GDPR Document Management: Masking and Erasure Done Right

GDPR document management comes down to three habits: know where personal data sits, mask it when others do not need to see it, and erase it reliably when a valid request arrives. This guide shows how to build those habits into daily file handling.

The erasure request that arrives on a Friday afternoon

Picture a mid-sized company. A former customer emails and asks for all their data to be deleted. Someone searches the CRM, removes the record, and considers the job done.

Three weeks later the same person's name turns up in a scanned contract on a shared drive, in an email attachment, and in last year's backup. The request was handled in one system, but the data lived in five places.

This is the typical failure. The problem is rarely bad intent. It is that documents spread faster than anyone tracks them.

What the right to be forgotten actually requires

The right to erasure, set out in Article 17 of the GDPR, lets a person ask you to delete their personal data in certain situations. Examples include when the data is no longer needed for its original purpose or when consent is withdrawn.

It is not absolute. You may need to keep some records to meet legal obligations, such as tax or accounting duties, or to handle legal claims. In those cases you keep only what the obligation requires and limit its use.

Because the exceptions depend on your country and sector, confirm edge cases with your data protection officer or legal advisor. Do not guess.

Find the data before you try to protect it

You cannot mask or delete what you cannot locate. Start with a simple map of where documents live: shared drives, email, project tools, scanning folders, and personal laptops.

Then note which document types carry personal data. Contracts, invoices, CVs, support tickets and signed forms are the usual suspects. A short register beats a perfect one that never gets finished.

Naming conventions help more than people expect. If a file name includes a customer ID rather than a full name, search and removal become faster and safer.

Masking: show only what the reader needs

Masking means hiding parts of personal data so a document can still be used. A support agent may need the last four digits of an account, not the whole number. A reviewer may need a contract's terms, not the signer's home address.

Real redaction matters here. Drawing a black box over text in a PDF often leaves the text underneath. Use tools that remove the content from the file itself, then check by trying to select and copy the area.

Apply masking at the moment of sharing, and keep the unmasked original in a restricted location. That way colleagues and external partners see less by default.

• Decide per role which fields are visible.
• Remove hidden content, including metadata and comments.
• Test the exported file by searching for the masked values.
• Log who shared which version and when.

Masking, anonymising or deleting: how to choose

These three options are often confused. Each fits a different situation, and picking the wrong one either exposes data or destroys records you still need.

Anonymisation is only real when nobody can reasonably identify the person again, even by combining other data. If re-identification is possible, the document is still personal data.

Retention rules and the backup problem

Erasure gets easier when documents already carry a retention date. If every contract folder has a review date, deletion becomes routine rather than a scramble.

Backups are the awkward part. Many teams cannot edit a backup, so they document that the data will expire on the normal cycle and ensure it is not restored into live systems without re-applying the deletion.

Write this down in your procedure. Regulators and requesters respond better to a clear, honest explanation than to silence.

Keeping proof: audit trails and a working process

Handling a request is only half the job. You also need to show what you did: who received the request, which systems you checked, what was removed, and what was kept and why.

A document platform with access control, version history and activity logs makes this far simpler. If you are weighing options, Filezonia's quality and document management is one place to see how structured storage and controlled access fit together.

Whatever tool you use, set a response routine. Acknowledge the request, verify the identity of the requester, search the mapped locations, act, and reply in writing within the deadline the regulation sets.

Start with one folder this week

Do not try to fix every archive at once. Pick one high-risk area, such as HR files or customer contracts, and map where copies live.

Next, add retention dates, define who may see unmasked versions, and test the process with a mock erasure request. Note what broke and fix it.

Once that folder works, repeat for the next. Have your legal advisor review the final procedure, since obligations differ by country and sector.