GDPR access request: redact other people's data
When someone exercises their right of access, you send them their data. The documents involved often contain other people's data too: colleagues, clients, third parties. Sumi helps you hide it on your own computer, without handing the file to an online service.
This page gives practical advice, not legal advice. Your data protection officer or lawyer decides what must be redacted.
What usually needs hiding
In emails, meeting notes, HR spreadsheets and internal messages:
- the names of other people;
- their email addresses and phone numbers;
- their postal addresses and dates of birth;
- the identifiers (employee or case numbers) that point to them;
- passages that reveal information about someone else.
The requester's own data stays visible: it is the point of the answer.
How to do it with Sumi
- Drop each document into the app. Scans and text PDFs are both accepted.
- Review the findings: names, emails, phone numbers, addresses. Switch the requester's own to Keep.
- Add names that come up often with "Redact a word or phrase everywhere": every occurrence is covered.
- For a sensitive paragraph, use Draw box.
- Turn on Preview to read the document as it will be sent.
- Redact & download, then file the copy with your answer.
How to check the result in 10 seconds
Search the final file for a third party's name with Ctrl+F: no result. The file no longer holds any text, only images of the pages.
Limits
A name written differently (a nickname, an initial) can slip past detection. Read every page, especially informal exchanges.
Questions
Do the documents go through your servers?
No. Processing happens in your browser, so no service provider receives the documents for this step.
Can I process a 40-page file?
Yes, with Pro, which removes the 10-page limit per document.
Will the requester's name be hidden by mistake?
It will be suggested: switch it to Keep before you export.