What Does GDPR Require for Redaction?

GDPR does not contain a specific "redaction" article, but it requires redaction in three practical situations: when responding to a data subject access request that involves third-party personal data, when sharing or disclosing documents externally, and when applying data minimization principles to retained records. Personal data covers any information that identifies a person directly or indirectly, which is broader than the U.S. concept of PII and includes things like IP addresses, employee IDs, and online identifiers.

When GDPR redaction obligations arise

Three common triggers:

1. Subject Access Requests (Article 15): when a person requests their data, the controller must provide it. If the records also contain other people's personal data, the third-party data must be redacted unless those other people consent or an exception applies.
2. Cross-border transfers: documents leaving the EU need redaction or pseudonymization to satisfy adequacy decisions and transfer mechanisms under Articles 44-50.
3. Data minimization (Article 5(1)(c)): personal data should be limited to what is necessary for the processing purpose. Records retained beyond the original purpose often need redaction to comply.

What constitutes personal data under GDPR

Article 4(1) defines personal data broadly: any information relating to an identified or identifiable natural person. This includes name, ID number, location data, online identifier (IP address, cookies, device IDs), and one or more factors specific to physical, physiological, genetic, mental, economic, cultural, or social identity. Special categories under Article 9 (race, religion, political opinion, health, sexual orientation, biometric, genetic) get additional protection and stricter redaction obligations.

Penalties for failed redaction

GDPR fines can reach 4% of global annual revenue or €20 million, whichever is higher, for serious violations. Disclosure of personal data without proper redaction can trigger Article 83 penalties as well as Article 82 individual damages claims. Practical enforcement has emphasized completeness: partial redactions that leave identifiable fragments have been treated as full disclosures.