Audit trail for redaction: what to log, why, and how long?

An auditor walks in and asks: "show us how you anonymised client data for report X." Without an audit trail, you have nothing to show. Here's what to log.

With automated or large-scale redaction, an audit trail is more than a nice-to-have: it's your defence against GDPR claims and ISO audits.

What to record for each redaction action

\n
• The user who performed the redaction.
\n
• Timestamp.
\n
• Original file (name + hash).
\n
• Redacted file (name + hash).
\n
• Patterns applied or manual regions (a summary — not the original text).
\n
• Number of matches redacted.
\n
• Redaction reason (optional free text).
\n
• Optionally: who received the resulting document.
\n

What NOT to log

\n
• The original text that was redacted — that would defeat the entire exercise.
\n
• Images of redacted content.
\n

Retention period

\n
• For ISO 27001 purposes: 3 years minimum.
\n
• For GDPR accountability: 3–5 years depending on context.
\n
• Longer if the redaction work relates to tax documents (7 years).
\n

Storage

Centralised log, with restricted access. Not inside the PDF itself (a contradiction in terms), but in a database or log file with access controls.

Verification

Periodic spot-check: pick 10% of recent redactions, open the log entry, compare it with the file — does what's logged match reality?

Tools: our PDF Redact Business plan produces an audit log that records everything needed for ISO purposes on a per-redaction basis. See also the redaction pillar.