Anonymising Statements of Work for External Review – UK GDPR-compliant anonymisation per UK GDPR Art. 5(1)(c)
A statement of work is a project-level document issued under an MSA specifying scope, named delivery team members, and client-side points of contact. UK GDPR Art. 5(1)(c) requires data minimisation; sharing named personnel with audit reviewers who need only commercial terms risks fines up to £17.5 million or 4% of annual global turnover. anonym.legal pseudonymises those individuals while preserving deliverables, pricing, and acceptance criteria.
When this applies
This task applies when an SOW is reviewed by internal audit, external consultants benchmarking project costs, or management teams assessing programme delivery, and those reviewers have no legitimate need to know the identities of the named delivery personnel or client contacts. According to the Data Protection Act 2018, organisations must be able to demonstrate a lawful basis for sharing personal data with third parties — a requirement that applies equally to project documents as to HR records.
How anonym.legal handles it
- Upload the SOW (and any change requests that amend it).
- The engine identifies all named individuals: project managers, delivery leads, client-side sponsors, and named approvers.
- Each individual is pseudonymised consistently across the SOW and any amendments.
- Deliverables, pricing, timeline, acceptance tests, and change-control procedures remain in clear text.
- A mapping table is produced with UK/EU data residency.
- Release the pseudonymised SOW for review; restore originals before execution.
What you provide
- Statement of Work
- Change requests or amendments naming individuals
- Project schedule or Gantt chart if it contains named resources
Limitations & cautions
- Project schedules in proprietary formats (e.g. .mpp) require export to PDF or XLSX before upload.
- The tool pseudonymises personal data but does not assess whether the SOW's acceptance criteria are commercially adequate. Claims for breach of an SOW executed as a simple contract are subject to a six-year limitation period under Limitation Act 1980 s.5 — document disputes promptly to preserve time-sensitive remedies.
FAQ
Is a Statement of Work treated differently from a services schedule?
Functionally they are very similar. An SOW is typically issued per engagement under a master contract, while a services schedule may be a standing exhibit. Both workflows are the same in anonym.legal — upload and process in a batch with the parent agreement.
Can I pseudonymise an SOW before it is countersigned?
Yes. The pseudonymised version is suitable for pre-signature review. Re-identify before countersigning so the executed version bears the correct legal names.
Does the tool handle SOWs with embedded approval-matrix tables?
Yes. Named approvers in table cells are detected and pseudonymised; approval-level descriptions and thresholds are preserved.
What limitation period applies to SOW disputes?
According to the Limitation Act 1980, simple contract claims must be brought within 6 years of the date of breach. Where an SOW is executed as a deed, the period extends to 12 years. Retain the mapping table for the full applicable period — many SOWs run under MSAs that are themselves executed as deeds, making the 12-year period the safer assumption for hundreds of cases.
How does the Unfair Contract Terms Act 1977 affect SOW liability clauses?
The Unfair Contract Terms Act 1977 restricts the ability of businesses to exclude or restrict liability for breach of contract. Liability caps and exclusion clauses in SOWs are preserved in clear text by anonym.legal; their legal validity requires specialist advice. Research shows that courts have struck down unreasonably broad exclusion clauses in thousands of commercial disputes since 1977.