Reversible vs Permanent Redaction Choice

The Core Choice

When you protect private records, you face one key decision: can you get the original back?

Permanent redaction removes content for good. There is no way to recover it.

Reversible encryption swaps names and IDs for tokens. You can restore the original with the right key.

That gap shapes your legal and compliance options. Choose wrong, and you may not meet a court order or a regulator's request.

Both methods have valid uses. The key is knowing which one to use, and when. Most tools only offer permanent removal. That limits your options when things change.

See our legal compliance overview for how each approach maps to common legal duties.

GDPR Draws a Clear Line

GDPR splits the world into two groups: anonymized records and pseudonymized records.

True anonymization

If a record cannot be linked to a person, GDPR does not apply. The law is out of scope.

Three things must be true:

• Re-linking must be not possible.
• No extra file can allow re-linking.
• The process must be one-way.

This is the main benefit. Anonymized records sit outside GDPR.

Pseudonymization under Article 4(5)

Pseudonymization swaps IDs for tokens. The original can be restored using a stored key.

Key facts:

• It still counts as personal records under GDPR.
• It qualifies as a security measure under Article 32.
• It cuts breach risk.
• It allows research use under Article 89.

When Permanent Removal Creates Risk

Legal discovery

Courts can order you to produce the original files.

• Privilege claims can be challenged.
• Judges can review files in private.
• Opposing counsel can dispute what was removed.
• Appeals may need the full, original text.

If you have wiped the content for good, you cannot comply.

A law firm removed client names from all case files. The court questioned a privilege claim. The firm could not produce the originals. Sanctions followed.

Regulatory audits

Auditors can ask to see complete records.

• Finance audits need full transaction detail.
• Health audits require patient records.
• GDPR audits may cover all processing steps.

Saying "we removed that for good" is rarely an acceptable answer.

Research that needs re-linking

Long studies must link records across time.

• Medical work tracks patient results over years.
• Academic work needs follow-up rounds.
• Quality reviews need trend data.

Permanent removal blocks all of this.

Business needs

Teams often need the original records back.

• Clients ask for their original documents.
• Internal reviews need the full picture.
• Key decisions need all the context.
• Audit trails may require the raw source text.

When to Use Each Method

Use permanent removal when:

Use reversible encryption when:

How Reversible Encryption Works

anonym.legal uses AES-256-GCM to encrypt and restore content.

Encrypt step

Original: "John Smith, SSN 123-45-6789"
    ↓
[Detect PII]
    ↓
Entities: PERSON("John Smith"), SSN("123-45-6789")
    ↓
[Generate key]
    ↓
[Encrypt each item]
    ↓
Output: "[PERSON_abc123], SSN [SSN_def456]"

Decrypt step

Input: "[PERSON_abc123], SSN [SSN_def456]"
    ↓
[Load key]
    ↓
[Decrypt tokens]
    ↓
Output: "John Smith, SSN 123-45-6789"

Key security

The key is:

• Made on your device. It uses a secure random source.
• Never sent to anonym.legal servers.
• Stored in your own key vault.
• Protected by your own login.

Without the key, you cannot decrypt. It is not possible.

A Legal Discovery Example

A law firm must produce files in a lawsuit.

Without reversible encryption

1. Permanently remove all privileged content.
2. Send files to opposing counsel.
3. Court disputes the privilege claim.
4. Firm cannot produce the originals.
5. Sanctions follow.

With anonym.legal

1. Encrypt the privileged content (reversible).
2. Send the encrypted version.
3. Court disputes the privilege claim.
4. Decrypt and submit for private court review.
5. Court rules on the claim.
6. Send the right version.

You keep control at every step. You can meet any court order. Our legal use case page covers the full flow. See the zero-knowledge page for how keys stay on your side only.

When This Approach Has Limits

Choosing between reversible and permanent redaction sharpens your options, but neither method is risk-free. Know the boundaries before you commit a workflow to one:

• Both methods only protect what was detected. The reversible-vs-permanent choice happens after PII detection. If the detector misses an identifier — an obfuscated value, an internal codename, a number in an unusual format — it is neither tokenized nor removed. The method you pick cannot fix a false negative upstream of it.
• "True anonymization" is harder to reach than it looks. GDPR Recital 26 sets a high bar: re-linking must be genuinely impossible, including by combining with other data. Rich context, rare attributes, or small populations can make a record re-identifiable even after every obvious identifier is gone — and re-identifiable data is still personal data under GDPR.
• Reversibility moves the risk, it does not remove it. Pseudonymized output is still personal data and still in scope for GDPR. Its safety depends entirely on key management: an exposed or poorly stored key turns "reversible" into "breached." You are trading a recovery capability for an ongoing custody obligation.
• Permanent removal cannot be undone — including your mistakes. If you redact for good and later discover you removed too much, or a court demands the original, there is no recovery path. The irreversibility that makes it strong for public release makes it unforgiving when requirements change.

Treat the method choice as one decision inside a wider program — accurate detection, key governance, and a documented basis for whichever standard (anonymization or pseudonymization) you are claiming.

Sources

• GDPR Article 4(5) — Pseudonymization definition
• GDPR Recital 26 — Anonymous information
• EDPB Guidelines 05/2022 on Pseudonymization
• TrustArc — GDPR Anonymization and Pseudonymization