Is sending a PDF to an online tool processing by a processor under GDPR?

Yes. As soon as a document containing personal data transits to a third-party server, that service acts as a processor — requiring a processing agreement under Article 28 and, if the server sits outside the EU, a transfer analysis.

Does local processing remove all GDPR obligations?

No. You remain responsible for processing on your own device. Local processing only removes the processor chain for the document manipulation itself: no DPA to negotiate and no transfer analysis to document for that operation.

How can you prove a PDF was not uploaded?

Open developer tools (F12), Network tab, drop the file and run the operation. If no request carries a body the size of the document — and the tool works offline after the initial load — the PDF stayed local.

Is a black rectangle enough to redact a PDF?

No. A plain black rectangle leaves the underlying text extractable. Safe redaction must rasterize the page or remove the text object. Document Flare's redact tool rasterizes the concerned pages to image, making the text unrecoverable.

GDPR/Legal

GDPR and PDF: how local processing shrinks your compliance perimeter

Processing PDFs containing personal data without sending them to a processor: what the GDPR requires, and why local browser processing mechanically removes a whole compliance chain.

Published on September 19, 2026Updated on September 26, 20267 min readby Hamza El Hajjaji

This page contains affiliate links: we may earn a commission if you use them, at no extra cost to you. This does not influence our recommendations. As an Amazon Associate, we earn from qualifying purchases.

Table of contents

The PDF, a concentrate of personal data

Contracts, payslips, patient files, ID documents, invoices: PDF remains the reference format for sensitive documents. Unlike a web page that renders and is forgotten, a PDF embeds its content, structure, metadata and sometimes attachments in a single file. The moment you process it online, you transfer all of that to a third party.

The GDPR does not apply to the format itself but to the personal data it carries. Address, social security number, IBAN, e-mail address, phone number: a single page can hold several. Before sending a document anywhere, it is worth asking what truly needs to leave your perimeter.

Fellowes 6M — P-4 micro-cutP-4 micro-cut: right for ID documents and financial papers.affiliate

Three notions drive the approach.

Legal basis. Any processing of personal data must rest on one of the bases in Article 6: consent, contract, legal obligation, public interest mission, vital interests or legitimate interest. Merging contracts for an HR file, compressing supporting documents for a tax filing or forwarding an accounting statement each fall under a different basis. The choice engages the controller’s responsibility.

Minimization. Article 5 requires limiting collected data to what is “necessary” for the declared purposes. Sending a full document to an online service when a single page would suffice, or keeping a file longer than needed, runs against that principle.

Processors and transfers. When you drop a PDF on a third-party server, that server becomes a processor within the meaning of Article 28. You must then ensure a data processing agreement, guaranteed security measures and — if the server sits outside the European Union — a framework for the transfer. These obligations rest on the controller, not on the tool alone.

Local processing changes the geography of risk

When PDF manipulation happens in the browser, on your device, the document never crosses your machine’s boundary during processing. The bytes are read locally, computation is offloaded to Web Workers, and the result is rebuilt in memory before being offered as a download via a Blob object. No account is required, no document server stores the file.

Mechanically, this removes the “cloud processor” link from the chain for the document manipulation itself: no agreement to negotiate for that operation, no transfer analysis to document, no purge delay to hope for on a third party’s side. For that manipulation, there is no Article 28 contract to sign — there is no identified processor.

The absence of upload is technically verifiable: open the developer tools’ Network tab, then go offline after the initial load. If the tool keeps working, the PDF stayed put. The clause-level reading of what cloud tools actually do with files is in where do your files go.

What stays local, what still crosses the network

“Local” does not mean “zero requests”. Several flows remain normal.

Page and asset loading. The site, its scripts, fonts and icons arrive from the server, like any web application.

Ads and consent. On public pages, Document Flare loads AdSense with a TCF v2.2 consent platform — the script itself loads unconditionally, but ad requests are gated by consent. The tool routes (/tools/) display neither ads nor a consent banner.

OCR and AI models in cache. Local OCR uses Tesseract WASM; models download once, then are cached. Summary and translation features rely on the browser’s APIs (Chrome or Edge 138+). Semantic search loads a ~115 MB model via Transformers.js. In every case traffic flows server-to-browser, never the reverse: the PDF does not leave.

Concrete actions: clean metadata, redact before sending

Two local tools answer the GDPR risks of PDF directly.

Cleaning metadata. A PDF’s Info dictionary can hold title, author, subject, keywords, creator, producer, creation and modification dates; an XMP stream may store more. The sanitize-pdf tool optionally removes that metadata, JavaScript actions (OpenAction, AA, embedded scripts), attachments and annotations. Page content stays intact.

Redacting before transmission. The redact-pdf tool locally detects common personal data — IBAN, French social security numbers (NIR), bank card numbers, SIREN/SIRET identifiers, e-mail addresses, phone numbers, birthdates with context, IPv4 addresses — then draws black rectangles and rasterizes the concerned pages to image. The text under those zones is no longer extractable. You can also enter keywords manually for names, addresses or any field the detector misses.

Careful: automatic detection is not exhaustive. A scan without a text layer, a broken font, a proper noun without context or an exotic identifier can escape it. Human review remains necessary before any sending.

What local processing does not exempt you from

Local processing does not “make you compliant”. It removes a processor risk, not the whole set of obligations.

You remain responsible for the legal basis, retention periods, the security of your own device, access control on the produced file and its final transfer by e-mail or messaging. Malware, a nosy browser extension, a system administrator or a simple sending mistake can leak a file that never left your browser. Local processing protects against server-side exposure; it does not protect against a compromised device or mishandling.

Finally, the tool is no substitute for legal advice. GDPR interpretation varies with your sector, your country of establishment and the exact nature of the data. If you process health data, biometric data or criminal-conviction data, specific rules apply on top.

In practice

For an HR team merging contracts, a firm preparing supporting documents or an individual transmitting administrative paperwork, the workflow can be:

Open the tool in the browser.
Strip unneeded metadata with sanitize-pdf.
Redact sensitive zones with redact-pdf.
Password-protect the file if the recipient must receive it encrypted.
Send the document over a secure channel and keep a record of the planned retention period.

This chain mechanically reduces personal data flows. It does not remove them all, but it eliminates the most opaque one: systematically sending the complete document to a third-party server.

To go further: what local processing really protects details the threat model, where do your files go reads the retention policies of cloud tools clause by clause, and redacting personal data in a PDF walks through removing personal data before sending.