GDPR-compliant
PDF redaction
Everything you need to know about traceable redaction of PDF documents: legal foundations, methods compared, and a step-by-step guide for practice.
RELEVANT GDPR ARTICLES
What is GDPR-compliant redaction?
GDPR-compliant redaction refers to the irreversible removal of personal data from PDF documents, so that it can be recovered neither visually nor technically. In contrast to mere visual overlay — such as a black bar — the text is physically removed from the PDF file.
The General Data Protection Regulation (GDPR) obliges companies, authorities and organisations to protect personal data. When documents are passed on to third parties — whether in response to information requests, file inspection, authority enquiries or internal processes — third-party personal data must be reliably removed.
A GDPR-compliant redaction must meet three criteria: it must be irreversible (no recovery possible), it must be complete (all relevant data was captured) and it must be documented (audit log as proof of compliance).
AT A GLANCE
- Irreversible removal of text
- No copying or recovery possible
- Automatic detection of 20+ data types
- Audit log for GDPR proof
- EU servers in Germany
- GDPR Art. 5, 17, 25, 30, 44
Laws and standards for PDF redaction
The obligation to redact personal data arises from several legal foundations. Here you will find the most important standards at a glance.
Data minimisation
Personal data must be adequate, relevant and limited to what is necessary for the purposes of processing. Data that is not required must be deleted or anonymised.
Right to erasure
The data subject has the right to demand that the controller erase the personal data concerning them without undue delay. When documents are passed on to third parties, third-party personal data must be redacted beforehand.
Data protection by design
The controller must implement appropriate technical and organisational measures that ensure only such personal data are processed as are necessary for the respective purpose. Redaction is one such measure.
Record of processing activities
Every controller and every processor must maintain a record of all their processing activities. The documented redaction of documents forms part of this evidence.
Data transfers to third countries
Personal data may only be transferred to a third country if an adequate level of protection is ensured. Through redaction, documents can be prepared in such a way that a transfer becomes legally unobjectionable.
Professional secrecy holders
Lawyers, doctors, tax advisors and other professional secrecy holders may not unauthorisedly disclose third-party secrets. Redacting confidential data in documents is a necessary measure to uphold this duty.
Freedom of Information Act
The Freedom of Information Act grants everyone access to official information. Protected interests such as third-party personal data must be protected by appropriate redaction (IFG Section 5).
Which data must be redacted?
The GDPR defines personal data as any information relating to an identified or identifiable natural person (Art. 4 (1) GDPR). The following table shows the most important data types that must be detected and redacted in documents.
| Data type | Examples | Category |
|---|---|---|
| Names | First and last names, company names | Identifier |
| Email addresses | max.mustermann@example.de | Contact data |
| Phone numbers | +49 170 1234567, (030) 1234-5678 | Contact data |
| Addresses | Street, postal code, city, PO box | Contact data |
| IBAN | DE89 3704 0044 0532 0130 00 | Financial data |
| Social security number | 12 345678 A 123 | Identifier |
| Date of birth | 01.01.1990 | Identifier |
| Credit card numbers | 4111 1111 1111 1111 | Financial data |
| Health data | Diagnoses, sick notes, therapy plans | Special category (Art. 9) |
| IP addresses | 192.168.1.1, 2001:db8::1 | Online identifier |
Genuine vs. fake redaction
Not every redaction is the same. The difference between genuine and fake redaction can decide between GDPR compliance and hefty fines.
Fake redaction (visual overlay)
- Black bar over the text
- Text remains in the PDF file
- Text can be copied and searched
- Reconstructable with simple tools
- No GDPR compliance
- Fine risk up to EUR 20 million
Example: you place a black bar over a name in Adobe Acrobat. The name remains visible in the PDF text stream — any text editor reveals it.
Genuine redaction (irreversible removal)
- Text is physically removed from the PDF
- No text beneath the redaction
- No copying or searching possible
- Recovery ruled out
- Traceably documented
- Complete audit log
Example: Datenmaske physically removes the text via MuPDF (applyRedactions). In a text editor no name is visible any more — the redaction is irreversible.
Manual vs. automatic redaction
The comparison shows: automatic redaction is not only faster and cheaper, but also faster and better documented.
| Criterion | Manual | Automatic (Datenmaske) |
|---|---|---|
| Time required | 30–120 min per document | < 2 min per document |
| Error rate | High (data is overlooked) | Low (AI + user review) |
| Cost | EUR 40–80/hour staff | from EUR 0 (Starter plan) |
| Audit log | Manual documentation required | Captured automatically |
| GDPR compliance | Hard to prove | Fully documented |
| Consistency | Depends on the employee | Always identical quality |
| Scalability | Linearly growing effort | Any number of documents |
GDPR redaction in 5 steps
With Datenmaske you prepare PDF documents in a few minutes — verifiably and irreversibly. This is how the process works.
Upload PDF document
Upload your PDF document — via drag & drop or file selection. Datenmaske supports any number of pages and documents up to 50 MB. The file is stored encrypted on EU servers in Germany.
Review automatic detection
The AI-powered detection analyses the document and automatically identifies personal data: names, email addresses, IBANs, phone numbers and more than 10 other data types. You see all findings at a glance.
Confirm redaction suggestions
Review each suggestion individually and confirm or reject it. You retain full control over which data is redacted and which is not. Confidence scores help with the assessment.
Carry out irreversible redaction
With one click the irreversible redaction is carried out. The text is physically removed from the PDF file — not just visually hidden. There is no way to recover the data.
Export redacted PDF
Download the redacted PDF. A complete audit log documents the entire process for your GDPR file. The original document is automatically deleted after 30 days.
For whom is GDPR redaction relevant?
GDPR redaction is relevant for all organisations that process personal data in documents. The following industries are particularly affected.
Law firms
For professional secrecy holders we are preparing Datenmaske Secure — the edition for § 203-compliant processing. Join the waitlist now.
Learn morePublic authorities
Public bodies must safeguard third-party interests during IFG information requests and file inspection. The redaction of personal data is required by law.
Learn moreHR departments
HR departments process particularly sensitive data: salaries, sick notes, performance reviews. When passed on to third parties, this data must be reliably redacted.
Learn moreHealthcare
Doctors, hospitals and clinics process health data in accordance with Art. 9 GDPR. These special categories of data require particularly careful redaction.
Learn moreQuestions about GDPR redaction
What does GDPR-compliant redaction mean?
GDPR-compliant redaction means that personal data in a PDF document is removed irreversibly and traceably. The text is physically deleted from the document, not just visually hidden. In addition, the process must be documented (audit log) in order to prove compliance with the GDPR requirements.
Which data must be redacted under the GDPR?
All personal data within the meaning of Art. 4 (1) GDPR: names, email addresses, phone numbers, addresses, IBANs, social security numbers, dates of birth, credit card numbers, health data and IP addresses. Particularly worthy of protection are the so-called special categories of data under Art. 9 GDPR, such as health data, religious or political views.
Is it enough to place a black bar over the text?
No. A black bar (visual overlay) only hides the text optically. The underlying text remains in the PDF file and can be copied, searched or made visible again with simple tools. Only the irreversible removal of the text from the PDF file counts as secure redaction.
Who is responsible for the redaction?
Under Art. 4 (7) GDPR, the controller (usually the company or authority that creates or processes the document) is responsible for correct redaction. In processor relationships, the processor must act in accordance with Art. 28 GDPR. For professional secrecy holders, Paragraf 203 StGB additionally applies.
How does redaction differ from anonymisation?
In redaction, personal data is irreversibly removed from the document. In anonymisation, the data is altered in such a way that it can no longer be attributed to a specific person. Pseudonymisation replaces identifiers with pseudonyms, whereby an attribution remains possible. Redaction is considered particularly secure because the data is removed completely.
Is there an obligation to document the redaction?
Yes. Under Art. 5 (2) GDPR, compliance with the data protection principles must be demonstrable (accountability principle). This means you must document which documents were redacted, which data was removed, when the process took place and by whom. An audit log is therefore indispensable.
How can I check whether a redaction is truly irreversible?
Open the redacted PDF in a text editor or use the text search in the PDF reader. If the redacted terms can no longer be found and no text is visible beneath the black areas, the text has been irreversibly removed. Professional tools such as Datenmaske guarantee this irreversible removal through MuPDF-based physical text deletion (applyRedactions, content stream removal).
Is Datenmaske suitable for authorities, HR and healthcare?
Datenmaske supports authorities and HR with verifiable redaction processes. For health data and professional secrets, an additional review is required; the web TOM do not cover §-203 content. For this, Datenmaske Secure with local processing is intended.