Which data must be redacted? A DSGVO overview
The DSGVO obliges organisations to protect personal data. When documents are shared — for example during file inspection, access requests or publications — third-party personal data generally must be redacted. Exactly which data this concerns depends on the context, but the fundamentals are clearly regulated in the regulation.
What does redaction mean in the DSGVO context?
Redaction is the irreversible removal of text from a document. In contrast to deleting the entire document, the document is retained, but the personal data is physically removed. This is relevant when documents must be retained or shared for legal reasons but certain data within them must not be accessible.
The DSGVO does not explicitly call this "redaction"; instead it regulates the duty of data minimisation (Art. 5 Abs. 1 lit. c), the right to erasure (Art. 17) and the duty to implement technical and organisational measures (Art. 32). Redaction is one such measure.
These categories of data must be redacted
Not all data in a document is personal. The following table shows the most common data categories and their classification:
| Data category | Personal? | Redaction required? |
|----------|:----------------:|:------------------------:|
| First and last name | Yes | Yes |
| Email address | Yes | Yes |
| Telephone number | Yes | Yes |
| Residential address | Yes | Yes |
| IBAN / bank details | Yes | Yes |
| Social security number | Yes | Yes |
| Date of birth | Yes | Yes |
| Credit card number | Yes | Yes |
| IP address | Yes | Yes |
| File reference (with personal reference) | Yes | Yes |
| Health data | Yes (especially sensitive) | Yes |
| Job title | Context-dependent | Limited |
| Company name | No (legal entity) | No |
| Public address of an authority | No | No |
| Date without personal reference | No | No |
The basic rule: All data relating to an identified or identifiable natural person (Art. 4 Nr. 1 DSGVO) is personal and must be protected against unauthorised disclosure.
When is redaction legally required?
Redaction obligations arise from various legal bases:
Art. 15 DSGVO — Right of access: When a data subject requests access to their data, third-party data in the documents must be redacted before access is granted. The BFH clarified in 2025 that this right may not be refused on the grounds of excessive effort.
Art. 17 DSGVO — Right to erasure: When personal data must be deleted but the document must be retained for other legal reasons, redaction can be a suitable means.
IFG / Freedom of Information Act: Authorities must redact third-party personal data before releasing documents in response to freedom of information requests.
§ 203 StGB — Persons subject to professional secrecy: Lawyers, doctors, tax advisors and notaries are subject to a statutory duty of confidentiality. When sharing documents, they must redact data that falls under this duty.
Redaction vs. erasure — what is the difference?
Erasure means that the entire document or data records are permanently removed. Redaction means that the document is retained, but certain personal data contained within it is irreversibly removed.
In practice, redaction is often the better choice when:
- The document must be retained for legal reasons (e.g. invoices, contracts)
- Only certain data should be removed, while the rest remains relevant
- The document is shared in the context of file inspection or an access request
Automatic detection of personal data
Manual redaction of documents is error-prone and time-consuming. A black bar only visually masks the text — the text remains in the PDF and can be recovered by copying or in a text editor. A sample of publicly indexed PDFs (Essex Software, n=72) found that in roughly every sixth document (approx. 17 %) text remained selectable under the redaction. Automatic detection tools use a combination of:
- Rule-based patterns (regex): Detect IBANs, email addresses, telephone numbers, credit card numbers and social security numbers based on defined formats.
- Named Entity Recognition (NER): Machine-learning models identify proper names, places, organisations and other entities within the text context.
Datenmaske combines both approaches. The NER models are self-hosted on EU servers — no data is sent to US AI services such as OpenAI or Google. For scanned pages, Azure Document Intelligence (EU, Germany West Central region) is used under an Art. 28 DSGVO data processing agreement.
Practical tip: How to redact correctly
- Load the document into a redaction tool
- Start automatic detection of personal data
- Review each detection individually — do not confirm blindly
- Add manual redactions if data was overlooked
- Export the redacted document
- Verify that the redaction is irreversible (text must not be copyable)
Important: The DSGVO does not require you to redact every single data item. It requires you to observe data minimisation and to share only the data that is necessary for the respective purpose.
You can find more practical knowledge on DSGVO-compliant redaction in our detailed guide.
FAQ
Which data must be redacted under the DSGVO?
All personal data that is not necessary for the respective purpose: names, email addresses, telephone numbers, IBANs, addresses, social security numbers, dates of birth and credit card numbers. Health data and biometric data also fall under this (Art. 9 DSGVO).
Is redaction the same as erasure?
No. Erasure removes the entire document. Redaction removes only the personal data from the document, while the document itself is retained. Redaction is useful when the document must be retained for legal reasons.
When is redaction legally required?
Redaction is required for access requests (Art. 15 DSGVO), freedom of information requests (IFG), file inspection, the sharing of documents by persons subject to professional secrecy (§ 203 StGB) and whenever documents contain third-party personal data and are shared.
Can redacted PDFs be made visible again?
True redaction — where the text is physically removed from the PDF — is irreversible. However, if the text was only visually masked (e.g. by a black rectangle), it can be made visible again with simple means. Therefore use a tool that removes the text irreversibly.
How is personal data detected automatically?
Automatic detection uses rule-based patterns (regex for IBAN, email, telephone) and Named Entity Recognition (NER for names, places, organisations). The combination of both approaches offers a high detection rate; the user reviews and confirms each suggestion.