DPOs and Compliance Teams: How to Write a Redaction Procedure
A redaction procedure for DPOs and compliance teams: the roles, approved tools, the verification routine, and what to log after a mistake.
A redaction procedure turns a one-off scramble into a routine everyone can follow. It names which documents get masked, who masks them, who checks the result, and what happens if a mistake gets out. Without a written procedure, every request is reinvented from scratch, and reinvention is exactly where a name slips through.
This guide follows the EU GDPR, with UK, French and German pointers, as of September 2026. It is not legal advice. Check the rule that applies to your exact case with your data protection officer or counsel.
When does a document actually need a redaction procedure?
A procedure earns its keep whenever a document with other people's data is about to leave your organisation. That covers six recurring situations, and each one has its own reader and its own risk. Write the procedure once, then point every new request at it.
- A subject access request under the GDPR: the requester gets their own file, not everyone else's data inside it.
- A freedom of information or public records request: the reader is the public, not just one person.
- Litigation or disclosure to the other side: the evidence goes out, not every name that happens to be on it.
- Publication: a report, a research paper or a press release built from real internal files.
- Sharing with a vendor, auditor or software provider: they need the layout or the numbers, not the people.
- Feeding a document into an AI tool: the model reads whatever you paste in, so paste less.
Who does what: requester, redactor, checker and approver?
Four roles keep a redaction honest. One person asks, one masks, a different person checks, and someone signs off. The approver is also who decides what stays disclosable when a rule is unclear, so that call never falls on the redactor alone.
| Role | What they actually do |
|---|---|
| Requester | Names the document, the reader and the deadline. Says why the document is needed. |
| Redactor | Applies the masks on a copy, following the rule set for that type of document. |
| Checker (four-eyes) | A different person from the redactor. Reopens the exported file and tries to find what should be hidden. |
| Approver | Signs off that the document may leave. Decides what stays visible when the rule is unclear. |
Which tools are approved, and which methods are banned?
Two kinds of tool actually remove data: dedicated redaction software that deletes the underlying text, and an export that flattens the page into an image. A word processor's strikethrough, a drawn shape, or a generic image editor were not built for this. They keep failing in the same three ways.
| Method | Why it fails |
|---|---|
| A black rectangle drawn over text in a PDF viewer | The rectangle sits on top of the text. Copying the page, or opening it in another viewer, can still reveal what is underneath, the UK's ICO warns. |
| Highlighter or marker on a printed page | Held up to a light, or scanned at high contrast, marker over print can still be read, a German data protection authority has found. |
| Cropping or a white box over a scan | A white box or a crop does not always remove the data underneath. A German data protection authority warns against redacting in track-changes mode, since an older version can sometimes be reconstructed from the file. |
A procedure can name ONYRI Sanitize as an approved tool for PDF, Word and scans. It runs inside the browser, so the file never leaves the machine, and it shows a Detected data list the checker can review. A page that cannot be read blocks the export until someone masks it by hand and confirms, instead of shipping it unmasked. Its limit: shared rules, roles and logs for teams are not ready yet, so the four-eyes check and the log stay in your own process.
What does the verification routine actually check?
Checking is not proofreading. It is trying to break your own redaction before someone else does. The checker works from the exported file, never the working copy, and never signs off on their own masks.
- Reopen the exported file, not the working copy, and read it from the first page to the last.
- Select all the text and paste it into a blank document. Nothing sensitive should appear.
- Search the file for the names, numbers or terms the redactor meant to hide.
- Open the file's properties and comments. Converting to PDF does not remove old metadata by itself, US guidance on redaction has warned since 2005.
- Sign the log: document ID, date, redactor, checker, outcome, never the values that were masked.
What happens after a redaction fails?
A missed redaction that reaches its recipient is usually a personal data breach. Article 33 of the GDPR gives a controller 72 hours to notify the supervisory authority once the organisation becomes aware of it. That duty falls away only when the exposure is unlikely to be a risk to the people involved.
Article 34 adds a separate duty: tell the people themselves, in plain language, when the risk is high. That covers cases like a bank detail or a health record getting out. Even when notification is not required, Article 33 still asks you to document the breach. Write down the facts, its effects and what you did about it.
A one-page procedure you can adapt
Keep the routine short enough that someone can follow it under pressure. Adapt the roles to your team's size, then keep the sequence.
| Step | Who | Action |
|---|---|---|
| 1. Receive | Requester | Log the request, the reader and the deadline. |
| 2. Choose the rules | Approver | Pick which categories must be masked for this situation. |
| 3. Redact | Redactor | Mask a copy in the approved tool. Never touch the original. |
| 4. Check | Checker | Reopen the export. Search it, select all, check the properties. Alone. |
| 5. Approve | Approver | Sign off, or send it back with what is missing. |
| 6. Send | Requester or owner | Share only the flattened export, on the agreed channel. |
| 7. Log | Checker and approver | Record who did what and when. Never the masked values. |
Frequently asked questions
Do we need a written procedure if only two or three people handle these requests?
Yes. A procedure is not about the size of the team, it is about never letting the redactor be the only check. In a team of three, the second reviewer can be a colleague from another desk. The only rule: it cannot be the person who made the masks.
Can the person who redacted the document also check it?
Better not. The ICO recommends a peer or senior review of redactions before release. That is because the person who made the masks is the worst placed to spot what they missed. Keep the redactor and the checker as two different people.
What goes in the log if a redaction mistake happens?
Article 33(5) of the GDPR asks for the facts of the breach, its effects and the remedial action taken. That applies whether or not you had to notify a regulator. Log the document, the date, who was affected and what you did next. Never log the exposed values themselves.
Does drawing a black box in a PDF viewer count as redaction?
No. The ICO explicitly warns against covering electronic text with black rectangles and leaving the text underneath. A drawn box, a highlighter on a printout, and a cropped scan all fail the same way: the data is hidden, not removed. Use dedicated redaction software or a flattened export instead.
Sources & references
- How do we avoid an accidental breach when redacting information?Information Commissioner's Office (ICO), UK
- Hinweise zum Schwärzen von Dokumenten (July 2025, in German)Landesbeauftragte für den Datenschutz Niedersachsen
- Redacting with Confidence: How to Safely Publish Sanitized Reports Converted From Word to PDF (NSA guidance, December 2005)Federation of American Scientists (hosting NSA guidance)
- Regulation (EU) 2016/679 (GDPR), Article 33: Notification of a personal data breach to the supervisory authoritygdpr-info.eu
- Regulation (EU) 2016/679 (GDPR), Article 34: Communication of a personal data breach to the data subjectgdpr-info.eu