Redacting personal data
Find and mask names, emails, IDs and more before sharing a file, with presets for GDPR, HIPAA, and legal discovery.
BigXL lets you easily find and hide sensitive information in your files. This feature prevents you from accidentally sharing personal data.
Opening it
Click Redact in the main toolbar. This opens the redaction panel where you can choose what to hide.
Presets
BigXL includes presets to help you comply with common regulations. The app scans your sample data and column headers to recommend the best preset. Detected columns are checked by default. You can uncheck any columns you do not want masked.
GDPR detects EU personal data. This includes names, email addresses, phone numbers, and dates of birth. It also finds postal addresses, IP addresses, MAC addresses, IBAN bank accounts, credit card numbers, and national ID numbers.
HIPAA detects the 18 identifiers covered by the HIPAA Safe Harbor standard (45 CFR 164.514). This includes patient and doctor names, clinical dates, medical record numbers, and contact details. It also finds Social Security numbers and account numbers. It applies special rules for HIPAA. Ages 90 and over are masked to ‘90+’. Dates are truncated to the year only. For 3-digit ZIP prefixes from the 17 low-population areas listed in the regulation, the app replaces them with ‘000**’.
Legal detects data relevant to litigation discovery under the Federal Rules of Civil Procedure. This includes attorney-client communications (FRCP 26(b)(5)) and work product (FRCP 26(b)(3)). It also finds settlement records (FRE 408), Social Security and Tax IDs (FRCP 5.2(a)(1)), minor names (FRCP 5.2(a)(3)), and financial account numbers.
Custom lets you pick columns yourself for anything the presets do not cover.
What it can detect
Each detector validates the actual value in the cells. It does not just look at the column name. A column called ‘id’ that happens to hold something else will not be flagged by mistake. BigXL can detect the following data types.
Email addresses finds standard email formats. Phone numbers detects international and local phone numbers. Credit card numbers validated with the Luhn algorithm. Social Security numbers identifies US SSN formats. IBAN bank accounts validated with mod-97. Aadhaar numbers validated with the Verhoeff algorithm. UK National Insurance numbers finds UK identifiers. IP addresses detects both IPv4 and IPv6 formats. MAC addresses finds standard network interface addresses. Person names identifies common human names. Dates of birth finds birth date fields. Admission or discharge dates identifies medical dates. Postal addresses finds street addresses and ZIP codes.
Masking modes
You can choose how you want to hide the data.
Keep domain masks an email but keeps the domain (a****@site.com). Keep last 4 digits masks a number but shows the last four digits (1111). Keep initials masks a name but shows initials (J D). Keep year only masks a date but keeps the year (1987--). Keep network masks an IP but keeps the network part (192.168..). Consistent hash replaces the value with a keyed SHA-256 hash. The same input always produces the same hash. You can still join masked datasets or count frequencies. The hash is irreversible. Keep first character shows only the first letter. Date shift shifts a date by a random but consistent number of days. The shift can be up to 14 days. The shift is the same for each record so date differences within a record are preserved. 3-digit ZIP prefix shows only the first three digits of a ZIP code (123). Age brackets groups ages into 10-year brackets (30-39). Ages 90 and over become ‘90+’ per HIPAA rules. Full redaction replaces the entire value.
Non-destructive masking
Masking applies to what you see on screen and what you export. Your source file is never changed. Any mask can be undone from the Timeline. Enterprise policies can make masks irrevocable if required by your organization.
Privilege log
The Legal preset can export a privilege log alongside the redacted file. The privilege log is a CSV file. It records what was masked, which columns were affected, and the legal basis for each redaction. This is used in litigation to document what was withheld and why.
Saving a privacy scan
Choose Privacy > Save privacy scan to write a short report of what BigXL recognised as personal data in the file as it currently stands.
The report lists each column it flagged, what kind of personal data it appears to hold, and whether that column is currently masked. It also records the file name, row count, the time of the scan and the BigXL version.
The report contains no values from your file. Column names and counts only. This is what makes it useful before sharing: you can send the scan itself to a compliance reviewer, a client or a manager who is not cleared to see the underlying data.
The report states plainly that what BigXL recognised is not a guarantee that nothing else in the file is personal. It makes no claim of regulatory compliance. Treat it as a checklist for a human decision, not as a clearance.
This differs from the compliance certificate, which documents an export that has already happened. The privacy scan describes the file as it sits now, before you decide anything.
Leak guard on export
When you export a file, BigXL scans the output for any unmasked data. It looks for anything that looks like personal information. If it finds something, it warns you before writing the file. This catches cases where you forgot to mask a column.