Subject access request redaction: what to cover

Answering a subject access request means giving a person a copy of their own data, often inside emails, case notes or contracts that also name other people. Subject access request redaction is the step in between. You cover what belongs to someone else, you record why, and you leave everything else readable. Here is what the GDPR asks, what the UK regulator adds, and how to do it without uploading the file.

What the requester is entitled to: a copy (Art. 15(3))

Article 15 of the GDPR gives a person the right to know whether you process their personal data, and to access it. Article 15(3) adds: “The controller shall provide a copy of the personal data undergoing processing.”

The right is to the data, not to the documents it sits in. The UK’s data protection regulator, the ICO, puts it plainly in its right of access guidance: “As you are obliged to provide information rather than documents, you could delete names or redact documents if the third party’s information does not form part of the requested information.” The guidance is written for the UK GDPR, whose Article 15 matches the EU text.

Other people in the same document (Art. 15(4))

Article 15(4) sets the limit: “The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.”

In the UK, the rule is spelled out in the Data Protection Act 2018, Schedule 2, paragraph 16. You don’t have to disclose information that identifies another individual. That changes if the other person has consented, or if it is reasonable to disclose it without their consent.

Covering a name is not always enough. The ICO’s example is a complaint about a neighbor: even with the neighbor’s name redacted, the requester will likely still know who it is. Read each passage the way the requester will read it.

Subject access request redaction: cover third-party data, record why

The ICO is clear about the record: “You must be able to justify your decision to disclose or withhold information about another person, so you should keep a record of what you decide and why.”

In Dress Docs, that record is part of the work:

• A reason on each cover. Print why a passage is covered, such as “third party” or your own wording, on the cover itself. See how to justify redactions.
• The redaction log. It records covers, reasons, pages and date, with no document content, so you can file it with the request. See the redaction log.
• Search and cover. A colleague named forty times in an email thread? Search for the name in a PDF with a text layer and review every match before it is covered.

All three are in Pro. The document stays on your device the whole time.

Don’t cover more than you must

Redaction protects other people; it is not a way to answer less. The ICO says you “must still provide as much of the requested information as you can, without disclosing the third party’s identity”, and that “it may often be better to leave information in (unless it’s covered by an exemption)”. A page of black bars tells the requester nothing about how their data is used.

Then check what you can’t see. A PDF’s author field, comments or form fields can name a colleague too. The Dress Docs export removes the metadata and flattens each page into one image. Our redaction checklist covers the remaining steps.

Checking the requester’s ID without keeping a copy

You may ask for proof of identity when you have real doubts about who is asking. You don’t have to keep it. The ICO: “While you do not need to keep copies of ID documents, you could keep a note of: what ID documents the person provided; the date you verified them; and who in your organisation verified them.”

The same rule applies beyond access requests: should you keep a copy of a customer’s ID?

Everything above is on the features page. The reasons, the log and search and cover come with Pro: see pricing.