How to redact a PDF for GDPR

Article 4(1) defines personal data as information relating to an identified or identifiable natural person. Identifiable is doing the work in that sentence. It covers direct identifiers and also anything that lets someone single a person out, directly or indirectly, including reference to an identification number, location data, an online identifier, or factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

In a real document that pulls in more than you would list from memory:

• Names, initials, signatures, photographs
• Email addresses, phone numbers, postal addresses, IP addresses
• National ID numbers, passport numbers, tax numbers, employee numbers, case numbers
• Bank accounts, IBANs, card numbers, salary figures
• Dates of birth, hire dates, termination dates
• Job title plus department plus office, when the team is small enough that this is one person
• Free-text notes that describe someone precisely without naming them

That last pair is where most redactions fall short. “The regional manager who was on sick leave in March” identifies exactly one person to anyone inside the organisation. Recital 26 is explicit that you judge identifiability by the means reasonably likely to be used, by you or by anyone else, and the recipient’s own knowledge counts.

Swapping names for Employee A and Employee B feels like a solution. Under Article 4(5) it is pseudonymisation, and Recital 26 says pseudonymised data that could be attributed to a person using additional information is still personal data. It is still in scope, still needs a lawful basis, still counts in a breach.

Anonymous means re-identification is not reasonably possible for anyone. That is a high bar and consistent key-based substitution does not clear it, especially in a document where the pattern of who appears where does half the work.

If you are redacting to make a document safe to disclose, the standard is that the information cannot be recovered from the file you hand over. A black rectangle drawn over text leaves the text in the content stream, extractable by copy-paste. It is not a redaction, and a document redacted that way that reaches an unintended recipient is a personal data breach under Article 4(12) with the Article 33 notification clock running.

Three things have to be true of the exported file:

1. The visible text is gone from the content stream, not covered.
2. Metadata, annotations, comments, attachments, and any saved revision history are gone too.
3. Nothing outside the visible page area, such as the rest of a cropped image, still holds it.

Article 5(1)(c) says process what is adequate, relevant and limited to what is necessary. That is usually read as a rule about the content, but the processing itself counts.

If you upload an HR file to a web service to remove one salary figure, you have sent the entire document, every other person in it included, to a third party. You now need a lawful basis for that transfer, a processor agreement under Article 28, a record in your Article 30 register, and a view on where the servers are. All to delete one number.

Doing the work on the device the file already sits on removes the transfer. There is no processor, no agreement, no register entry, no transfer question, because nothing moved. That is not a technicality; fewer copies in fewer places is the most reliable privacy control there is.

Before you start, write down who receives this and what they already know. That decides how much has to go.

Work from the original file, not a scan of a print of it, so the text layer is intact and detection can help you. Use automatic detection to find candidates, then read the document yourself, because no rule set catches the sentence that describes a person without naming them.

Apply redactions with a tool that removes content, export, and reopen the exported file. Select the redacted regions and copy. Search for a name you removed. Check the document properties for an author, a title, or an original filename you did not intend to send. Strip them if they are there.

Then keep a note of what you removed and why. Article 5(2) makes you accountable for demonstrating compliance, and a short line in the case file is much easier than reconstructing your reasoning in ten months.

A scanned PDF has no text layer, so copy-paste finds nothing and the page looks safe. It isn’t. The pixels still show the name, and OCR turns them back into text in seconds.

Redacting a scan means the pixels have to change. If your tool burns the box into the image and rebuilds the page from the modified image, that works. If it draws a box over the image, you have the same problem with an extra step.

---

None of this is legal advice, and the line between adequate and inadequate redaction is a judgement call your DPO or counsel should make on the actual document. The mechanical part is not a judgement call: either the bytes are gone or they are not, and you can check that yourself in ten seconds.