Can an AI agent redact personal data from documents?

Yes, and it catches more than a tired reviewer at the end of a long pack. An AI agent can find names, account numbers, addresses, signatures, faces and special category data in documents, propose redactions and apply them to copies. Judging context-dependent cases, such as indirect identification, and approving release stay with a compliance or data protection officer.

Why is redaction riskier than it looks?

Redaction fails in two directions. Under-redaction discloses someone's personal data to a person who should not have it, which is a personal data breach. Over-redaction withholds information the recipient was entitled to, which can breach a subject access right or a disclosure obligation. Both happen often when people redact by hand under time pressure.

There is also a technical failure mode: redaction that only looks like redaction. A black box drawn over text in a PDF can leave the text underneath selectable. Document metadata, tracked changes and embedded images can carry data the visible page does not show. An agent working on the document's content, not its appearance, avoids most of these.

What may the agent prepare?

The agent may:

• Detect direct identifiers: names, addresses, phone numbers, emails, account and card numbers, national identifiers, dates of birth.
• Detect special category data, such as health information, and flag it for heightened care.
• Find identifiers in images, scanned pages, signatures, headers, footers and metadata.
• Propose each redaction with a reason code: third party, special category, out of scope, possibly exempt.
• Apply approved redactions to a copy, flattening the document so redacted content cannot be recovered.
• Produce a redaction log listing what was removed and why.

Detection depends on classification, so the agent's accuracy here rests on the same capability described in can an AI agent classify personal data?

The officer decides:

• Indirect identification: whether a job title, a location or a described event identifies someone even without a name.
• Third-party data where context matters, such as whether a joint account holder's details should be disclosed to the other.
• Exemptions, such as legal privilege.
• Approval to release the redacted document.

What does a redaction job look like?

Take a lender responding to a request from a customer's solicitor for the customer's loan file. The file runs to 180 pages, including application forms, bank statements, call notes and internal emails.

The agent proposes 420 redactions. Most are routine: other customers' names in a batch report, staff mobile numbers, card numbers on statements. It flags eight for a person. In one call note, an adviser recorded that the customer's spouse "mentioned their cancer treatment". The agent marks this as special category data about a third party, the spouse. In an internal email, a manager is described as "the underwriter in the small regional office who was off sick," which identifies someone without naming them.

The officer redacts both. She leaves one flagged item unredacted: the name of the customer's own broker, which the customer already knows. She approves release. The agent flattens the copies and files the redaction log. Had an unredacted copy gone out, the personal data breach assessment template would have been the next step, and assessing the breach for notification would have followed.

Which controls make agent redaction safe?

• Originals are never altered. The agent works on copies. Source records stay intact.
• Flattened output. Redacted documents are rendered so hidden text, layers and metadata are gone.
• Release held. Sending a redacted document is held for a named person.
• A redaction log. Each redaction has a reason, so a later challenge can be answered.
• Sample checks. A person checks a sample of pages the agent left unredacted, not just the ones it flagged.
• The agent's own records are covered too. If the agent logs document content while it works, those logs contain personal data and need the same care; see how do you handle personal data in AI agent logs?

The general principle is in our guide to AI compliance agents.