Practical notes on removing personal data from documents

Lawyers, letting agents, payroll offices and HR teams send documents to third parties every day. These notes explain where redaction usually goes wrong and what European rules actually ask for, with a source for every rule.

Why black boxes on a PDF often hide nothingDrawing a rectangle is not redaction. The text layer, metadata and scanned images that leak data after the box is drawn. Tenant files in France and Germany: what an agency may ask for and what to black outThe French closed list of documents and the German data protection authorities' guidance on income proof. Using AI on client documents: placeholders before the promptHow consistent placeholders let a model work on a document without receiving names, and where this sits in the GDPR.

The notes are maintained by the team behind Redactic, an EU-hosted tool for document redaction and protected AI chat. Corrections are welcome.