Subject access requests: how to redact other people's data

When you answer a subject access request, you give the person a copy of their own personal data. Under Article 15(4) GDPR, that copy must not adversely affect the rights and freedoms of others. So you mask what identifies other people when disclosure would really harm them, hand over everything else, and write down why.

Picture Jane Example. She asks her former employer for her data. Her file holds an email thread in which a colleague complains about her. Jane has a right to what it says about her. The colleague has rights too. This is general information, not legal advice, as of September 2026.

What do Articles 15(3) and 15(4) GDPR say?

EU: Article 15(3) says the controller shall provide a copy of the personal data undergoing processing. Further copies may cost a reasonable fee. Article 15(4) then sets the limit.

The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. (Article 15(4) GDPR)

Recital 63 names trade secrets, intellectual property and software copyright as examples. It adds a safeguard: the result should not be a refusal to provide all information to the data subject. Article 15(4) lets you take parts out. It does not let you keep the whole file.

What do the EDPB guidelines say about other people's data?

The European Data Protection Board (EDPB) adopted its Guidelines 01/2022 on the right of access on 28 March 2023. Section 6.2 covers Article 15(4). The key points:

• Others means any person or entity apart from the requester. It can include the controller itself, for example for its trade secrets.
• A general concern is not enough. The controller must be able to demonstrate that, in the concrete situation, rights would in fact be affected.
• Three steps: check for a real adverse effect, try to reconcile the rights (for example by masking), then decide which right prevails.
• Information about others is rendered illegible as far as possible, instead of refusing to provide a copy.
• Article 15(4) does not apply to the information about the processing in Article 15(1), such as purposes or recipients.

What is typically redacted, and what can you not withhold?

What do national authorities add?

UK: under the Data Protection Act 2018, the ICO describes three steps. Can you comply without revealing information that identifies someone else? Has that person consented? If not, is it reasonable to disclose anyway? You weigh the type of information, any duty of confidentiality, and any refusal.

France: for work emails, the CNIL says to try deleting, anonymising or pseudonymising third-party data first, and to refuse only if that is not enough. Germany: the BfDI says controllers may not, as a rule, refuse entirely. They must, for example, black out third persons' names. Section 29(1) of the Federal Data Protection Act (BDSG) also exempts information that must be kept secret, in particular for a third party's overriding legitimate interests.

How do you handle the redaction, step by step?

1. Collect. Search every system that holds the person's data: HR files, email, chat, CRM, paper.
2. Review. Mark what is the requester's data, what concerns others, and what may be a trade secret.
3. Redact. Work on a copy, never the original. Mask only what the balancing justifies. Replace a name with a neutral label such as Colleague A, so the text stays readable.
4. Verify. Have a second person check. Try to select and copy text under each mask. Check comments and metadata.
5. Log. Record what you masked, why, who decided and when. Keep the unredacted and redacted versions, clearly labelled.

The ICO warns that text covered by a simple black rectangle remains in the electronic file, and can be revealed by copying and pasting. Use a tool that removes the content. As of September 2026, Adobe's documentation says the Redact tool, available in Acrobat Pro, Premium and Studio, permanently removes information, and that sanitizing removes comments, metadata and hidden layers.

A browser-based option: ONYRI Sanitize masks a PDF, a Word file or a scan without uploading it, and exports flattened pages with no text layer. No detector finds everything. Review each item by hand.

The log is your proof. Article 5(2) GDPR requires the controller to be able to demonstrate compliance. The ICO adds: you must be able to justify your decision to disclose or withhold, so keep a record of what you decide and why.

What are the deadlines?

EU: Article 12(3) requires an answer without undue delay and in any event within one month of receipt. That period may be extended by two further months where necessary, given the complexity and number of requests. You announce the extension, with reasons, within the first month. The EDPB counts the need to redact other people's information among the factors that can make a request complex. A large effort alone does not.

According to the EDPB, if you refuse all or part of a request under Article 15(4), Article 12(4) applies. Without delay, and within one month at the latest, you give the reasons and mention the right to complain to a supervisory authority and to seek a judicial remedy. The EDPB wants reasons tied to the concrete circumstances. Plan backwards: redaction and review can take days.

Frequently asked questions

Sources & references