Redacting documents — legal requirements and practice

Redacting documents is an effective yet frequently misunderstood data protection measure. Used correctly, it can support a permissible disclosure without unnecessarily revealing third-party personal data. A black bar over the text, however, often creates only a false sense of security. This article explains what "redacting documents" means, which legal bases need to be reviewed and how to set up a traceable process.

Short answer: Redacting documents correctly means irreversibly removing text from the PDF — not just visually masking it with a black bar. During redaction, all personal data that is not necessary for the respective purpose is physically deleted from the content stream and the metadata is completely sanitised.

What does "redacting documents" mean?

Redaction means the irreversible removal of text from a document, so that the original content can be restored neither visually nor technically. Unlike deleting the entire document, the document itself is retained, but the personal data it contains is physically removed — the document is, as it were, freed of its sensitive contents.

Common use cases are access requests under Art. 15 DSGVO, file inspection under the Administrative Procedure Act, IFG requests for access to information, the sharing of documents by persons subject to professional secrecy (doctors, lawyers, tax advisors, notaries) or the publication of reports and expert opinions.

The central legal principle: data minimisation. Anyone who shares documents may only reveal the data that is really necessary for the respective purpose (Art. 5 Abs. 1 lit. c DSGVO). All personal data beyond that — in particular that of third parties — must be removed before sharing, i.e. redacted.

Legal bases: When must documents be redacted?

Several legal provisions establish an obligation to redact documents. The most important:

Art. 5 Abs. 1 lit. c DSGVO — data minimisation. Personal data must be adequate and relevant for the purpose and limited to what is necessary for processing. Anyone who shares documents and reveals more data than necessary breaches this principle.

Art. 17 DSGVO — right to erasure. The data subject may request the immediate erasure of their personal data. If the entire document must be retained for other reasons — for example due to commercial or tax-law retention periods — redaction is the appropriate way to fulfil the erasure claim without breaching the retention obligation.

Art. 25 DSGVO — data protection by design. Controllers must already ensure during the design of procedures that only the necessary data is processed. Redaction is one such "built-in" protective measure.

§ 203 StGB — breach of private secrets. Persons subject to professional secrecy (doctors, dentists, psychologists, lawyers, tax advisors, auditors, notaries, pharmacists and others) may not unauthorisedly reveal confidential information entrusted to them. When sharing documents with third parties, they must reliably redact the data subject to professional secrecy, otherwise they render themselves liable to prosecution.

IFG — Freedom of Information Act. The federal Freedom of Information Act (IFG) and the corresponding state laws grant everyone access to official information. § 5 IFG obliges authorities to protect the worthy-of-protection interests of third parties — in particular their personal data — by redaction before documents are released.

In summary: anyone who shares documents containing third-party personal data — authorities, companies, persons subject to professional secrecy — generally must redact them beforehand, insofar as the data is not necessary for the respective purpose.

Which data must be redacted?

Fundamentally all third-party personal data that is not necessary for the respective purpose. The most common data categories in practice:

• Names (first and last name) and initials
• Contact details (email addresses, telephone numbers, residential addresses)
• Bank details (IBAN, BIC, credit card numbers)
• Social security numbers and ID card numbers
• Dates of birth and nationality
• Health data (diagnoses, sick notes, therapy plans) as a special data category under Art. 9 DSGVO
• File references with personal reference
• IP addresses and other online identifiers

For documents subject to professional secrecy under § 203 StGB, even stricter standards apply: client information, patient data or client secrets may not be disclosed to third parties at all, unless the data subject has released them.

The big mistake: black bar instead of true redaction

The most common mistake when redacting documents is mere visual masking. Users place a black bar over the text in a PDF editor and believe the spot has been redacted. In reality, the original text remains fully intact in the content stream of the PDF file and can be restored with simple means: by copying with Ctrl+C, by opening it in a text editor such as Notepad, or by removing the graphics layer in professional PDF tools.

A sample of publicly indexed PDFs found that in roughly every sixth document (approx. 17 %) text remained selectable under the manual redaction. The well-known AstraZeneca report also showed the problem: the text bodies were correctly redacted, but the PDF bookmarks contained the original text in plain text — a much-cited textbook example of overlooked metadata.

Legally as well as technically, visual masking is not redaction. The DSGVO requires effective measures (Art. 32 DSGVO) — anyone who relies on a bar has not fulfilled this duty.

Manual vs. automatic redaction

Manual redaction, in which an employee individually marks and redacts each text passage, is error-prone, slow and expensive. Above all with longer documents or larger document volumes, data is overlooked. Moreover, different employees redact differently — quality depends on the person.

Automatic redaction tools combine rule-based patterns (regex) with Named Entity Recognition (NER):

• Regex patterns detect IBANs (DE + 20 digits, plus check digit according to ISO 13616), email addresses, telephone numbers, credit card numbers and social security numbers based on defined formats.
• NER models detect proper names, i.e. persons, places and organisations, from the text context.

An employee then reviews each suggestion individually and confirms or rejects it. This combination of machine and human is significantly more reliable than pure manual work — the AI finds data that a human overlooks, the human prevents false alarms that a machine produces.

Step by step: redacting documents correctly

1. Upload document. Load the PDF into a redaction tool. Scanned pages are processed into text via OCR.
2. Start automatic detection. The tool identifies personal data — names, IBANs, email addresses, telephone numbers, addresses, social security numbers.
3. Review each suggestion individually. Confirm only what is not needed for the respective purpose. Do not accept blindly.
4. Also sanitise metadata. Comments, bookmarks, PDF properties and hidden layers can also contain personal data — the AstraZeneca case is the textbook example.
5. Add manual redactions if data was overlooked.
6. Test the redaction. Select the spot and try to copy the text — if no text appears, the redaction was irreversible.
7. Save the audit log. Document what was redacted, when, by whom and why — this is the basis for the accountability principle under Art. 5 Abs. 2 DSGVO.

With the Datenmaske Free-Check you can redact a PDF free of charge — automatically, without registration, irreversibly.

Which documents are typically redacted

• Bank statements for the Jobcenter, landlord or social provider
• Invoices before sharing with uninvolved parties
• Personnel files during file inspection by the works council or third parties
• Contracts (tenancy agreements, employment contracts, service contracts) with IBANs and other contact data
• Authority mail in the context of IFG requests or file inspection
• Medical records when sharing with insurance or employer
• Court documents before publication or sharing

The same principle applies everywhere: process only the data that is really necessary for the respective purpose, and irreversibly remove the rest.

Redaction vs. anonymisation vs. pseudonymisation

These three terms are often confused, but mean different things:

• Redaction: Certain text passages are irreversibly removed from the document, the document itself is retained.
• Anonymisation: Data is altered in such a way that personal identifiability can no longer be established by any means (Art. 4 Nr. 5 DSGVO). In contrast to redaction, anonymisation usually alters the data rather than removing it.
• Pseudonymisation: Identifiers are replaced by pseudonyms (e.g. "Patient 4711"). Allocation is still possible with additional knowledge, therefore pseudonymised data is still considered personal.

Redaction is the safest variant, because the data is completely removed — no allocation remains possible.

Conclusion: redacting documents done right

Redacting documents is a core discipline of practical data protection. A process that is reviewed on a technical and legal basis can enable permissible disclosures, protect third parties and take retention obligations into account. Mistakes such as mere bars, remaining metadata or missing documentation, by contrast, increase the risk of data leaks and data protection breaches.

The basic rules in brief: remove text irreversibly instead of just covering it up, consistently capture third-party personal data, also sanitise metadata, document every redaction operation. Automatic tools such as Datenmaske take over the laborious detection without replacing human review. Further details on the practical approach can be found in the article Redacting documents correctly and in the detailed DSGVO guide to redaction.