Why GDPR matters when sharing documents
GDPR applies to any processing of personal data relating to EU data subjects. “Processing” includes storing, transmitting, or making accessible any document that contains names, email addresses, ID numbers, location data, or any other information that could identify a person.
When your organization shares, publishes, or sends a document to a third party, you are performing a transfer of personal data. If that document contains more personal data than is necessary for the purpose of the transfer, you may be in breach of GDPR's data minimization principle (Article 5(1)(c)).
Redaction — permanently removing the personal data that is not needed for the specific transfer — is the standard technical measure for addressing this obligation.
GDPR principles relevant to document redaction
Art. 5(1)(b) — Purpose limitation
Personal data may only be used for the specific purpose for which it was collected. When sharing a document for a new purpose (e.g., research, litigation, a third-party audit), personal data not relevant to that purpose should be removed.
Art. 5(1)(c) — Data minimization
Only the personal data that is necessary for the stated purpose may be processed. If you share a contract with a supplier to verify payment terms, the names and addresses of uninvolved third parties in that contract are not necessary — they should be redacted.
Art. 5(1)(e) — Storage limitation
Personal data should not be retained longer than necessary. Redacting copies of documents shared with external parties limits the propagation of personal data beyond its original retention scope.
Art. 25 — Privacy by design
Data controllers must implement technical measures to apply data minimization proactively. Establishing a redaction workflow before sharing documents is a concrete implementation of privacy by design.
Art. 44–49 — International transfers
Transfers of personal data to countries outside the EU/EEA require an adequacy decision or appropriate safeguards. If the redacted document no longer contains personal data at all, the transfer rules no longer apply to it — but see below on what it takes for a document to be truly anonymous.
Data minimization in practice: one document, three recipients
Article 5(1)(c) does not say which fields to remove; it says to keep only what is “adequate, relevant and limited to what is necessary” for the purpose. The same document therefore gets redacted differently depending on who receives it and why. Take an employee's expense claim with its receipts:
The useful question is not “what is personal data here?” but “what does this recipient need to do their job?” Everything else is a candidate for redaction.
Subject access requests: redacting other people's data (Art. 15)
Article 15 gives a person the right to a copy of the personal data you hold about them. The documents that hold it — e-mail threads, meeting notes, HR files, complaint records — almost always mention other people too: colleagues, witnesses, customers, the author of a report.
Article 15(4) sets the limit: the right to obtain a copy “shall not adversely affect the rights and freedoms of others”. In practice that makes redaction the normal way to answer an access request, and it cuts both ways:
- Redact third parties whose data the requester is not entitled to: names, contact details, opinions about them, their own identifiers.
- Do not withhold the whole document when redacting part of it would protect the others. The European Data Protection Board's guidelines on the right of access treat Article 15(4) as a reason to limit what is disclosed, not to refuse the request.
- Weigh each case. A colleague's name on a routine e-mail and a witness's statement in a grievance file do not call for the same answer. Some information about others is already known to the requester; some would expose someone to real harm.
- Do not over-redact the requester's own data. Their name, their statements and the opinions recorded about them are what they asked for.
A workable sequence
- Collect every document that contains the requester's data. The default deadline is one month (Art. 12(3)).
- For each document, mark the third-party data and decide: disclose, or redact.
- Record the reason for each redaction — you may have to explain it to the requester or to a supervisory authority.
- Redact permanently, then run the copy test on the exported file before it goes out.
- Send the redacted copies, with a note that third-party information has been removed.
Anonymization vs pseudonymization under GDPR
GDPR draws a sharp distinction between these two techniques. The choice matters for what obligations apply to the resulting document.
Redaction does not make a document anonymous by itself. Recital 26 sets the test: a person must no longer be identifiable by any means “reasonably likely to be used” — by you or by anyone else. A document can lose every name and still point to one person:
- Indirect identifiers left in: a job title in a small team, a rare diagnosis, a date and a place.
- Context the reader already has: the requester of a grievance file knows who the witnesses were.
- Consistent replacements: “Employee A” throughout a file, with a list of who A is kept somewhere, is pseudonymization.
Black-box redaction with no mapping kept is the strongest starting point — there is no code to reverse. Whether the result is anonymous in the GDPR sense still depends on what is left on the page and who will read it.
The audit report is a re-identification key
RedactOffline's audit report (Premium) lists every redacted value in clear, so you can check nothing was missed. While you keep it, you hold the means to put the data back — so in your hands the redacted document is pseudonymized, not anonymized. Keep the report internal, never send it with the document, and delete it once the check is done if you do not need it.
Common scenarios requiring redaction under GDPR
Sharing contracts with third-party auditors
Redact names and personal identifiers of parties not relevant to the audit scope. Retain only the clauses being audited.
Responding to subject access requests (SAR)
Redact personal data of third parties appearing in the same documents — the right of access does not extend to other people's data (Art. 15(4)). See the section above.
Publishing research or case studies
Anonymize all personal identifiers in source documents before use. Pseudonymization is not sufficient for public publication.
Cross-border data transfers
Redact personal data before transferring documents to processors in non-adequate third countries, where removal takes the document outside transfer restriction scope.
Internal HR file archiving
When archiving documents beyond their retention period, redact personal data that is no longer needed to satisfy storage limitation obligations.
How local processing supports GDPR workflows
The act of redacting a document using an upload-based online tool creates its own data protection risk: you are sending the unredacted document — containing all the personal data you intend to remove — to a third-party server.
That transfer may itself require a Data Processing Agreement under GDPR Article 28. The server operator becomes a processor of the personal data in your document, with all associated obligations (security measures, sub-processor audits, deletion guarantees).
RedactOffline processes documents entirely within the user's browser. The document never leaves the device. As a result, RedactOffline does not act as a data processor under GDPR — no Article 28 agreement is required, and no personal data is transferred to our infrastructure. The redaction workflow itself generates no new GDPR obligations for your organization.
Redaction checklist for data controllers
- 1Identify the purpose of the transfer and what personal data is strictly necessary for that purpose.
- 2Redact all personal data not necessary for the stated purpose (names, ID numbers, email addresses, phone numbers, dates of birth, bank details).
- 3Redact personal data of third parties not party to the transfer (witnesses, referenced individuals, bystanders).
- 4For an access request: keep the requester's own data, redact only what would affect others, and record why.
- 5Check for indirect identifiers — job titles, dates, places — before calling the result anonymous.
- 6Verify redactions are permanent — not just visual overlays (use the select-and-copy test).
- 7Check PDF metadata: author, revision history, and keyword fields may still contain personal data.
- 8Document your redaction decisions in case of a supervisory authority inquiry.
- 9If using an online tool: confirm the tool does not upload your document to a server, or review the Data Processing Agreement.
Legal disclaimer: This guide provides general information about GDPR and document redaction practices. It does not constitute legal advice. GDPR compliance depends on your organization's specific context, the nature of the data processed, and the applicable national implementations. Consult your Data Protection Officer or legal counsel for guidance specific to your situation.
Redact documents without creating new GDPR obligations
Local processing only. No upload. No Data Processing Agreement needed. Free plan available.
Start Redacting For Free