Redaction vs. Anonymization

Redaction and anonymization are often used synonymously in everyday language, but they have different legal meanings. Redaction is a technical process: parts of a document are made illegible by permanently removing the text and replacing it with an opaque area. Anonymization within the meaning of the GDPR means that personal data is altered in such a way that it can no longer be attributed to a natural person — neither on its own nor in combination with other data.

The GDPR also distinguishes between anonymization and pseudonymization. In pseudonymization, the data is altered so that it can no longer be attributed to a person without additional information (the key). Pseudonymized data is still considered personal data within the meaning of the GDPR. Only when attribution is irreversibly precluded is it considered true anonymization — and the GDPR no longer applies.

Datenmaske performs a technical redaction that irreversibly removes the text from the PDF. Depending on the context, this redaction can amount to anonymization within the meaning of the GDPR — namely when all identifying features have been removed. The redaction log documents which data was removed, thereby supporting legal defensibility.