GDPR Redaction Checklist for 2026 (with Swiss FADP Notes)

GDPR has been in force since 2018, but enforcement keeps tightening. In 2024–2025, EU data protection authorities issued record fines for retention violations and excessive data sharing — much of which could have been prevented with proper redaction.

This checklist gives you a practical, 2026-current view of GDPR-aligned redaction, with notes for Swiss readers operating under the revised FADP.

The legal foundation

Two GDPR principles drive most redaction obligations:

Article 5(1)(c) — Data minimization: personal data must be "adequate, relevant and limited to what is necessary."
Article 5(1)(e) — Storage limitation: personal data must be kept in identifiable form "no longer than is necessary."

The Swiss FADP (Art. 6 al. 3 and Art. 6 al. 4) mirrors these almost exactly.

Redaction is one of the practical mechanisms for complying with both: when you can't legally delete a document but the PII is no longer needed, redacting it is the next-best option.

When redaction is required vs. recommended

Required (regulatory exposure)

Responding to a Data Subject Access Request (DSAR) where third-party data must be removed before disclosure
Sharing documents with processors under Article 28 DPA (minimum-necessary rule)
Cross-border data transfers with reduced PII surface
Retention beyond original purpose — e.g., keeping rejected applicant files for fair-process audit but removing identifiers

Recommended (risk reduction)

Sharing documents with third parties (banks, partners, auditors) — even when contractually authorized
Long-term archives — reduce breach blast radius
Analytics and training data — anonymized or pseudonymized at minimum
Internal sharing beyond the original need-to-know circle

A 7-point redaction checklist

1. Identify the legal basis for processing

Before redacting, document why you're keeping the rest of the file. Common bases: contract performance (Art. 6(1)(b)), legitimate interests (Art. 6(1)(f)), legal obligation (Art. 6(1)(c)).

This documentation matters: if a regulator later asks why you kept a redacted file at all, you need an answer.

2. Define what's "necessary" for each use case

Different recipients need different data. A bank needs proof of agent authority; a court needs party names; a research dataset needs zero identifiers. Don't apply one-size-fits-all redaction — define per-purpose policies.

3. Cover all standard PII categories

In a GDPR context, the standard "personal data" categories to consider:

Names
Postal addresses
Email and phone
Identifiers (passport, ID, AVS, fiscal number)
IBAN / credit card
Dates of birth
IP addresses (when linked to an identified person)
Photographs of identifiable faces

Tools like Redact PDF AI detect most of these automatically; institution-specific identifiers can be added to "Always Redact" terms.

4. Handle special-category data with extra care

GDPR Article 9 special categories: health, race, religion, political opinions, sexual orientation, trade union, biometric, genetic. These have stricter rules:

Generally prohibited to process without specific legal basis
Need enhanced consent or specific legal exemption
When archiving, redact aggressively — even an apparent inference (e.g., "patient seen at psychiatric clinic") can be special-category.

5. Use irreversible redaction

A PDF "redaction" that just draws a black box leaves the underlying text intact and recoverable. Under GDPR, this is not real redaction — the data is still there.

Real redaction:

Rasterizes the page (converts to image) before masking
Removes hidden text layers
Strips metadata referring to original content
Cannot be reversed by copy-paste, forensic tools, or PDF parsing

Always confirm your tool produces a flattened/rasterized output.

6. Document the redaction

For audit defensibility, log:

Which document was redacted
When
Who performed/authorized the redaction
What categories were redacted
Where the redacted copy is stored

Most tools, including Redact PDF AI, persist redaction masks so you can re-export with different decisions later — which itself is auditable.

7. Set a retention policy for redacted copies

Even after redaction, the file should have a defined lifecycle. Document:

How long the redacted copy is kept
When and how it's deleted
Who has access during retention

Swiss FADP specifics

The Swiss FADP (in force September 2023) is largely GDPR-equivalent but differs in important details:

No DPO requirement for most controllers (unlike GDPR's Art. 37)
Different breach notification window — "as soon as possible" rather than 72 hours
Specific Swiss identifiers to redact: AVS / NAVS13 (social security), residence permit numbers (B, C, L permits)
Data Subject Access Right under Art. 25 — recipients of DSARs in Switzerland may rely on this article rather than GDPR Art. 15

For Swiss organizations, the FADP applies primarily; GDPR may still apply for processing related to EU residents.

Tools that help

For at-scale redaction in a GDPR-aligned workflow, look for:

Automated PII detection across common European languages
OCR for scanned documents
Irreversible/rasterized output (not just black boxes)
EU or Swiss data residency for the processing pipeline
Audit trail of redaction decisions
No AI training on your documents

Redact PDF AI checks all these boxes: built on Microsoft Azure infrastructure (SOC 2 Type II, ISO 27001, GDPR-compliant) with Swiss / EU data residency, AES-256 encryption at rest, TLS 1.2+ in transit, and no AI training on customer documents.

Get started

Try the free demo on redact-pdf.ai or browse our topic guides for category-specific tips.