Guide
A person who asks for their data is entitled to a copy of it. The other people named in the same documents are entitled to stay out of it.
Updated
Under article 15 of the GDPR, a person can ask any organisation that processes their data whether it does, and receive a copy of that data with information about its use: purposes, recipients, retention period and source. Employees, former employees, customers, patients, tenants and users all make such requests.
The copy is often made of documents: e-mails, reports, minutes, contracts, files. Those documents rarely mention only the person asking.
The answer is due without undue delay and within one month of receiving the request. The time limit can be extended by two further months when the requests are complex or numerous, provided the person is told within the first month, with the reasons. Masking dozens of documents takes time: start early.
Article 15(4) states that the right to obtain a copy must not adversely affect the rights and freedoms of others. Colleagues, other customers, witnesses and family members named in the documents have their own rights. Their data is therefore masked, unless they agreed to its disclosure or it is already known to the person asking.
Masking is not a reason to withhold a document: the document is sent, with the other people's data removed. The assessment of what may be disclosed belongs to the organisation, often with its data protection officer.
Obscelis finds the names, addresses, e-mail addresses, phone numbers and identifiers in each document. You keep the data of the person asking, mask the others with one decision for every occurrence of the same value, and draw zones over signatures or handwriting.
Everything runs on your computer: the documents of a request never go to a third-party service. Each copy is exported next to the original and reread before it is published. With the Pro and Team plans, an audit report records the checks performed and the categories masked, without any masked value, and a whole project is exported in one go.
Generally not: the usual answer is to send the document with the other people's data masked. Refusing a document outright needs a specific reason, which the organisation assesses and should be able to explain.
It depends on the context and on your organisation's assessment: the name of a person acting in their professional role is not handled like that of a private third party. Decide on a rule before you start, and apply it the same way to every document.
Masking is one part of the answer, not the whole of it. The completeness of the search, the time limit, the information sent with the copy and the lawfulness of each disclosure remain the organisation's responsibility. No tool settles them on its own.
The United Kingdom keeps a similar right in the UK GDPR, and other laws give comparable rights. Their time limits and exceptions differ: check the rules that apply to you.
Redacting a PDF means removing information from the file, not hiding it on screen. Here is the method, the traps, and how to check the result.
Drawing a black rectangle over a name hides it on screen, and nowhere else. The text stays in the file, one copy and paste away.
Summarising a contract, rewording a report, analysing a table: AI assistants are useful. What you paste into them leaves your computer.
Download it for macOS, Windows or Linux: the trial needs no account and no card. A question, or a demonstration for your team? Write to us.
latelierdudev.contact@gmail.com
Opens your e-mail app. We only use your address to reply.
