Ireland and UK · DSAR

How to redact documents for a subject access request

Updated 27 October 2026 · Lasting Apps, Dublin, Ireland

When someone asks for a copy of their personal data, the documents you send them usually mention other people too: colleagues, customers, witnesses, family. Their details have to come out, and they have to come out properly. A name hidden under a black box that can still be copied is a data breach of its own.

This guide walks through a redaction job from start to finish, using the published guidance from Ireland’s Data Protection Commission (DPC) and the UK Information Commissioner’s Office (ICO).

1. Work on a copy, and start a log

Never redact the original. The DPC is blunt about it: work on a copy, because redaction changes records you may need again in their original form.¹

Start a simple log before you begin: which document, what you removed, why, and when the redacted version was made and sent. The DPC recommends exactly this, and it is what you will rely on if the person later says something was held back unfairly.¹ The ICO also expects you to record what you decided about other people’s information and why.³

2. Decide what belongs to someone else

The person is entitled to their own personal data, but the right to a copy “shall not adversely affect the rights and freedoms of others” (GDPR Article 15(4)). So information that identifies another person is the main thing you redact.¹

In the UK the ICO sets out three questions:³

Can you answer without identifying the other person? Often yes, by removing their name or other details. You must provide the requester’s information, not necessarily whole documents.
Has the other person agreed? If they consent, you disclose. Asking is optional, and not always appropriate.
Is it reasonable to disclose without their consent? Weigh things like confidentiality, whether the requester already knows the information, and how important it is to them.

Whatever you decide, you still respond: give as much of the requester’s information as you can, with other people’s details edited out.³

3. Find every mention, not just the names

People are rarely referred to only by their full name. The DPC’s examples include descriptions such as “my grandfather” or “the Appellant’s neighbour”, initials, and misspelled or shortened names.¹

Search helps, but it has limits the DPC points out: it only finds the words you type, it may skip tables of contents and references, and it cannot read text inside images, such as a scanned letter or a photo of a certificate.¹ Read the documents, not just the search results.

In Ireland, also look for PPS numbers, Eircodes, bank details (IBANs), phone numbers and email addresses that point to someone other than the requester.

4. Remove what you cannot see on the page

Electronic files carry more than their visible text. The DPC lists the usual hiding places:¹

Comments, revision history and editing mark-up in Word documents.
Hidden columns, rows and worksheets in spreadsheets.
File properties: author, editor and revision dates.
Email headers: senders, recipients, times and IP addresses.
Photo data: who took it, when, where, and on what device.

The DPC suggests exporting to plain text or CSV to strip hidden content and make review easier.¹

5. Redact so the text is gone, not covered

Highlighting text in black or changing its colour is not redaction. The text is still there and can be copied out. The DPC says plainly not to rely on it.¹ The same goes for a black rectangle drawn over a PDF: in a well-known 2010 case, the hidden text of a court filing was recovered with select-all and copy-paste.⁵

What works:

Replace the text with a placeholder such as [REDACTED], which also shows where something was removed.¹
Use a redaction tool that deletes the text under each box, not one that only draws over it.⁵
If you have no such tool, print the redacted pages and scan them back in as a new PDF.⁵

6. Check the final file before it goes out

This is the step most often skipped. On the finished copy:

Select all the text and paste it into Notepad or TextEdit. Nothing you redacted should appear.
Search the file for each name, number and email you removed.
Open the file properties and check the author and title fields.
For paper, the DPC suggests copying or scanning the redacted page and holding it up to the light.¹

7. Send it on time

In Ireland, the organisation must respond within one month of receiving the request. That can be extended by up to two further months, for example if the request is complex, but you must tell the person, with reasons, before the first month runs out. You do not need anyone’s permission to extend.²

The ICO explains how to count in the UK: from the day you receive the request to the same date next month; if that date does not exist, use the last day of the month; if the deadline falls on a weekend or bank holiday, you have until the next working day. If you genuinely need clarification, the clock stops while you wait for the reply.⁴

Checklist

Working on copies; originals untouched
Redaction log started: document, what, why, date
Other people’s details identified, including initials and descriptions
Images and scans read by eye, not just searched
Comments, revisions, hidden sheets and file properties removed
Text deleted or replaced, never highlighted or covered
Final file checked with select-all, search and properties
Response sent within one month, or extension notice sent in time

This guide summarises public guidance from the DPC and the ICO. It is not legal advice. For a contested or sensitive request, take advice from your data protection officer or solicitor.