Redacting documents for a GDPR access request
Under the UK and EU GDPR, people can ask an organisation for a copy of the personal data it holds about them. This is a subject access request, or SAR. The copies usually include emails, notes and reports that also mention colleagues, customers or other third parties, and those parts need redacting before release.
This guide is general information, not legal advice.
What to redact
- Third-party personal data. Names, contact details and opinions about other people, unless they agree to disclosure or it is reasonable to share without their consent.
- Information covered by an exemption, such as legal privilege, or data whose release would prejudice crime prevention.
- Content unrelated to the requester, where a long document is only partly about them.
Do not redact the requester's own data, even if it is unflattering. Their name, their opinions and opinions about them are what the request is for.
Deadlines
A response is due within one calendar month of receiving the request. It can be extended by up to two further months for complex or numerous requests, as long as the requester is told within the first month.
A workflow that scales
- Collect the documents and remove duplicates, such as the same email in several mailboxes.
- Run each file through the matching tool: PDF, Word, Excel or text for email exports.
- Untick findings that belong to the requester. Add colleagues' names under "Always redact" so they are caught everywhere.
- Use "Replace with label" in Word and text files where the reader needs to know a person was mentioned, such as [NAME].
- Keep a log of what was redacted in each document and why. Regulators may ask for it if the requester complains.
Checks before release
- Search each output for the third parties' names.
- Check attachments inside emails, not only the email body.
- Make sure the files cannot be un-redacted. See why black boxes in PDFs fail.