Redacting documents for Freedom of Information requests: third parties' personal data

A journalist asks a council for all correspondence about a disputed planning enforcement case. The search turns up 140 emails, two officer reports, a spreadsheet of site visits and a scanned letter from a neighbour. The information officer has 20 working days, and almost every page mixes material the public is entitled to see with personal data about residents, complainants and junior staff. Release everything and you breach data protection law; withhold everything and you breach the Freedom of Information Act.

This guide explains how the law treats third parties' personal data in an FOI or EIR response in the UK, how to decide what comes out, and how to redact so that what you remove is really gone. It complements our articles on subject access requests and on publishing council minutes.

The legal framework: section 40 and regulation 13

The Freedom of Information Act 2000 gives anyone a right to information held by public authorities, subject to exemptions. Personal data is dealt with in section 40, which works in two halves. If the requester asks for their own personal data, section 40(1) exempts it from FOI altogether: the request should be handled as a subject access request under the UK GDPR instead. If the information is about someone else, section 40(2) applies, and it is exempt when one of three conditions is met.

• First condition: disclosure to a member of the public would contravene the data protection principles in Article 5(1) of the UK GDPR. This is the condition used in most cases, and it is absolute: there is no public interest test.
• Second condition: disclosure would contravene an objection the individual has made under Article 21 of the UK GDPR.
• Third condition: the individual could not get the information themselves through a subject access request, because a Data Protection Act 2018 exemption would apply.
• The second and third conditions are qualified: you must also weigh the public interest. Section 40 also allows you to neither confirm nor deny that information is held where confirming would itself reveal something about a person.

For environmental information, such as planning, pollution, land use or waste, the request falls under the Environmental Information Regulations 2004. Regulation 13 mirrors section 40 with the same three conditions, and the first one is again applied without a public interest test. In Scotland, devolved authorities answer under the Freedom of Information (Scotland) Act 2002, where personal information is covered by section 38, and under the Scottish EIR; the reasoning is similar, but follow the Scottish Information Commissioner's guidance rather than assuming the two regimes are identical.

Disclosure is to the world, not to the requester

The ICO stresses that an FOI or EIR disclosure is treated as a disclosure to the world at large. Who is asking, and why, is generally irrelevant, and the requester is under no duty of confidence afterwards. A useful test for every name on the page is: would we be comfortable publishing this on our website?

The lawfulness test in three steps

According to the ICO, the principle most likely to be breached is lawfulness, fairness and transparency (Article 5(1)(a)). The lawful basis normally examined in an FOI context is legitimate interests, which the ICO breaks down into three questions asked in order. If one fails, you stop there.

Special category data (health, ethnicity, sexual life and so on) and criminal offence data need an extra condition on top. The ICO notes that, in practice, only explicit consent or information the person has manifestly made public are likely to be relevant, so this kind of data is very rarely disclosable under FOI.

Who usually stays visible and who is redacted

There is no fixed list, but the ICO's guidance points to the factors that matter most for staff: seniority, whether the role is public-facing, responsibility for spending public money and whether the information is about their work or their private life. The table summarises common outcomes; each request still needs its own judgement.

Remember that section 40 applies to information, not documents. If a report contains one paragraph about a resident's circumstances, you redact that paragraph and release the rest. Withholding a whole document because it mentions people is rarely defensible. Redactions are a partial refusal, so the response letter should cite the exemption relied on (section 40(2) or regulation 13) and explain it, as a refusal notice requires.

A practical workflow for the 20 working days

1. Log, locate and scope

Record the date of receipt and the deadline: 20 working days under section 10 of FOIA, and the same under regulation 5 of the EIR, where regulation 7 allows an extension to 40 working days for complex and voluminous requests. Decide early whether the request is FOI or EIR, and whether part of it is really the requester's own data.

2. Map the personal data

Before anyone redacts, list the categories of people in the bundle: officials, members, residents, contractors. Do not forget email headers, signatures, attachments, comments and spreadsheet tabs. A neighbour can be identified by a house number or a description of their car as easily as by a name.

3. Decide per category and write it down

Apply the three-step test once per category of person rather than per page, and record the outcome in a short decision note. That note drives consistent redaction across 140 emails and is what you will rely on if the requester asks for an internal review or complains to the ICO.

4. Redact for real

Use a method that deletes the underlying content, not one that draws a shape on top. Then remove the PDF metadata, flatten the file and, for scans, make sure the OCR text layer has been redacted too. Our article on PDF redaction mistakes covers the technical traps in detail.

5. Second-person check and release

A colleague who did not do the redaction opens the final files, searches for the names in the decision note, copies a few redacted areas into a text editor and checks every worksheet. Only then is the response sent, ideally in the same format you would use for publication in your disclosure log.

The redaction failures that make the headlines

The best-known UK example is the Police Service of Northern Ireland. In August 2023, a spreadsheet published in response to an FOI request contained a hidden worksheet with the surname, initials, rank and role of every officer and member of staff. The ICO fined the force, and in 2025 it published new guidance on disclosing documents to the public securely. The recurring failures are well documented:

• Hidden worksheets, rows, columns and filters in spreadsheets, and source data behind pivot tables.
• Overlay boxes or black highlighting in PDFs, with the text still there to copy and paste.
• Metadata, comments and tracked changes in Word files, and author names in document properties.
• The OCR text layer of scanned letters, which keeps the words even when the image is covered.
• Inconsistent redaction: a name removed in the body but left in a quoted reply further down the thread.
• Re-identification by context: small numbers, unusual job titles or a street name that point to one person.

How Anonimatum helps with FOI redaction

Anonimatum detects names, addresses, phone numbers, email addresses and identifiers with its own AI running on EU servers, and you can add patterns for your own formats, such as case or staff reference numbers. A whitelist keeps senior officials and members visible while everyone else is hidden, and a saved template applies the same decision note to the whole bundle, in batches. OCR runs only on the pages that are scanned, signatures and stamps can be covered with zones or shapes through visual anonymisation, and every match is shown in a preview for human review before anything is applied. The redacted text is genuinely removed from the output rather than covered, metadata can be stripped, and Word, Excel and PowerPoint files are processed in their own format. It does not replace your judgement on what the law requires, nor the final check of hidden worksheets and context: it makes the mechanical part faster and consistent.