A genuine customer review contains someone else's private information

Isolate the exposure without destroying the record

Unpublish or hide the item promptly while it is assessed, since the exposed person has an interest that does not wait for your process. At the same time, preserve the original review in full in restricted storage: the author, date, product, complete text, and where it appeared. You need the original because every later step — redaction, author contact, a dispute — depends on what was actually said, and because your moderation record must show you did not quietly alter the substance.

Identify what the private information is and whose it is. A third party's name, contact details, or order references belong to someone other than the reviewer, and the reviewer may have had no right to publish them. Categorize the exposure without copying the values into your working notes; the log needs the category and location, not another copy of the data.

Apply the published policy by its terms, not by the review's tone

The moderation decision should come from your published policy: most honest policies already prohibit publishing other people's private information, and that clause applies identically to a five-star and a one-star review. Under the UK ICO's articulation of data minimisation, published personal information should be limited to what the purpose requires; a review's purpose does not require a third party's private details. That is UK guidance under review, and the legal obligations in your jurisdiction need qualified confirmation, but the editorial principle stands on its own.

The countervailing risk is suppression. FTC guidance on consumer reviews addresses deceptive practices including suppressing negative reviews, and a privacy removal that happens to land only on unfavorable reviews will look like exactly that. Your protection is the record: the same clause, applied the same way, to every review, with the original preserved. If the review is favorable and contains the same exposure, it gets the same treatment.

Choose redaction, removal, or author resubmission

Where the policy and the tool allow it, redacting only the private information preserves the review's meaning and is usually the least disruptive option. Where the private information is load-bearing — the review cannot be understood without it — removal with an invitation to resubmit may be the honest route. What is not available is rewriting the review yourself: edited words must remain the customer's words, and any redaction should not change the claims, sentiment, or rating the review expresses.

Record any notice to the author: what was removed or hidden, which policy clause applied, and how they can resubmit. Notice matters because a silently vanished review teaches the author that moderation is arbitrary. If the author disputes the decision, the dispute goes to the policy owner named in your moderation process, not to ad hoc negotiation.

Close the loop and check for pattern risk

Log the disposition, the approver, the date, and the republication state, and keep the original and the log together under restricted access. If the exposed person's information spread beyond the review — quoted in a reply, captured in a screenshot, syndicated by a widget — each location is a separate cleanup item with its own owner, and the exposed person's further remedies are a question for qualified advice, not for this process.

If your published policy does not actually cover third-party private information, that gap is a policy correction for the owner, applied prospectively and consistently. A Prism website-review consultation can include how your review policies and displays are presented; agree the pages, scope, fees and terms before work. Well-handled moderation is an honest-records practice, not a legal finding about any individual review.

Review privacy-handling log

One entry per affected review. Record categories and references, never the private values. The same policy clause must produce the same outcome for favorable and unfavorable reviews; if it would not, the process is not ready and the decision goes to the owner.

Worksheet entries are not submitted by Prism’s worksheet and are not saved by the site. Use record types, availability, anonymized observations, or match/mismatch results. Do not enter government identifiers, customer names or addresses, customer messages, receipt-access links, card or bank details, passwords, or keys. Send sensitive documents only through the provider’s verified secure channel.

These are temporary notes. Leaving or reloading this page may clear them. Worksheet entries are not sent automatically. If you copy notes into the consultation message and submit the form, Prism receives them as part of your request.