DSGVO document check for SMEs: compliant in 3 steps

Many small and medium-sized enterprises (SMEs) know that the DSGVO applies — but practical implementation is where they struggle. Documents containing personal data are shared, stored or archived without protection. A systematic DSGVO document check provides a remedy. This article shows which documents must be reviewed and how to implement the process in three steps.

What is a DSGVO document check?

A DSGVO document check is the systematic review of all documents your company processes for personal data. The aim is to ensure that only the data that is necessary for the respective purpose is processed and shared — and that all other personal data is adequately protected or redacted.

The check covers three aspects:
1. Inventory: Which documents containing personal data exist?
2. Review: Which data is necessary for the respective purpose, which must be redacted?
3. Implementation: Automatic or manual redaction of the data that is not necessary.

Which documents must be reviewed?

Not all documents in a company contain personal data. The following table shows the most important document types and their relevance for the DSGVO check:

| Document type | Contains personal data? | Typical data | Review priority |
|-------------|:---------------------------------:|---------------|:------------:|
| Invoices | Yes | Name, address, IBAN, email | High |
| Contracts (rent, service, employment) | Yes | Name, address, IBAN, SS number | High |
| Personnel files | Yes | Name, SS number, health data, IBAN | Very high |
| Customer correspondence (email, letters) | Yes | Name, email, telephone, address | Medium |
| Bank statements | Yes | Name, IBAN, transfer partners | High |
| Authority mail (notices, decisions) | Yes | Name, file reference, address | Medium |
| Delivery notes | Limited | Name, address | Low |
| Meeting minutes | Limited | Names, possibly personal content | Medium |
| Marketing materials | Limited | Customer data in case studies | Low |
| Accounting records | Yes | Name, IBAN, tax number | High |

Particularly critical are document types that contain particularly sensitive data: personnel files with health data, bank statements with financial information and contracts with bank details.

The 3-step document check

Step 1: Upload — load documents into the review tool

Load the documents to be reviewed into an automated redaction tool. Datenmaske supports all common PDF formats, including scanned documents (via OCR recognition).

Tip: Start with the document types with the highest review priority — invoices, contracts, personnel files and bank statements. These contain the most sensitive data and should be reviewed first.

Step 2: Review — review and confirm detected data

Datenmaske automatically analyses the document and detects personal data:
- Names (first and last name) — via Named Entity Recognition
- IBANs — via regex pattern with check digit validation
- Email addresses — via regex pattern
- Telephone numbers — via regex pattern
- Addresses — via pattern recognition
- Social security numbers — via regex pattern

You review the proposed redactions individually: confirm the data that should be redacted and reject that which is necessary for the purpose. This human review is important — automatic detection is a tool, not a substitute for your own judgement.

Step 3: Export — export the redacted document

After the review, you export the redacted document. Datenmaske irreversibly removes all confirmed data from the PDF — the original text can no longer be reconstructed afterwards. At the same time, metadata, comments and bookmarks are sanitised.

The result: a document reduced to the respective purpose, with an audit log that traceably documents the reviewed redaction process. Whether sharing is permissible is still assessed by the controller.

How SMEs benefit from automation

Manual document checks are hardly feasible for SMEs. A medium-sized company processes dozens to hundreds of documents with personal data every day. Manually reviewing each individual document ties up personnel resources that are urgently needed elsewhere.

Automation offers concrete advantages:

• Time savings: Instead of 3–5 minutes per page, automatic review takes less than 10 seconds.
• Higher quality: AI-supported detection with check digit validation — every suggestion is approved by the user.
• Traceability: Automatic audit logs document every process.
• Consistency: Every document is reviewed according to the same standards.
• Scalability: From 10 to 10,000 documents — the process remains the same.

Cost comparison: manual vs. Datenmaske

| Cost factor | Manual check | Datenmaske |
|-------------|:---------------:|:----------:|
| Personnel costs (50 docs/month) | approx. EUR 1,500/month | from EUR 0 (Free plan) |
| Error rate | High | Low (user-reviewed) |
| Audit log | Create manually | Automatic |
| Risk of fines | High | Significantly reduced |
| Scalability | Limited | Unlimited |

The free Free-Check from Datenmaske allows you to check individual documents for personal data free of charge — ideal for getting to know the process before deciding on a plan.

Conclusion and next steps

A systematic DSGVO document check is not a luxury for small businesses, but a necessity. The three steps — upload, review, export — are done in minutes with the right tool. Start today by reviewing your most critical documents.