@@ -320,6 +320,14 @@ Should submission anonymization be enabled. Allows for both manual anonymization
 
 ----
 
+Should form authors be able to mark application form fields as containing personally identifiable information (PII). Answers to marked fields are only shown to the applicant, their co-applicants and staff.
+
+See [here](pii-fields.md) for more information.
+
+    PII_FIELD_MARKING_ENABLED = env.bool("PII_FIELD_MARKING_ENABLED", False)
+
+----
+
 ## Slack settings
 
     SLACK_TOKEN = env.str('SLACK_TOKEN', None)
 
@@ -0,0 +1,94 @@
+# Marking form fields as personal information
+
+Application forms often ask for details that identify the applicant personally —
+a phone number, a home address, a date of birth. Hypha lets you mark those
+questions so that only the people who genuinely need the answers can read them.
+
+Set `PII_FIELD_MARKING_ENABLED=True` to turn the feature on.
+
+## Marking a field
+
+With the setting enabled, the question blocks in the form builder (Wagtail
+Admin → "Apply" → "Forms") gain a **"Personal information"** checkbox. Tick it
+on any question whose answer will contain personally identifiable information.
+A few blocks do not have the checkbox, see
+[Questions without the checkbox](#questions-without-the-checkbox) below.
+
+The checkbox is empty by default, so no existing question changes behaviour when
+you turn the feature on.
+
+## Who can see the answers
+
+Answers to marked questions are shown to:
+
+ * the applicant who created the submission
+ * the co-applicants invited to that submission
+ * staff (and staff admins)
+
+Everyone else — including reviewers, external reviewers and community reviewers
+— sees the question, but the answer is replaced with "Hidden — contains personal
+information." Keeping the question visible means reviewers can still tell what
+was asked and that an answer exists.
+
+Staff also see a small "(PII)" marker after the label of each marked question,
+so they can tell at a glance which answers are restricted. Applicants and
+co-applicants do not see the marker.
+
+## Questions without the checkbox
+
+The built-in required fields (Title, Full name, E-mail, Address, Organization
+name, Requested funding and Duration) do not have the checkbox, because they are
+rendered separately from the rest of the answers and so are never redacted.
+Applicant identity in those fields is controlled separately by
+[`HIDE_IDENTITY_FROM_REVIEWERS`](configuration.md).
+
+The **"Group fields"** block — the question that reveals or hides a group of
+other questions — does not have the checkbox either, so the choice made on it is
+always shown to reviewers. Marking it would achieve little on its own: the
+toggle decides whether the questions inside the group are answered at all, so an
+empty group tells the reader which way it was set. Mark the questions *inside*
+the group instead, which is where the personal information is given.
+
+## Other forms
+
+The checkbox appears on application forms only. Review, determination, project
+(PAF and SOW) and report forms do not have it, since their answers are not
+redacted.
+
+## Turning the feature off again
+
+Setting `PII_FIELD_MARKING_ENABLED=False` hides the checkbox in the form builder
+but does **not** un-hide fields that have already been marked. This is
+deliberate: turning the setting off should never silently expose information
+that was marked as personal. To make an answer visible again, turn the setting
+back on and untick the checkbox on that question.
+
+Note that changing a form only affects submissions made from then on. Each
+submission stores its own copy of the form it was filled in with, so existing
+submissions keep the marks they were submitted with.
+
+For the same reason, a form definition copied or imported from an instance
+where the feature was on arrives with its marks intact, and answers to those
+questions are redacted even though the checkbox is not on offer. Turn the
+setting on if you need to see or change which questions are marked.
+
+## Limitations
+
+Answers are indexed for search regardless of whether they are marked, so a
+search by a reviewer can still match on the text of a hidden answer. The search
+results themselves only show submission titles, never the matched answer.
+
+Redaction applies to the submission page and everywhere the answers are shown on
+it, including the answers panel embedded in the review and determination forms.
+
+Redacting a file or image answer removes the attachment, and with it the
+download link, from the page. It does not revoke access to the file itself: a
+link to it obtained some other way — pasted into a comment, or kept from before
+the question was marked — still works for anyone who can view the submission.
+The link contains the internal id of the question, which is never shown for a
+redacted answer, so it cannot be guessed.
+
+The other places answers appear are restricted to staff already, so nothing is
+redacted there: the submission PDF download, the revision comparison view, and
+CSV exports (the last also governed by `SUBMISSIONS_EXPORT_ACCESS_STAFF` and
+`SUBMISSIONS_EXPORT_ACCESS_STAFF_ADMIN`).
@@ -99,17 +99,35 @@ def prepare_data(self, value, data, serialize):
         data = category.options.filter(id__in=data).values_list("value", flat=True)
         return data
 
-    def render(self, value, context):
-        # Overwriting field_label and help_text with default for empty values
+    def get_display_value(self, value):
+        # Fall back on the category's own name and help text for empty values.
         category_fields = {"field_label": "name", "help_text": "help_text"}
 
-        for field in category_fields.keys():
-            if not value.get(field):
-                category = value["category"]
-                if isinstance(category, int) or isinstance(category, str):
-                    category = self.get_instance(id=category)
-                value[field] = getattr(category, category_fields[field])
-        return super().render(value, context)
+        missing = [field for field in category_fields if not value.get(field)]
+        if not missing:
+            return value
+
+        # Look the category up once, however many fields fall back on it.
+        category = value["category"]
+        if isinstance(category, int) or isinstance(category, str):
+            category = self.get_instance(id=category)
+
+        defaults = {
+            field: getattr(category, category_fields[field]) for field in missing
+        }
+
+        # Return a copy, so that the fallbacks are never written back to the
+        # stored form definition.
+        block = getattr(value, "block", None)
+        if block is None:
+            display_value = dict(value)
+        else:
+            display_value = value.__class__(block, value.items())
+        display_value.update(defaults)
+        return display_value
+
+    def render(self, value, context):
+        return super().render(self.get_display_value(value), context)
 
     def get_searchable_content(self, value, data):
         return None
 
@@ -8,13 +8,30 @@
 from wagtail import blocks
 
 from hypha.addressfield.fields import ADDRESS_FIELDS_ORDER, AddressField
-from hypha.apply.categories.blocks import CategoryQuestionBlock
+from hypha.apply.funds.pii_blocks import (
+    PIICategoryQuestionBlock,
+    PIICharFieldBlock,
+    PIICheckboxesFieldBlock,
+    PIICheckboxFieldBlock,
+    PIIDateFieldBlock,
+    PIIDateTimeFieldBlock,
+    PIIDropdownFieldBlock,
+    PIIFileFieldBlock,
+    PIIImageFieldBlock,
+    PIIMarkdownTextFieldBlock,
+    PIIMultiFileFieldBlock,
+    PIIMultiInputCharFieldBlock,
+    PIINumberFieldBlock,
+    PIIRadioButtonsFieldBlock,
+    PIIRichTextFieldBlock,
+    PIITextFieldBlock,
+    PIITimeFieldBlock,
+)
 from hypha.apply.stream_forms.blocks import FormFieldsBlock
 from hypha.apply.users.models import User
 from hypha.apply.utils.blocks import (
     CustomFormFieldsBlock,
     MustIncludeFieldBlock,
-    RichTextFieldBlock,
     SingleIncludeBlock,
 )
 from hypha.apply.utils.templatetags.apply_tags import format_number_as_currency
@@ -272,8 +289,34 @@ class Meta:
 
 
 class ApplicationCustomFormFieldsBlock(CustomFormFieldsBlock, FormFieldsBlock):
-    category = CategoryQuestionBlock(group=_("Custom"))
-    rich_text = RichTextFieldBlock(group=_("Fields"))
+    """The form fields available when building an application form.
+
+    The fields that hold an answer are overridden with the variant that can be
+    marked as personal information, see `hypha.apply.funds.pii_blocks`. Two
+    kinds of field are left out. The built-in fields (title, email, ...) are
+    rendered on their own rather than as part of the answers, so marking one
+    would have no effect. The group toggle keeps the plain block because the
+    questions it reveals give away the choice made on it either way; the answers
+    worth marking are the ones inside the group.
+    """
+
+    char = PIICharFieldBlock(group=_("Fields"))
+    multi_inputs_char = PIIMultiInputCharFieldBlock(group=_("Fields"))
+    text = PIITextFieldBlock(group=_("Fields"))
+    number = PIINumberFieldBlock(group=_("Fields"))
+    checkbox = PIICheckboxFieldBlock(group=_("Fields"))
+    radios = PIIRadioButtonsFieldBlock(group=_("Fields"))
+    dropdown = PIIDropdownFieldBlock(group=_("Fields"))
+    checkboxes = PIICheckboxesFieldBlock(group=_("Fields"))
+    date = PIIDateFieldBlock(group=_("Fields"))
+    time = PIITimeFieldBlock(group=_("Fields"))
+    datetime = PIIDateTimeFieldBlock(group=_("Fields"))
+    image = PIIImageFieldBlock(group=_("Fields"))
+    file = PIIFileFieldBlock(group=_("Fields"))
+    multi_file = PIIMultiFileFieldBlock(group=_("Fields"))
+    rich_text = PIIRichTextFieldBlock(group=_("Fields"))
+    markdown_text = PIIMarkdownTextFieldBlock(group=_("Fields"))
+    category = PIICategoryQuestionBlock(group=_("Custom"))
     required_blocks = ApplicationMustIncludeFieldBlock.__subclasses__()
     single_blocks = ApplicationSingleIncludeFieldBlock.__subclasses__()
 
 
@@ -18,6 +18,7 @@
     ApplicationRevision,
     ApplicationSubmission,
 )
+from hypha.apply.funds.pii_blocks import unmarked_block_class
 from hypha.apply.review.blocks import (
     RecommendationBlock,
     RecommendationCommentsBlock,
@@ -86,13 +87,17 @@ def update_text_data():
                 else:
                     update_data(self.f.text(len(data)))  # noqa: B023
 
+            # Application form fields are the PII-markable subclasses of the
+            # blocks below, so compare against the block each one extends.
+            block_class = unmarked_block_class(form_field.block)
+
             if form_field.value["field_label"].lower() == "organization name":
                 update_data(self.f.company())
             elif form_field.value["field_label"].lower() == "contact phone number":
                 update_data(self.f.phone_number())
             elif (
                 form_field.value["field_label"].lower() == "organization address"
-                or type(form_field.block) is AddressFieldBlock
+                or block_class is AddressFieldBlock
             ):
                 try:
                     address = json.loads(data)
@@ -124,35 +129,35 @@ def update_text_data():
                 update_data(self.f.ssn())
             elif form_field.value["field_label"].lower() == "additional contact email":
                 update_data(self.f.email())
-            elif type(form_field.block) is FullNameBlock:
+            elif block_class is FullNameBlock:
                 update_data(self.f.name())
-            elif type(form_field.block) is EmailBlock:
+            elif block_class is EmailBlock:
                 update_data(self.f.email())
-            elif type(form_field.block) is TitleBlock:
+            elif block_class is TitleBlock:
                 update_data(self.f.sentence(5))
-            elif type(form_field.block) is MultiFileFieldBlock:
+            elif block_class is MultiFileFieldBlock:
                 update_data([])
-            elif type(form_field.block) is RecommendationBlock:
+            elif block_class is RecommendationBlock:
                 update_data(random.choice(RECOMMENDATION_CHOICES)[0])
-            elif type(form_field.block) is ScoreFieldBlock:
+            elif block_class is ScoreFieldBlock:
                 update_data(random.choice(RATE_CHOICES)[0])
-            elif type(form_field.block) is ScoreFieldWithoutTextBlock:
+            elif block_class is ScoreFieldWithoutTextBlock:
                 update_data(
                     random.randint(form_field.value["min"], form_field.value["max"])
                 )
-            elif type(form_field.block) is DropdownFieldBlock:
+            elif block_class is DropdownFieldBlock:
                 update_data(random.choice(form_field.value["choices"][1]))
-            elif type(form_field.block) is ValueBlock:
+            elif block_class is ValueBlock:
                 update_data(random.randint(0, 10000000))
-            elif type(form_field.block) in [
+            elif block_class in [
                 TextFieldBlock,
                 CharFieldBlock,
                 RichTextFieldBlock,  # This may need to be updated sometime in the future
                 RecommendationCommentsBlock,
             ]:
                 update_text_data()
             elif (
-                type(form_field.block)
+                block_class
                 in [
                     RadioButtonsFieldBlock,  # If it's a radio button, then it doesn't really need to be randomized
                     CheckboxFieldBlock,  # Similar to above
@@ -166,9 +171,7 @@ def update_text_data():
                 print(form_holder.id)
                 print(form_field.value["field_label"])
                 print(data)
-                raise Exception(
-                    "Don't know how to handle " + str(type(form_field.block))
-                )
+                raise Exception("Don't know how to handle " + str(block_class))
         form_holder.save()
 
     def handle(self, *args, **options):