Redaction in the offboarding process: which documents need to be cleaned up?

Ex-employee data must be cleaned up in line with GDPR retention periods. Redaction helps with documents you need to keep — but without personally identifying information.

After offboarding, documents containing references to former employees continue to exist. Tax retention rules say: keep them. GDPR says: minimise identifiability. Redaction bridges the gap.

Categories to consider

• Pay slips (7-year tax retention): kept in their original form — national insurance numbers and amounts are part of the fiscal record.
• Performance reviews (2 years): delete in full once the retention period expires, unless a dispute is ongoing.
• Project documents mentioning the former employee (kept for client history): replace the name with a role title or initials.
• Internal memos and meeting notes: assess on a document-by-document basis.
• Email archive: after 30 days of forwarding, retain the archive in line with your retention policy; most email data can be anonymised or deleted after 1–2 years.

Process

1. Identify documents that must be retained.
2. Assess each document: is personal identification still necessary, or is a name or job title sufficient?
3. Redact any identification that is no longer required.
4. Log the redaction (when, by whom, and which document) — see audit trail.
5. Schedule a review moment (e.g. annually).

Automating for volume

With > 50 former employees per year, pattern-based bulk redaction pays off: automated name detection and replacement. Our PDF Redact Business includes tooling for exactly this.

See also: offboarding pillar, retention periods.