Pixelation vs blurring vs solid masking: which redaction method holds up under GDPR?
When personal information appears in video footage, simply placing an effect over someone's face is not enough to demonstrate that the information has been adequately protected. Under the GDPR, organizations need to consider whether people can still be identified and whether the technical and organizational measures used are appropriate for the circumstances.
That makes the choice between pixelation, blurring, and solid masking more important than it might initially appear. Each method changes the visibility of information differently, and the right choice depends on factors such as the original footage quality, movement, the size of the area being concealed, and what the resulting video will be used for.
There is also an important distinction between redaction and true anonymization. A visual effect can restrict access to personal information in a disclosure copy without necessarily making the underlying data anonymous for every possible purpose. The European Data Protection Board's 2026 anonymization guidance reinforces the importance of considering whether individuals can actually be identified in the circumstances, rather than assuming that applying a particular technical technique automatically achieves anonymization.
What does GDPR require from video redaction?
The GDPR does not prescribe one specific visual redaction technique.
Instead, organizations processing identifiable people through video surveillance need to consider their wider data protection obligations, including the principles of data minimization, security, transparency, and data protection by design and by default. The EDPB's guidance on video devices emphasizes that surveillance processing must have an appropriate legal basis and should not collect or use more personal data than necessary for the stated purpose.
For organizations responding to a subject access request, for example, the objective may be to provide information about the requester without unnecessarily revealing information about other people appearing in the same recording.
The UK's Information Commissioner's Office specifically identifies blurring, masking, and solid fill as possible techniques for CCTV and body-worn video redaction. It also makes clear that the most appropriate technique depends on how the footage was created and its quality.
So there is no GDPR rule stating that pixelation is compliant while blurring is not, or that solid masking is automatically preferable. The important question is whether the selected approach adequately protects the information in the particular circumstances.
How pixelation works
Pixelation replaces detailed areas of an image with larger blocks of color. When applied to a face, for example, the person's facial features become increasingly difficult to distinguish.
The technique is familiar because it has been used in television and online media for decades. It can also be computationally straightforward because the software does not need to reconstruct the obscured area; it simply reduces the visible detail.
However, pixelation has an inherent limitation: the original visual structure is still partially represented.
A sufficiently large pixelated face may provide little useful information to someone viewing the recording normally. But the effectiveness of the effect depends on how aggressively the image has been degraded, the resolution of the source footage, and what other information remains visible.
A face that appears heavily pixelated in a low-resolution preview may contain more residual detail when the underlying recording is high resolution. If the masking area is too small, other identifying features can also remain visible around it.
How blurring works
Blurring smooths visual detail within a selected area rather than replacing it with discrete blocks.
A Gaussian-style blur, for example, can make facial features indistinct while maintaining some visual continuity with the surrounding scene. This can produce a less visually disruptive result than a solid block, which may be useful when the recipient still needs to understand what is happening in the scene.
But visual subtlety should not be confused with stronger privacy protection.
The amount of blur matters enormously. A lightly blurred face may still retain enough information to make identification possible, particularly when combined with other details in the recording. The effectiveness also depends on the original footage and the processing applied during export.
For that reason, organizations should assess the actual resulting footage, rather than assuming that an effect labelled "blur" provides a predetermined level of protection.
How solid masking works
Solid masking takes the most straightforward approach: the sensitive area is completely covered by an opaque shape.
Instead of transforming the underlying image, a solid mask prevents the viewer from seeing it altogether. A black rectangle over a face, for example, provides an obvious visual barrier between the original information and the person receiving the redacted copy.
This can be particularly useful when maximum visual obscuration is more important than maintaining the appearance of the original scene.
There is, however, a trade-off. A large opaque mask can remove contextual information that might otherwise help someone understand what happened. If the masked area covers a significant part of an incident, the resulting footage may be harder to interpret.
The objective should therefore be complete protection of unnecessary personal information without unnecessarily destroying relevant context.
Which technique is most secure?
There is no universal winner.
The ICO explicitly recognizes all three approaches as potential redaction techniques and says that the appropriate method depends on the circumstances and quality of the footage.
A useful way to compare them is to consider what happens if someone deliberately examines the resulting recording for information that remains visible.
| Method | Main Advantage | Main Risk | Suitable Consideration |
|---|---|---|---|
| Pixelation | Familiar and visually clear | Residual detail may remain | Appropriate strength and export quality are essential |
| Blurring | Preserves more visual context | Weak blur may leave identifying information visible | Useful where scene continuity matters |
| Solid masking | Completely obscures the selected area | Can remove useful visual context | Strong option where visibility is unnecessary |
The method should be selected based on the risk and purpose of the disclosure, rather than aesthetic preference.
If a face needs to be completely concealed from a third party, preserving the general appearance of the face may not provide any benefit. Conversely, if a small visual area needs protection while the surrounding scene remains important evidence, a carefully controlled redaction may provide a better balance.
Redaction strength matters more than the label
One of the easiest mistakes is to think in terms of software effects rather than outcomes.
"Blurred" does not automatically mean "unidentifiable." "Pixelated" does not automatically mean "anonymous." And a solid rectangle does not necessarily protect information elsewhere in the frame.
Consider a CCTV camera positioned outside a business. A person entering the building might have their face blurred, but their distinctive clothing, name badge, vehicle, or companion could still make them identifiable.
The GDPR's concept of personal data extends beyond one isolated identifier. Identification can arise from information considered together, which means redaction should be assessed in context.
The ICO similarly warns that effective anonymization depends on contextual factors and that techniques such as blurring or masking do not guarantee anonymization simply because they have been applied.
Don't forget movement
Static images are comparatively easy to redact. Video is much harder because the subject moves.
A face can enter the frame, turn sideways, move behind another person, leave the scene, and reappear somewhere else. A redaction that remains perfectly positioned for one frame may drift away from the target moments later.
This is where tracking becomes a critical part of video privacy workflows.
An organization should verify that the selected redaction remains attached to the intended subject throughout the relevant sequence. Particular attention should be paid to crowded environments, partial obstructions, rapid movement, changes in lighting, and people crossing in front of one another.
The ICO's CCTV guidance specifically recommends that organizations have the ability to efficiently and effectively blur or mask footage where redaction is required to protect the rights and freedoms of third parties.
The exported file is what matters
A redaction can look secure during editing but still fail if the final output is handled incorrectly.
Organizations should check the exported file rather than relying solely on the editing interface. The review should establish that the sensitive information remains concealed throughout the relevant sequence and that the effect cannot simply be disabled or removed in the delivered version.
Metadata may also need consideration. The ICO notes that organizations may need to remove metadata from footage files where necessary.
This is especially important when footage is being prepared for a third party. The disclosure copy should contain only what the recipient needs and should be transferred using appropriate security controls.
Automated redaction changes the scale of the problem
Choosing a technically appropriate masking method is only one part of the challenge. An organization processing thousands of hours of CCTV cannot realistically rely on someone manually locating every face and drawing an effect around it.
Automated detection can identify likely faces, license plates, screens, and other sensitive objects throughout a recording. Tracking can then help maintain the redaction as subjects move.
We built Secure Redact around this kind of workflow, combining automated detection and tracking with tools that allow teams to review and adjust redactions. That means an organization can use automation to handle repetitive identification while retaining human oversight for difficult footage and final quality checks.
The benefit is not simply speed. Consistent automated processing can give teams a repeatable method for dealing with large quantities of footage while reducing the chance that a reviewer overlooks a sensitive area buried deep within a recording.
Human review still matters
Automation should support a privacy process rather than remove human judgment from it.
A detection system can encounter unusual lighting, reflections, partial faces, unusual camera angles, crowded scenes, or objects that resemble faces. Tracking can also become less reliable when subjects overlap or disappear from view.
Human review provides an opportunity to catch those problems before disclosure.
A sensible process is therefore:
Detect → Track → Redact → Review → Export → Review Again
The second review is particularly valuable when footage is being released externally. It allows the organization to assess the final file as a recipient would see it rather than assuming that successful processing means successful redaction.
GDPR compliance goes beyond the visual effect
The choice between pixelation, blurring, and solid masking is only one element of a compliant video privacy workflow.
Organizations also need to consider why the footage is being processed, how long it is retained, who can access it, when it is disclosed, and whether people can exercise their data protection rights.
The EDPB's video-surveillance guidance stresses that organizations should consider necessity and proportionality when processing video data. Surveillance should not simply collect everything because technology makes extensive recording possible.
The ICO also recommends considering governance capabilities when selecting surveillance technology, including whether footage can be uploaded, stored, audited, retrieved, and redacted when necessary.
That means a strong redaction system should fit into the wider governance process rather than functioning as an isolated editing tool.
Choose the method based on the risk
There is no single redaction effect that satisfies every GDPR scenario.
Pixelation can be effective when applied strongly enough and reviewed carefully. Blurring can provide a natural-looking result while concealing sensitive detail. Solid masking offers an unmistakable barrier where visual context within the masked area is not required.
The important consideration is whether the final recording prevents inappropriate identification while retaining the information genuinely needed for its intended purpose.
Our approach with Secure Redact is to give teams control over that decision rather than forcing every situation into the same visual treatment. Automated detection and tracking can identify where redaction is needed, while reviewers can assess the footage and apply the appropriate treatment for the circumstances. Get started with a free trial today.
A strong redaction workflow is more important than a single technique
GDPR does not demand that every face be pixelated, blurred, or covered with a particular color. It demands responsible handling of personal data, and the appropriate technical measures depend on the circumstances.
For video, that means looking beyond the name of the effect. Consider the source quality, movement, surrounding identifiers, intended recipient, purpose of disclosure, and whether the final file genuinely prevents unnecessary identification.
The strongest approach is therefore not simply choosing between pixelation, blurring, and solid masking. It is establishing a workflow that identifies sensitive information reliably, applies an appropriate level of protection, preserves relevant context, and verifies the final output before it leaves the organization's control.
Frequently asked questions
-
No. GDPR does not prescribe pixelation, blurring, solid masking, or another specific technique. Organizations need to select appropriate technical and organizational measures for the circumstances.
-
Not necessarily. The effectiveness of pixelation depends on factors including its strength, the original footage quality, and other information that may remain visible.
-
A solid mask completely obscures the selected visual area, but that does not automatically make it the appropriate choice. It can remove useful context that a less intrusive technique would preserve.
-
Potentially. If an individual remains identifiable from the blurred image or from the combination of information available in the footage, the underlying information may still constitute personal data.
-
Not in every situation, but license plates can contain information that contributes to identifying a person. Organizations should assess them according to the purpose of processing and disclosure.
-
No technology can guarantee compliance on its own. Automated tools can support detection and processing, but organizations still need appropriate policies, legal assessments, security controls, human review, and governance.
-
The appropriate retention period depends on the purpose and applicable requirements. Where the original must be retained, it should be protected separately from the disclosure copy and handled according to the organization's retention and security policies.
-
Yes. Effective redaction should remove information that does not need to be disclosed while retaining relevant visual context. The amount of information removed should therefore be carefully considered rather than simply maximizing the size of every redaction.