Anonymise or Pseudonymise a PDF? GDPR Rules for Documents

To anonymise a PDF under the GDPR, you must remove or change the personal data so that no one, using means reasonably likely to be used, can identify the people in it. Blacking out names while keeping the original file usually achieves pseudonymisation, not anonymisation, so the redacted PDF is still personal data and the GDPR still applies.

The difference matters. Truly anonymous information falls outside data protection law; pseudonymised information does not. This article sets out the legal definitions, what the Irish Data Protection Commission (DPC) and the European Data Protection Board (EDPB) say, a 2025 Court of Justice judgment that adds nuance, and the practical steps for a PDF. It is general information, not legal advice; check decisions with your Data Protection Officer.

What is the difference between anonymisation and pseudonymisation?

Pseudonymisation is defined in Article 4(5) of the GDPR (Regulation (EU) 2016/679) as processing personal data "in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures". Replacing patient names with study codes, while a separate list links codes to names, is the classic example.

Anonymisation is not defined in an Article, but Recital 26 explains it. Personal data that has undergone pseudonymisation "should be considered to be information on an identifiable natural person". The principles of data protection do not apply to "anonymous information", meaning information that does not relate to an identifiable person or personal data "rendered anonymous in such a manner that the data subject is not or no longer identifiable".

The test is identifiability. Recital 26 says account should be taken of "all the means reasonably likely to be used, such as singling out, either by the controller or by another person", considering costs, time, available technology and technological developments.

What the Irish DPC says

The DPC's Guidance on Anonymisation and Pseudonymisation (June 2019) makes three points that apply directly to documents:

• Direct identifiers are not enough. "Removing direct identifiers does not render data sets anonymous." Phone numbers, email addresses and internal IDs are indirect identifiers, and context such as a job title, a rare condition or a date can single someone out.
• Keeping the source matters. If the source data is not deleted and could be used to identify individuals, "the data may be considered only 'pseudonymised' and thus still 'personal data'".
• Publication raises the bar. When anonymised data is released to the world at large, there is "a much higher burden" to make sure the anonymisation works, because publication cannot be retracted.

The guidance also warns about personal knowledge: a reader who knows the people involved, such as a colleague or a neighbour, may recognise them from details that would mean nothing to a stranger.

Does it depend on who holds the data?

Two recent sources take different emphases, and both are worth knowing.

The EDPB's Guidelines 01/2025 on Pseudonymisation, adopted on 16 January 2025 as a version for public consultation, state that pseudonymised data "is to be considered information on an identifiable natural person, and is therefore personal", and that this "also holds true if pseudonymised data and additional information are not in the hands of the same person".

On 4 September 2025, in Case C-413/23 P, EDPS v SRB, the Court of Justice confirmed that pseudonymised data "must not be regarded as constituting, in all cases and for every person, personal data". Pseudonymisation may, depending on the circumstances, prevent people other than the controller from identifying the data subject, so that for them the person is not identifiable. The case was decided under Regulation (EU) 2018/1725, which applies to EU institutions. The Court also held that the controller's own duties are assessed from the controller's point of view at the time of collection.

For an organisation redacting its own PDFs, the practical result is the same either way: while you keep the original or a key, the redacted file is personal data in your hands. Whether a particular recipient can identify anyone is a case-by-case assessment for your DPO.

Where personal data hides in a PDF

A PDF can carry personal data in places you do not see on the page:

• The text layer under a black box, if the box was drawn on top rather than the text removed.
• An OCR layer of invisible text over a scanned image.
• Metadata, such as the author name in the document properties and the XMP metadata.
• Comments and form fields, which carry reviewer names and entered values.
• Attachments embedded in the file.
• Images of signatures, faces, handwriting or ID cards.
• The file name, for example "Complaint_JMurphy_2026.pdf".

Techniques that work on documents

Redaction is only one technique. For documents, the common options are:

1. Remove: delete a name, signature or paragraph entirely.
2. Replace: substitute a role or code, such as "Operator A" or "Patient 012". If you keep the code list, this is pseudonymisation.
3. Generalise: turn a date of birth into an age band, a full date into a month, an address into a county.
4. Aggregate: report counts and ranges instead of individual rows.

Choose by asking what a reader could still work out. A redacted complaint letter that leaves the date, the ward and the treatment may still identify the patient to anyone who worked that shift.

How to redact personal data from a PDF properly

Use a process that removes the content, then test it:

1. Work on a copy and keep the original under access control.
2. Find every instance. Find and Redact searches the PDF's text for the words, or regular-expression patterns, that you enter and lets you review each match. It does not recognise names, roles or indirect identifiers by itself, and it cannot find text that exists only as an image, so read the document too. Redact PDF lets you draw boxes by hand over anything else, including images and signatures.
3. Remove what is under the boxes. Both tools draw opaque boxes onto the page; they do not delete the text underneath. Converting the boxed file with Rasterize PDF, using PDF output, rebuilds each page as an image in a new document, so the covered text, the text layer, metadata, comments and attachments are not carried over; only what is visible on the page survives, as part of the image. The pages are no longer searchable.
4. If you need searchable text, use a full PDF editor whose redaction feature deletes content, then strip hidden data. Sanitize PDF removes document metadata, including XMP, embedded attachments and JavaScript by default; comments are removed only if you tick Remove Annotations.
5. Test the result. Search for a redacted name, copy and paste text around a box into a plain text editor, and check the document properties. Our guide on how to redact a PDF properly sets out these checks.
6. Rename the file so the name carries no personal data.

These tools run in your browser, so the unredacted document is not uploaded. They make the mechanics reliable; they do not decide whether the result is anonymous. That judgement depends on the content, the audience and what else they know.

This article is general information, not legal advice. For decisions on anonymisation or disclosure, consult your DPO or legal adviser.