Redact Third-Party Details in a Subject Access Response

An employee’s subject access request may involve correspondence, meeting notes or a grievance record that mentions other people. The difficult part is deciding what should be disclosed. Redaction is the editing step after that decision, not a substitute for it.

Do not automatically remove every colleague’s name

The UK ICO’s subject-access advice discusses redaction and information relating to other people. Whether information should be disclosed requires a contextual decision, not a blanket name-removal rule. Use the ICO’s subject access request advice and your organisation’s responsible reviewer. Other jurisdictions may use different access rules.

Keep the disclosure decisions and reasons in your approved case record. WhatTheFile does not determine exemptions, legal privilege, deadlines or whether a response is complete. It does not maintain a case-management record or redaction log for you.

Work through an approved PDF response copy

1. Finish the information review. Decide which documents are in scope and which specific details need redaction. Keep untouched originals separately.
2. Prepare the input. Open a PDF or supported image. This editor does not open email mailboxes, spreadsheets or Word files directly. If you export those elsewhere, check that the PDF contains all intended content.
3. Find repeated details. Search names, contact details or identifiers that your review has approved for removal. Inspect every match before selecting it; a name may refer to different people.
4. Check the surrounding record. Read quoted replies, message headers, screenshot captions and handwritten notes. Names are not the only way to identify someone.
5. Apply and verify. Use Redact selected areas. Inspect each page, create the copy and reopen the download. Have the appropriate reviewer compare it with the disclosure decisions before sending.

What should the final review include?

• The requester’s information remains readable where it should be disclosed.
• Repeated third-party details have received a consistent, contextual review.
• No box accidentally covers necessary context or leaves part of a selected detail exposed.
• The recipient can use the image-only format, including any accessibility needs.
• The response is delivered through your approved channel with any required explanations.

Can the tool explain why each redaction was made?

No. The editor helps locate and remove individual marked areas, but it does not export reason codes, a legal rationale or an audit trail. Keep any required explanation in your own records. For large or collaborative reviews needing tracked approvals, use an approved review system that supports those functions.

Will keyword search find all third-party information?

No. A job title, quoted conversation or contextual description can identify someone without using their name. OCR may also misread text. Read each page, and use manual boxes only after deciding what should be withheld.

When this tool is a fit

The download is a new image-only PDF or PNG with opaque black pixels in the selected areas. Original PDF text layers, attachments, comments and document metadata are not copied. Searchable text, links, interactive forms, digital signatures and accessibility tags are lost. Fine print can change and the file can grow.

Use another approved workflow if you need searchable or accessible output, a redaction audit log, review approvals, or preservation of signed documents. Local processing alone does not establish regulatory compliance or permission to disclose a record.

For the controls and keyboard shortcuts, see the complete PDF and photo redaction guide. Start with the private redaction tool when you have decided what the recipient is allowed to see.