Redacting national ID numbers: when and how to do it properly
National identification numbers appear on passports, payslips, tax letters and many letters from health insurers and employers. In the Netherlands it is the BSN (burgerservicenummer), in the UK the National Insurance number, in Germany the tax ID (Steuer-ID) and in Italy the codice fiscale. Each is linked to exactly one person, which makes it valuable to fraudsters. This article explains when you should remove such a number and how to do it safely.
Why do ID numbers get extra protection?
The GDPR lets Member States set specific conditions for processing a national identification number (Article 87 GDPR). The Netherlands, for example, did so in Article 46 of its GDPR Implementation Act (UAVG): the BSN may only be used to carry out the law that prescribes it or for purposes laid down by law. In Germany, the use of the tax ID is restricted by section 139b of the Fiscal Code (AO).
In practice: tax authorities, local government, healthcare providers, insurers and employers (for payroll) may use these numbers because a law requires it. A web shop, gym, landlord or club generally has no reason to ask for or store them.
The main risk of a leaked ID number is identity fraud: combined with a name, date of birth and a copy of an ID document, criminals can pose as someone else.
When should you redact an ID number?
- Copies of ID documents: do you have to hand over a copy of your passport or ID card to someone who does not need your ID number? Make the number, and if possible the photo, unreadable. In the Netherlands the government offers the free KopieID app for this, which also adds a watermark with the purpose and date.
- Sharing letters and documents: are you having a letter from the tax office or your insurer checked by an adviser, relative or AI assistant? Remove the number. The recipient almost never needs it to answer your question.
- Examples and publications: sample letters, training material, forum posts and published documents should never contain a real ID number.
- Internal forwarding: forwarding a file, as an employer or care provider, to someone who doesn't need the number for their task? Leave it out.
How to redact an ID number safely
In a text or letter
The simplest and safest method is to remove the number from the text itself, rather than placing a black box on top of it. Paste the text into VerumVault: the tool detects ID numbers and replaces them with a label such as [ID_NUMBER_1], along with names, addresses and IBANs. Then check whether the number also appears elsewhere, for example in a reference.
In a PDF
Drawing a black rectangle with an ordinary PDF editor or highlighter is not enough: the text underneath often remains and can be copied or searched. Use a real redaction function (often called "Redact") that actually removes the text. Test the result: select the black area and copy it into a text editor. Does the number appear? Then it has not been redacted properly. Read more in How to redact a document safely.
On a scan or photo
A scan is an image. Cover the number with a fully opaque box and save the image as a new, flattened file (for example as JPG or PNG, or by "printing" it to PDF again). Avoid blurring or pixelating: that can sometimes be reversed, especially for short strings of digits.
Tip: keep the original separately and share only the cleaned copy. Put "anonymised" in the file name so nobody forwards the original by mistake.
Is a leaked ID number a data breach?
If an organisation accidentally sends a document containing an ID number to the wrong person, that is a personal data breach (Article 4(12) GDPR). Because ID numbers are sensitive to fraud, the organisation will in many cases have to report the breach to the supervisory authority within 72 hours (Article 33 GDPR) and sometimes inform the people affected (Article 34 GDPR). Prevention is far better than cure.
Read also: Anonymise a document in 3 steps and GDPR for small businesses.
Anonymise your document for free with VerumVault →Runs locally in your browser · no upload · no accountFrequently asked questions
Can a landlord ask for my national ID number?
Generally not. A landlord usually has no legal basis to process it. If you hand over a copy of your ID, black out the number.
Can my employer use my ID number?
Yes. Employers need it for payroll and tax reporting, for which there is a legal basis.
Is a black box in a PDF enough to hide an ID number?
Not always. In many programs the text underneath remains. Use a real redaction function or remove the number from the text itself, and test the result by copying.
Does VerumVault detect ID numbers?
Yes. VerumVault detects, among others, the Dutch BSN, the German tax ID and the Italian codice fiscale, locally in your browser. Always check the result yourself.