Redacting Personal Data from TA Forms: UK GDPR Compliance for Conveyancers

Last updated: 5 May 2026

Quick answer

Before sharing TA6, TA7, TA10, or any other property information form with a third party (mortgage broker, removal company, surveyor), redact personal data the recipient does not need: dates of birth, full addresses for parties not involved in the transaction, telephone numbers, bank account details, and references to medical conditions or other special-category data. UK GDPR Articles 5 and 6 require data minimisation and a lawful basis for sharing. Use a permanent redaction tool — flatten the PDF before sending — not a black highlight. Keep an unredacted master copy on the file. SRA Principle 2 (acting in a way that upholds public trust and confidence in the solicitors' profession), the SRA Code of Conduct paragraph 6.3 (confidentiality of client information), and the CLC's confidentiality obligations under its Code of Conduct and Acting in the Best Interests of Clients Code all reinforce the data-minimisation duty.

---

Why redaction matters in conveyancing

Conveyancing is one of the most data-intensive areas of legal practice. A single transaction generates:

• Seller's name, age, marital status, family circumstances
• Buyer's name, source of wealth, source of funds, employer, salary
• Property history including disputes, neighbour relations, complaints
• Service charge arrears, leasehold breaches
• Building defects, planning issues, environmental risks
• Sometimes: medical conditions affecting a property feature (e.g. lift, accessibility)

When the conveyancer shares the pack with a mortgage broker, surveyor, removal company, search provider, or AML check service, only a subset of that data is genuinely needed. UK GDPR Article 5(1)(c) — the data minimisation principle — requires controllers to share only what is "adequate, relevant and limited to what is necessary". Sharing the full pack with everyone is a textbook breach.

The Information Commissioner's Office routinely investigates conveyancing data breaches. Most are accidental — a TA6 emailed to the wrong address, a completion pack with the buyer's mobile number in front of a third-party builder. The fix is process: redact before share, every time.

---

What needs redacting (and what does not)

Different recipients need different subsets. Use this matrix as a starting point.

The buyer's solicitor and the lender on a panel mortgage need the unredacted pack — they have a legitimate interest, a clear lawful basis, and parallel obligations of confidentiality. The other recipients in the chain do not.

---

Special category data

UK GDPR Article 9 lists special category data — race, ethnic origin, political opinions, religious beliefs, trade-union membership, genetic data, biometric data, health data, sex life, sexual orientation. Special category data needs a higher bar for sharing — Article 9(2) lawful conditions, not just Article 6.

In conveyancing, special category data tends to surface in:

• TA6 disclosures about a neighbour's conduct ("neighbour suffers from a mental health condition")
• TA7 leasehold information about service-charge disputes mentioning a neighbour's age or disability
• TA10 fittings statements that reference medical or accessibility equipment installed (stair lifts, hoists, adaptations) — where the equipment identifies a particular current occupant's health condition or disability, this can engage Article 9
• Searches that reveal planning history mentioning a specific use (e.g. care home conversion)

Where special category data appears, the default is to redact unless the recipient has a clear Article 9 basis. The buyer's solicitor usually does (provision of legal services). The mortgage broker, surveyor, and removal company usually do not.

---

How to redact properly

The right way: permanent redaction with flattening. The wrong way: black highlight or "draw a black box" in a PDF reader.

What "permanent redaction" means

A proper redaction tool:

1. Removes the underlying text from the PDF
2. Removes any underlying image data the redaction is meant to cover
3. Flattens annotations so the redaction cannot be moved or removed
4. Re-saves the PDF as a new document

After permanent redaction, no amount of forensic PDF analysis will recover the redacted content.

What "black highlight" looks like — and why it fails

A black highlight (or a black filled rectangle drawn over text) does NOT remove the underlying text. The text is still there, hidden behind a coloured shape. Anyone who:

• Copies and pastes from the PDF
• Opens the PDF in a different reader
• Uses a PDF text extraction tool
• Opens the file in a browser plug-in

...will see the original text. There have been multiple high-profile UK government redaction failures (the 2003 "Hutton Report" Word document; multiple Ministry of Defence scandals; FOI releases) where this exact mistake leaked classified material.

The conveyancing equivalent: a TA6 with a child's date of birth covered by a black box, sent to a mortgage broker, who copies the buyer's contact details into their CRM and accidentally exposes the redacted content.

Tools that redact properly

A redaction tool fit for conveyancing should:

• Operate at the text-and-image level, not annotation level
• Allow permanent removal with explicit flattening
• Generate a redacted-output file separate from the source
• Include a redaction log (what was redacted, by whom, when)

Adobe Acrobat Pro has a Redact tool that does this. Some specialist legal-document platforms (including BundleCreator) include redaction. Free PDF readers (Preview on macOS, the basic Edge or Chrome PDF viewer) do not — they only highlight.

If you must redact in a tool that does not support permanent redaction:

1. Print the document on paper
2. Black out the sensitive text with a permanent marker
3. Re-scan
4. OCR the rescanned document so it remains searchable for the recipient

This is slow but it is forensically sound.

---

What to keep on file

Always keep an unredacted master of every TA form on the file. The redacted version is what you share; the master is what you retain.

If a dispute arises later — a query about what the seller actually disclosed, an SRA enquiry, an Information Commissioner investigation — you need the unredacted version to demonstrate what was originally captured.

The Solicitors Regulation Authority's SRA Standards and Regulations and the Council for Licensed Conveyancers' Code of Conduct both expect proper file-keeping. UK GDPR Article 5(1)(e) requires data not to be kept longer than necessary — which for completed transactions is typically 6-15 years (insurer-driven; see your firm's retention policy).

---

A worked example

The mortgage broker has asked for the TA6 so they can confirm valuation drivers for the lender. Steps:

1. Open the unredacted TA6 from your case management system
2. Save a copy as TA6_redacted_for_broker.pdf
3. Open the copy in Adobe Acrobat Pro (or a redaction-capable tool)
4. Mark for redaction:
   • Seller's date of birth
   • Seller's mobile number and email
   • Neighbour's name in dispute disclosure
   • Bank reference numbers
5. Apply redactions (this is the permanent step — Acrobat will warn you it cannot be undone)
6. Save and check — open the file in a different PDF reader and verify the redactions hold
7. Email to the broker
8. Log the redaction in your case file

The first time you do this it takes 10-15 minutes. After three or four it is a 3-5 minute task.

---

What about the conveyancing portal?

Many lenders now use a portal that requires upload of the full pack, with the lender's own permission system controlling who sees what within the lending team. This is a legitimate transfer to the controller (the lender as data processor for its loan-decisioning purposes) and does not need redaction at your end.

Brokers and intermediaries are different. A broker is usually a separate controller pursuing their own sales / referral / compliance purposes. They need only what is necessary for their role.

---

Common errors — and how to spot them

---

How BundleCreator helps

BundleCreator's Conveyancing module includes redaction. Workflow:

1. Upload TA6 / TA7 / TA10 to the matter
2. Select redaction tool
3. Mark each personal-data field — drag to highlight, click to mark
4. Apply — text is removed at the layer level, document is flattened
5. Generate a redacted output PDF
6. Original file remains on the matter, unredacted, for your records

Redaction logs are kept against the matter so you can demonstrate compliance during an SRA file-review or ICO enquiry. UK-region hosting means the personal data does not cross borders during processing.

---

Frequently asked questions

Do I need consent to share a redacted TA form with a broker?

Usually no. The lawful basis is normally Article 6(1)(f) (legitimate interests — supporting the buyer's mortgage application, with appropriate redaction so only the data necessary for the broker's role is shared). Article 6(1)(b) (performance of contract) can apply to the buyer's own data where the broker is engaged by the buyer, but does not generally support sharing the seller's TA6 data — for that, (1)(f) and a documented legitimate interests assessment is the correct route. Consent is rarely the right basis and should only be relied on for purposes beyond the conveyancing transaction.

What if the seller asks me not to disclose something on the TA6?

You cannot omit a fact from the TA6 that the buyer needs to know. Sellers sometimes try to "redact" their own TA6 — that is not redaction, that is misleading the buyer. If the seller refuses to disclose, the conveyancer's role is to advise on the consequences (potentially misrepresentation under the Misrepresentation Act 1967). Redaction is for sharing with downstream third parties, not for hiding from the buyer.

What if I redact too much and the broker queries it?

Brokers will tell you what they need. Err toward more redaction; provide the additional information on request. The broker can ask for specific fields; you can unredact those fields specifically.

How long should I keep the unredacted master?

The standard retention period for conveyancing files in England and Wales is 6 years (limitation in contract) or 12-15 years (some firms extend for indemnity reasons). Your firm's retention policy will set this. UK GDPR requires not keeping personal data longer than necessary — 15 years is generally accepted as the maximum for residential conveyancing.

Does a Subject Access Request require me to disclose unredacted information?

A SAR from the data subject (e.g. the seller asking for their own data) requires you to provide their data. Third-party data within the file (the buyer's, the broker's, the lender's) is considered for redaction before the SAR response under DPA 2018 Schedule 2, Part 3, paragraph 16 (information about another individual), applying the reasonableness test in paragraph 16(2).

Is metadata an issue?

Yes. PDF metadata contains author, software, last-modified date, sometimes the case reference. Strip metadata before sharing. Acrobat Pro: File > Properties > Description (strip), and consider Advanced > Sanitize Document.

---

Further reading

• UK GDPR Articles 5, 6, 9 — Lawful basis and data minimisation
• ICO — Data sharing in legal proceedings — Regulator guidance
• SRA Standards and Regulations — Principle 2, Code of Conduct paragraph 6.3
• CLC Handbook — Code of Conduct + Acting in the Best Interests of Clients Code
• Conveyancing Completion Pack: TA6, TA7, TA10, SDLT1, AP1 in the Right Order
• Same-Day Completion Pack: Bookmarked, OCR'd PDFs Without the Stress