Redacting personal data: why "good enough" is not good enough

Redacting personal data means permanently removing names, addresses, bank details, and identification numbers from a document in such a way that they can no longer be read or restored. This article explains why many tools only seemingly redact – and what really matters for reliable, GDPR-compliant redaction.

Every company sits on documents full of personal data. Contracts, support tickets, medical letters, personnel files. Sooner or later, you have to share them, analyze them, or feed them into an AI tool. And at exactly this moment, one question matters more than any other: Is every name, every bank account, every ID number really gone? The question is not just one of good conscience: The GDPR provides for fines of up to 20 million euros or 4% of global annual turnover for insufficiently protected personal data (Art. 83 GDPR).

At Kontinent, we develop maskwerk, a redaction engine built specifically for this task – with a special focus on German documents. It reads the formats your data actually lives in, including PDF, Word, Excel, and plain text, and it can even read the text in scanned images. In this article, we explain in simple terms how it works and why we built it the way we did.

The Most Important in Brief

• maskwerk is the German redaction engine from Kontinent – it detects and redacts personal data in PDF, Word, Excel, text, and scanned images.

• Verify instead of guess: IBAN, tax ID, social security and health insurance number, credit card, and identity card are validated via their check digit – not guessed based on hint words.

• Real PDF redaction: The underlying text is removed and the result is verified – no mere black bar under which the content remains copyable.

• Runs locally, GDPR-friendly: Your documents do not leave your own environment.

• Reversible for AI use: consistent placeholders whose mapping is kept only in RAM.

• In tests: 100% detection rate on labeled test data, 85% on real German court rulings, 78% on synthetic business documents.

The Problem with Most Redaction Tools

Legally, more depends on this question than it initially appears. The European Data Protection Board makes it clear in its EDPB, Opinion 28/2024 on AI models that anonymity must never be assumed flat-rate, but must be proven in each individual case. A redaction that only partially hits names is therefore not anonymization, but pseudonymization – and personal data remains personal data, with all obligations arising from Regulation (EU) 2016/679 (GDPR).

Most tools find personal data the way a human would when skimming a page: they look for clues. If the word "IBAN" stands next to a long number, the number is masked. If a word looks like a name, it is also masked – provided the software feels confident enough.

This approach fails in both directions. A tax ID that stands alone in a table cell, without a label next to it, slips through because there was no clue. At the same time, harmless text is redacted because it vaguely looked like something sensitive. In the end, you have documents that are simultaneously leaky and unreadable.

Verify Instead of Guess

Here is a detail that is hardly known outside the specialist world: Many official identification numbers carry a built-in proof of validity. German tax IDs, social security numbers, health insurance numbers, identity card numbers, IBANs, and credit card numbers all contain a check digit – a small mathematical fingerprint that only real numbers possess.

maskwerk uses this. If it sees a candidate number, it recalculates the actual check. If the number passes, it is masked – even if it stands completely alone, without any labeling. If it fails, it remains untouched, even if someone typed "tax ID" directly next to it, because a number that does not pass the check is not a real tax ID.

There is a conscious exception, and it is a matter of safety. If a number is clearly identified as bank details but fails its check, maskwerk masks it anyway. A mistyped IBAN is still someone's bank details; disclosing it because of a typo would be exactly the wrong reflex.

For names and places, where there is no such mathematics, maskwerk combines several language models and then corrects their predictable errors with simple knowledge. A model will readily classify the city of Hamburg as a person's name; a curated list of real German cities and first names quietly straightens that out.

The result is a tool that captures the identification numbers that matter and does not tear your document apart because of false alarms.

No Half-Redacted Names

There is a subtle failure mode in redaction software that we find unacceptable: the leftover fragment. Suppose a system recognizes "Anna Bergmann-Weiß" as a person and separately recognizes "Bergmann" as something else. Careless tools replace both findings independently, the positions shift, and in the end, the document reads "PERSON-Weiß". Part of the name has survived. That is a data leak, just a quieter one.

maskwerk resolves any overlap between findings before touching the text. Every character of the document belongs to exactly one finding, and only then does the replacement take place. A name is completely removed – or the software refuses to continue. There is no in-between.

A Black Bar is Not Enough

When people redact a PDF, they usually drag a black rectangle over the sensitive spot. It looks finished. But the words underneath are often still there, invisible in the file, recoverable with a simple copy and paste. Newspapers, law firms, and public authorities have disclosed sensitive information in exactly this way.

maskwerk does not cover text, it removes it. For PDFs, it deletes the underlying content, removes the hidden metadata in which personal data likes to nest, and then reads its own output again to make sure nothing has survived. If an original value can still be recovered, the file is rejected instead of being returned to you. A redaction that cannot be verified is a redaction we do not deliver.

If Something Breaks, We Stop

Software fails sometimes. The interesting question is what happens next. Many processing chains are built to be forgiving: if a detection step crashes, the rest continues, and the document comes out looking finished at the other end.

For data protection work, we believe this is the wrong choice. A partially verified document looks exactly like a fully verified one, and no one notices until it is too late. That is why maskwerk aborts in a controlled manner in case of doubt. If a part of the detection breaks, the entire run stops and tells you – loud and clear. You will never receive a half-verified document masquerading as a secure one.

Redaction that Can Be Deliberately Reversed

maskwerk does not just redact. It replaces every piece of personal data with a labeled placeholder, and the same person or account number always receives the same placeholder throughout the document. The mapping between placeholders and originals is kept only in RAM for the duration of the process – never written to disk – and is used to reinsert the real text into the result before being discarded. Why is this important?

Because the most common reason to redact today is the safe use of AI. You mask a document, let an AI model summarize or translate it, and then reinsert the real names into the result. Because the placeholders are consistent, the AI can still track who did what; its summary remains coherent, even though it never learns a single real name. maskwerk even handles the fact that AI models sometimes reformat the placeholders along the way, and repairs them during recovery.

And because maskwerk runs as a software library in your own environment, the documents themselves never leave your premises – neither to us nor to anyone else. A redaction that requires you to first upload your files to a stranger always seemed like a strange bargain to us.

Does It Really Work?

We test maskwerk on three levels, because a single number never tells the whole story, and a benchmark you built yourself always flatters you a little.

The first test is our own: 360 labeled German documents containing names, addresses, bank details, identification numbers, and dates, with the test documents strictly separated from those used during development – so the system cannot simply memorize the answers. There, maskwerk captured 100 percent of the labeled personal data.

Then we made it harder, with text we had no hand in creating. On real, published German court rulings, it captured 85 percent. And on 476 complete synthetic German business documents – the invoices, bank statements, and contracts modeled on the environment we are targeting – it masked 78 percent of the personal data. We look closest at this last number because it is nearest to the real-world task. The open-source redaction engine we compare against achieved 72, 56, and 46 percent on the same three tests. We also pitted maskwerk against six other detectors, both open-source and commercial, and in the overall task, it led the field by a wide margin – as the only one that validates German ID numbers at all.

Notice the pattern: the harder and more real the test becomes, the larger the gap to everything else. That is the opposite of how software behaves when optimized for the demo, and it is intentional.

For a redaction tool, the detection rate is the most important number because every miss is a potential leak. On unfamiliar, real-world text, maskwerk also prefers to play it safe and sometimes masks a harmless word – a procedural role like "the defendant," for example. We believe this is the right direction in which to err. An over-cautious black bar costs a moment when reading; an overlooked name costs someone their privacy.

The full benchmark setup – datasets, scripts, and evaluation – is documented alongside the code, so these numbers can be verified rather than just believed.

The Same Protection for Every Name

There is a quieter risk in name recognition that is rarely discussed. The language models most redaction tools rely on are predominantly trained on German news and Wikipedia, and many of them recognize names of Turkish, Arabic, Slavic, or East Asian origin noticeably worse. In an ordinary tool, this is a quality gap. In a redaction tool, it is something worse: weaker protection for the very people who are often already most exposed.

So we measured it directly. Across names from five different origins, maskwerk's detection rate was identical. Every person's name is protected in the same way because the underlying models read many languages and not just German. We believe: A redaction tool that quietly protects some people better than others has failed its actual task – no matter what its average score says.

The Short Version

Redaction is one of those tasks where "close enough" is not enough, because what slips through is always someone's name or bank details. We built maskwerk around some stubborn principles: verify instead of guess, remove things completely instead of covering them up, stop loudly instead of failing quietly, test on the hardest real-world texts we can find, protect every name equally, and leave your documents where they belong – with you.

If you work with German documents and want to use them freely without carrying their risk, we would love to show you maskwerk in action. Reach out via kontinent.ai.

Redaction does not replace any of the other obligations. A DPA according to Art. 28 GDPR remains necessary, as does a clean answer to the question of data residency – the paths there are described in Using OpenAI, Claude, and Gemini in Europe. The Comparison of GDPR-compliant LLM routers shows which EU routers offer redaction directly in the request path.

Frequently Asked Questions

What does "redacting" personal data mean?

Redaction refers to the permanent removal or rendering unreadable of personal data in a document – such as names, addresses, IBANs, or ID numbers – so that they can no longer be read or restored. Unlike a mere black bar, real redaction removes the underlying text from the file.

How do you redact personal data in compliance with the GDPR?

Two things are crucial: the data does not leave your control unnecessarily, and the redaction is demonstrably complete. maskwerk runs locally in your own environment, so no documents are transferred to third parties, detects personal data with checksum validation, and verifies every redaction before the file is output.

Can you really redact a PDF so that the text is removed?

Yes. Many tools only place a black rectangle over the text, which remains copyable underneath. maskwerk deletes the underlying content, removes hidden metadata, and reads the output again to confirm that no original value can be recovered.

What personal data does maskwerk detect?

Among others, names, addresses and locations, IBANs, credit card numbers, German tax IDs, social security and health insurance numbers, identity card numbers, VAT IDs, BIC, email addresses, phone numbers, IP addresses, dates, and license plates.

Do my documents remain local?

Yes. maskwerk runs as a software library in your own environment. The documents themselves are not transferred to Kontinent or third parties.

Can a redaction be reversed for AI use?

Yes. maskwerk replaces every value with a consistent placeholder and keeps the mapping only in RAM. This allows an AI model to process a masked document, and the real values are then reinserted into the result – without the model ever seeing a real name.

How reliable is the detection?

In our tests, maskwerk achieved a 100% detection rate on labeled test documents, 85% on real German court rulings, and 78% on synthetic business documents – significantly above the open comparison engine (72, 56, and 46%).

Sources

• Regulation (EU) 2016/679 (GDPR) – Art. 4 Nos. 1 and 5, Recital 26

• EDPB, Opinion 28/2024 on AI models

As of: August 27, 2026 · kontinent.ai. maskwerk by Kontinent. Benchmark methodology and datasets are documented alongside the code.