File inspection and redaction: obligations and practice
File inspection is a fundamental right in Germany. Citizens, journalists and organisations can request access to official documents from authorities. But with the duty to grant access comes the duty to redact: before documents are released, third-party personal data must be redacted. This guide explains the legal basis and shows how the process works in practice.
What is file inspection?
File inspection (also: access to official files) grants citizens the right to view official documents. The legal basis depends on the context:
- Freedom of Information Act (IFG): Grants everyone access to official information of federal authorities. Similar laws exist at state level (LIFG).
- Art. 15 DSGVO: Grants data subjects the right to obtain information about the personal data concerning them.
- Administrative Procedure Act (VwVfG): Regulates file inspection in ongoing administrative proceedings.
- Social Code (SGB): Regulates file inspection in social law.
Why must authorities redact documents?
Authorities may not simply release all documents unfiltered during file inspection. They must protect the rights of third parties — in particular their right to informational self-determination. The redaction obligation arises from:
- Art. 5 DSGVO (data minimisation): process only the data necessary for the purpose
- Art. 32 DSGVO (technical and organisational measures): appropriate measures for data protection
- IFG § 5: protection of personal data when providing information
The Lower Saxony Data Protection Commissioner (LfD Niedersachsen) makes this clear: "Often a text passage is only visually masked and can still be read." True redaction must physically remove the text.
IFG and freedom of information
The federal Freedom of Information Act (IFG) grants everyone — even without a personal interest — a right of access to official information. Since September 2025, a new freedom of information act has also applied in Austria, tightening the redaction obligation for Austrian authorities.
For IFG requests, authorities must in particular redact:
- Names of private individuals
- Contact details (email, telephone, address)
- Social security numbers and dates of birth
- Health data
- Tax matters
- Trade and business secrets of third parties
Which data must be redacted during file inspection?
The following overview shows the most common data categories and their redaction obligation during file inspection:
Always redact:
- Names and contact details of private individuals who are not the applicant
- Social security numbers
- Health data and medical findings
- Bank details (IBAN, BIC)
- Credit card numbers
- Data of minors
- Information about criminal proceedings of third parties
Redact depending on context:
- Names of authority employees (depending on role and context)
- Internal notes and statements
- File references with personal reference
Do not redact:
- Names of office holders in their official capacity
- Publicly accessible information
- The applicant's own data
The manual process — and why it is not sufficient
In practice, many authorities still redact documents manually. This means: an employee reads the document, identifies personal data and redacts it individually. For document volumes of hundreds or thousands of pages, this process is:
- Time-consuming: Hours or days per request
- Error-prone: Data is overlooked, especially in long documents
- Inconsistent: Different employees redact differently
- Expensive: Personnel costs for manual processing
The Lower Saxony Data Protection Commissioner points out that there are "no tests by independent institutions or recommendations from data protection authorities" for redaction tools. Automation can remedy this.
Automating redaction — best practice
Modern redaction tools can significantly accelerate the process:
- Upload document: Load the PDF into the tool
- Automatic detection: The tool identifies personal data using regex patterns and NER (Named Entity Recognition)
- Human review: An employee reviews the suggestions and confirms or rejects them
- Export: The redacted document is exported
- Logging: An audit log documents the entire process
Datenmaske was developed precisely for this workflow: automatic detection, human review, irreversible redaction and complete logging. The NER models run self-hosted on EU servers; no data is sent to US AI services such as OpenAI or Google. Try the automatic redaction free of charge.
Do not forget metadata
A common problem with file inspection: the document is correctly redacted, but the PDF metadata still contains personal data. This can affect:
- PDF properties (author, creation date)
- Comments and annotations
- Bookmarks — the AstraZeneca case showed that bookmarks can reveal redacted text
- Hidden layers and attachments
A complete redaction process must also sanitise the metadata.
FAQ
What does file inspection mean?
File inspection grants citizens the right to view official documents. The legal bases are the Freedom of Information Act (IFG), Art. 15 DSGVO and the Administrative Procedure Act (VwVfG). The authority must redact third-party personal data before release.
Which data must be redacted during file inspection?
All third-party personal data: names, contact details, social security numbers, bank details, health data and data of minors. The applicant's own data is not redacted.
Is merely masking text sufficient?
No. The Lower Saxony Data Protection Commissioner makes clear: 'Often a text passage is only visually masked and can still be read.' True redaction must irreversibly remove the text from the PDF.
How can authorities automate redaction?
Automatic redaction tools detect personal data using regex patterns and Named Entity Recognition (NER). An employee reviews the suggestions, confirms or rejects them, and the tool exports the irreversibly redacted PDF with an audit log.
Why must metadata also be redacted?
PDF metadata can contain personal data: author names, comments, bookmarks. In the AstraZeneca case, bookmarks revealed redacted text. A complete redaction process also sanitises the metadata.