BlurDataGDPR · Data privacy on Mac
GDPR data discovery and DSAR redaction, on your Mac
BlurData finds the personal data in your documents, helps you answer a data subject access request without exposing anyone else, and gives you a record of what it found. Detection, review and export run on your Mac. Your documents are never uploaded.
What BlurData does for GDPR work
- Data Discovery. Scan PDFs, scans, photos and whole folders for names, emails, addresses, account numbers, ID numbers and more. Every person and value is listed with its pages, and the list exports as a CSV inventory.
- Data Subject Requests (DSAR). See where the requester appears, remove third parties and anything you withhold, export one clean copy per document, and check the copies before you send them.
- Compliance Management. Data minimisation, pseudonymisation and privacy by design are part of the workflow. The same versioned presets on every Mac in the team. Nothing is uploaded, so there is no data processing agreement to sign with us for your documents.
General information about GDPR, not legal advice. BlurData supports these tasks. Your organization's policies and decisions stay yours.
- Made in Europe
- 100% offline
- 14-day money-back guarantee
Data discovery in BlurData: every person, address, email and amount found in a 27-page document, with spellings, count and pages. Export key… saves the list as a CSV.
Data Discovery: find the personal data in every document
Personal data hides where a search box can't reach it: scanned letters, photographed forms, screenshots, 80-page case files. BlurData reads every page on your Mac, text layer and image alike, and marks what it finds before anything is saved.
Whole folders at once
Pick a folder and every PDF and image inside it is loaded and scanned with the same rules. One letter or a whole case file, every page gets the same treatment.
Scans, photos and screenshots
Every page goes through on-device text recognition, so a scanned letter is searched like a digital PDF. PDF, PNG, JPEG, HEIC, TIFF and WebP. Word files go in as PDF.
Built-in detectors
Names and surnames, linked across pages and files. Emails, postal addresses, account numbers and IBANs, amounts, IP addresses, web links, license plates, barcodes and QR codes, and phone numbers when you switch them on.
Presets per country and document type
Free presets add the identifiers of a document type: national ID and tax numbers, dates, record numbers. Medical records for the US, UK, Switzerland and Germany, payslips, tax forms, bank statements, invoices, court documents, ID cards. BlurData recognizes the type of document and suggests the matching preset.
Your own identifiers
Employee numbers, customer IDs, case references: add a pattern once and it is found in every document, on every page. A document type is missing? We write the preset for you, free, usually within 24 hours.
Nothing leaves the Mac
Reading, detection and review happen on the Mac in front of you. No upload, no account, no cloud service between your documents and the result.
A personal data inventory, per document
Switch to Pseudonymize and open Entities. Every person and value BlurData found becomes one card: the label it gets, the spellings found (Eleanor, Whitfield, ELEANOR WHITFIELD), how many times it appears and on which pages. Merge two cards that are the same person, split a wrong merge, double-click a card to jump to its page. Then Export key… saves the whole list as a CSV file:
| Label in the document | Original text | Kind | Pages | Also written as |
|---|---|---|---|---|
| [PERSON_1] | Eleanor Whitfield | People | 1, 2, 3, 4, 5, 6, 9, 12 | Whitfield; Eleanor; ELEANOR WHITFIELD |
| [PERSON_2] | Thomas Reeve | People | 1, 2, 26 | Reeve; Contact Reeve |
| [ADDRESS_1] | 14 Orchard Lane | Addresses | 2 | |
| [EMAIL_1] | [email protected] | Emails | 2 | |
| [AMOUNT_2] | £250,000 | Amounts | 3, 4, 7 |
Sample data. The columns are the ones BlurData writes. The file opens in Excel or Numbers. It holds the real values, so keep it apart from the documents.
Data Subject Requests (DSAR): answer an access request without exposing anyone else
Under GDPR Article 15, anyone can ask an organization for a copy of the personal data it holds about them. You usually have one month to reply (Article 12(3)). And the copy must not adversely affect the rights and freedoms of others (Article 15(4)). In practice, the emails, reports and scans you hand over have to be cleaned of everyone else's data first. That is the slow part, and it is the part BlurData does.
Subject: Eleanor Whitfield, return to work
Anna Kowalski confirms Eleanor can start on 3 March. Call Anna on 0161 496 0732.
Subject: Eleanor Whitfield, return to work
confirms Eleanor can start on 3 March. Call on .
The requester, Eleanor Whitfield, stays readable. The colleagues who wrote about her are removed. (Sample data.)
Gather the documents
Export the emails, HR files, tickets and scans that mention the requester into one folder. Drop the folder on BlurData: every document inside is loaded and scanned.
Find the requester, and everyone else
Switch to Pseudonymize and open Entities. Type the requester's name in the filter to see how often they appear and on which pages. The other people are the third parties: colleagues, other customers, family members. Their emails, phone numbers and account numbers have cards of their own.
Remove the third parties
Switch to Redact. Double-click a third party's name and choose Hide everywhere: it disappears from every document you loaded. Keep the detectors on for identifiers that belong to other people, and turn off the ones that would hide the requester's own data.
Withhold what you may withhold
Draw a box over passages you hold back, such as legally privileged advice or confidential notes about someone else. Do the same for faces, signatures and handwriting on scans.
Export clean copies
Save Each Document Separately writes one redacted file per document, named after the original, in a folder you choose. The text under the boxes is removed from the file, not covered, and the original's metadata is not carried over.
Check, send, keep a record
Run the copies through the free checker below, then search each copy for the third parties' names. Nothing should come up. File the copies you sent with the request, together with the CSV inventory of the personal data found in the documents you reviewed.
Free check before you send. Our redaction checker looks for text left under black boxes and in the file's properties, right in your browser. Your file is never uploaded.
Check a redacted PDFWhere BlurData fits in a DSAR
| Step | Who does it |
|---|---|
| Log the request, confirm the requester's identity, track the deadline | Your process, or your request tracking tool |
| Collect the documents from mail, HR, CRM and paper files | Your team. BlurData opens a whole folder at once |
| Find the requester's data and third parties' data in the documents | BlurData |
| Redact third parties and withheld passages | BlurData |
| Export clean copies and verify them | BlurData and the free redaction checker |
| Send the copies and keep a record | Your team, with the CSV inventory from BlurData |
Erasure requests, when a document has to stay
BlurData does not delete records in your systems. But when someone asks to be erased (Article 17) and a document that mentions them is still useful, such as a report, a case file used as a template or an archive kept for statistics, BlurData makes a copy that no longer identifies them. Redact removes them. Pseudonymize replaces them with a label, and if you never export the key, that label leads nowhere. Deleting the original stays your step.
Compliance Management: GDPR principles built into the workflow
Compliance is your organization's policies, records and decisions, and no app provides it. What BlurData does is make the document part of it easy to do the same way every time, and easy to show.
Data minimisation
Article 5(1)(c): share only what the recipient needs. Redact before a document goes to a colleague, a client, a court or an AI tool. The content stays readable, the people don't travel with it.
Pseudonymisation
Each person and value becomes a consistent label such as [PERSON_1]. The key that links labels to real values is a separate file that only you hold, as Article 4(5) describes. Article 32 lists pseudonymisation among the security measures to consider.
Data protection by design
Article 25: detection, text recognition, review and export run on the Mac. No upload, no account, no cloud copy of your documents. There is nothing to configure for that: it is how the app works.
No processor in the chain
Your documents never reach us, so we don't process the personal data in them on your behalf. There is no data processing agreement (Article 28) to sign with BlurData for your documents, and no international transfer to assess.
Records you can show
Article 5(2) asks you to be able to demonstrate what you did. The CSV inventory records which personal data a review found and on which pages. File it with the request or the project, next to the redacted copies.
The same rules on every Mac
Presets are versioned and come from one library, so everyone on the team who installs a preset applies the same rules. Installed presets you haven't edited update themselves at launch. The Team plan covers 5 Macs with one license key.
Presets in the library today include US, UK, Swiss and German medical records, German, Italian and French payslips, US W-2 and 1099 statements, UK tax returns, bank statements, invoices from five countries, Italian, German and Belgian court documents, and German and Spanish ID cards. See every preset.
Working with US health records? See HIPAA de-identification before AI and redacting medical records.
Frequently asked questions
What is data discovery in BlurData?
Finding the personal data inside documents: PDFs, scans, photos and screenshots, one file or a whole folder. BlurData marks every match on every page, lists each person and value in Entities with its pages, and exports the list as a CSV inventory. It works on the files you open. It does not crawl servers, mailboxes or databases.
How does BlurData help with a data subject access request (DSAR)?
It does the document part. You collect the files that mention the requester. BlurData shows where the requester and other people appear, you remove the third parties and any passage you withhold, and it exports one clean copy per document. A free checker confirms nothing is left under the boxes. Logging the request, confirming identity and the one-month deadline stay in your process.
Can I redact third parties and keep the requester's data?
Yes. Hide each third party by name with Hide everywhere, which removes that name from every loaded document, and choose which detectors stay on for other people's emails, numbers and IDs. Draw a box over anything else you withhold. Every change shows on the page before you export.
Does BlurData help with the right to erasure?
Partly. It does not delete records in your systems. When a document that mentions the person is still needed for another reason, BlurData makes a copy without them, redacted or pseudonymized without a key, to keep in place of the original.
Do we need a data processing agreement (DPA) with BlurData?
Not for your documents. They are read, analyzed and exported on your Mac and never reach us, so we don't process the personal data in them. The app contacts our servers to activate the license, check for updates and download presets, and never sends document content or file names.
Is BlurData GDPR certified?
No. BlurData holds no GDPR certification and no security certification such as ISO 27001 or SOC 2, and no app can make an organization compliant on its own. BlurData is built for GDPR work: data minimisation, pseudonymisation as Article 4(5) defines it, and processing that stays on your Mac.
Can a whole team apply the same rules?
Yes. Presets come from one versioned library, so everyone who installs the same preset applies the same rules, and installed presets you haven't edited update themselves. The Team plan covers 5 Macs with one license key. For a document type that is missing, we write the preset for you, free, usually within 24 hours.
Does this work for UK GDPR, CCPA and other privacy laws?
The document work is the same everywhere: find, separate, redact, export, check. UK GDPR keeps the same right of access as the EU GDPR. California's CCPA gives consumers a right to know, with 45 days to reply. For US health records, see our HIPAA guide.
This page is general information about GDPR, not legal advice. Deadlines, exemptions and what you may withhold depend on your country and your case. Ask your data protection officer or lawyer.