Redacting IBANs in PDFs — automatic and DSGVO-compliant

The IBAN (International Bank Account Number) is one of the most sensitive personal data items in business documents. Together with the account holder's name, it enables the unambiguous identification of a person and their bank account. Anyone who shares PDFs containing IBANs without redacting them breaches the DSGVO. This article shows why IBAN redaction is mandatory, how it works automatically and how to implement it in practice.

What is an IBAN?

The IBAN (International Bank Account Number) is an internationally standardised account number that has been mandatory for transfers in Germany since 2014. A German IBAN consists of 22 characters:

• Country code: DE (for Germany)
• Check digits: 2-digit (e.g. 89)
• Bank code: 8-digit
• Account number: 10-digit (padded with leading zeros)

Example: DE89 3704 0044 0532 0130 00

Why is the IBAN personal data?

The DSGVO defines personal data as all information relating to an identified or identifiable natural person (Art. 4 Nr. 1 DSGVO). The IBAN clearly falls into this category, because:

• It is assigned to a specific person (account holder)
• In combination with the name, it enables identification
• Even on its own it can contribute to identification (e.g. via the bank code and account number)

Supervisory authorities classify the IBAN as personal data. It is therefore subject to all DSGVO protection provisions — including the obligation to redact it when sharing documents.

When must you redact IBANs?

IBANs must be redacted when documents are shared and the IBAN is not necessary for the respective purpose. Typical scenarios:

Bank statements: If you submit a bank statement as proof of income, your own IBAN and the IBANs of transfer partners do not necessarily have to be visible — provided account identification is possible by other means.

Invoices: Invoices often contain the IBAN of the invoice issuer and the recipient. When archiving or sharing with third parties, IBANs should be redacted if they are not relevant to the recipient.

Contracts: Tenancy agreements, employment contracts, service contracts — IBANs for payment processing are found everywhere. When sharing with uninvolved third parties, these must be redacted.

Personnel files: IBANs of employees for salary transfers have no place in personnel files that are shared with unauthorised persons.

How does automatic IBAN detection work?

Automatic detection of IBANs in PDFs is based on rule-based patterns (regex). For German IBANs, the detection pattern is:

• Starts with "DE" followed by 20 digits
• Total length: 22 characters
• Check digit validation according to ISO 13616 (modulo-97 procedure)

Datenmaske uses this pattern to automatically identify IBANs in PDFs — regardless of formatting (with or without spaces, in tables, in running text or in form fields). In addition to German IBANs, all other European formats are also supported (AT, CH, FR, NL, etc.).

Automatic detection process:

1. PDF is analysed and text is extracted with position information
2. Regex patterns search for IBAN formats in the entire text
3. Found IBANs are confirmed by check digit validation
4. The position of the IBAN in the document is marked as a redaction area
5. The user reviews the suggestions and confirms the redaction

Step by step: redacting IBANs with Datenmaske

Step 1 — Upload document: Load the PDF document into Datenmaske. All common PDF formats are supported, including scanned documents (via OCR).

Step 2 — Automatic detection: Datenmaske analyses the document and automatically marks all detected IBANs. In addition, other personal data such as names, email addresses and telephone numbers are detected.

Step 3 — Review results: Review the proposed redactions. You can confirm or reject each detection individually. Add manual redactions if an IBAN was overlooked.

Step 4 — Export: Export the redacted PDF. The IBANs are irreversibly removed from the document — they are neither copyable nor visible after removing graphics layers.

Step 5 — Create log: Datenmaske automatically creates an audit log documenting which data was redacted, when and by whom.

Manual vs. automatic — the comparison

| Criterion | Manual redaction | Automatic redaction (Datenmaske) |
|-----------|--------------------:|:--------------------------------------|
| Detection rate | Manual, error-prone | AI-supported + reviewed |
| Time per page | 3–5 minutes | < 10 seconds |
| Error rate | High | Low — user-reviewed |
| Check digit validation | No | Yes |
| Audit log | Create manually | Automatic |
| Consistency | Variable | Standardised |
| Metadata sanitisation | Often forgotten | Automatic |
| DSGVO compliance | Uncertain | Verifiable |

Conclusion

IBANs are personal data and must be redacted when sharing documents if they are not necessary for the purpose. Manual redaction is error-prone and time-consuming. Datenmaske automatically detects IBAN patterns, permanently removes confirmed hits and documents the process. The controller reviews detection, legal basis and result before sharing.

You can redact IBANs in your PDF free of charge — with the Datenmaske Free-Check.