps controls, not conclusions. Meeting Articles 5(1)(c), 25, and 32 with the right technical measures supports compliance but does not constitute it. A regulator judges the outcome, and Encrypt mode in particular is reversible pseudonymization under Article 4(5), so that data stays in GDPR scope and the burden shifts to protecting the key. A trained human still has to review each preview, confirm BDSG Section 22 special categories were caught, and sign off that a published document meets the legal standard.
Sources
- European Commission Open Source Software Strategy 2020-2023
- Schleswig-Holstein government — 25,000 PC move to LibreOffice (2024)
- French Gendarmerie — 77,000+ GendBuntu workstations (by 2019)
- GDPR Articles 4(5), 5(1)(c), 25, 32, Recital 26
- BDSG Section 22 — German Federal Data Protection Act