Video Redaction Workflow: Definition
A video redaction workflow is a structured organizational and technical process used to identify, assess, anonymize, verify, document, and archive video footage or images that contain personal data visible in the frame. In practice, this mainly concerns faces and license plates, and in selected cases also other identifying elements that require manual image redaction. In the context of data protection, the goal is not aesthetic editing, but processing footage in a way that reduces the risk of identifying a natural person while preserving the intended purpose of further use of the recording.
The main legal and interpretative basis for this process includes Regulation (EU) 2016/679 - GDPR, in particular Article 5(1)(c) and (f), Article 25, and Article 32, as well as Recital 26 on the identifiability of a person. In the case of a person’s likeness, national laws may also apply, including civil law provisions and copyright-related regulations. A video redaction workflow should therefore combine legal requirements, information security principles, and image processing techniques.
In the area of image and video anonymization, the workflow usually covers a sequence from footage acquisition, through risk analysis and object detection, to masking, quality control, export, and retention. If AI models are used, they are built with machine learning methods, most often deep learning, and then applied to detect faces and license plates frame by frame or based on object tracking throughout a sequence.
Stages of a Video Redaction Workflow in an Organization
A properly defined video redaction workflow must be repeatable and auditable. This means the organization should be able to demonstrate what footage was processed, for what purpose, under which procedure, and with what quality-control outcome.
In practice, the process can be described in the following stages:
- Footage identification - determining the source of the recording, the process owner, the purpose of processing, the categories of data visible in the image, and the legal basis.
- Risk classification - assessing whether the footage contains faces, license plates, or other elements that may enable identification. This stage also defines the required level of masking.
- Technical preparation - verifying the input format, codec, frames per second, resolution, footage length, and file integrity.
- Detection and redaction - automatically detecting faces and license plates and applying a blur mask or concealment effect. In Gallio PRO, automation applies only to faces and license plates.
- Manual redaction - manually obscuring elements that the system does not detect automatically, such as a document, ID badge, tattoo, logo, or content displayed on a monitor.
- Quality control - checking the completeness of anonymization on a sample or across the full footage, including difficult frames, motion, occlusion, and poor lighting.
- Export and output protection - saving the redacted version together with operational metadata, without retaining unnecessary personal data in logs.
- Documentation and archiving - recording the scope of redaction, the operator, the procedure version, and the retention period for both the source and output material.
Technologies Used in a Video Redaction Workflow
Video redaction workflow automation relies on computer vision analysis. For faces and license plates, the most common approach is to use detection models trained on labeled datasets. Deep learning is currently the most widely used method for building AI models capable of detecting objects under varied conditions, for example when perspective changes, scale varies, the object is partially obscured, or the image is compressed.
A typical technology stack includes:
- object detection in frames - faces, license plates,
- inter-frame tracking - keeping the mask on the same object in subsequent frames,
- pixel-level redaction - blur, pixelation, or full masking of the selected area,
- manual verification - corrections where automation is insufficient.
In environments with elevated security requirements, on-premise deployments are used to limit the transfer of footage outside the organization. This model can support the privacy by design principle under Article 25 GDPR and make it easier to control data location, permissions, and retention.
Key Parameters and Metrics in a Video Redaction Workflow
Evaluating the quality of a video redaction workflow should not rely on general claims. Measurable indicators are needed for detection effectiveness, redaction quality, and processing performance.
Parameter
Meaning
Practical application
Recall
The percentage of actual objects detected by the system
Critical for minimizing missed faces and license plates
Precision
The percentage of correct detections among all detections
Affects the number of false masks
False negative rate
The share of undetected objects
Directly linked to privacy breach risk
Processing time
Minutes of footage processed per hour of system operation
Supports resource planning and SLAs
Coverage review
The percentage of footage included in quality control
Defines the final confidence level
In practice, a simple missed-detection risk metric can be used:
Operational risk = number of undetected objects / total number of objects in the footage
If an organization processes evidentiary or publication footage, this metric should be as close to zero as possible, and the workflow must include mandatory manual review.
Challenges and Limitations of a Video Redaction Workflow
Even a well-designed video redaction workflow has technical and legal limitations. The biggest problems arise with low-quality footage, high crowd density, camera movement, reflections, night scenes, and strong lossy compression.
It is also important to distinguish the scope of automation from the full identification of all risks visible in an image. Gallio PRO automatically blurs only faces and license plates. It does not automatically detect logos, tattoos, nameplates, documents, or content shown on monitor screens. Such elements can be redacted manually in the editor. The software does not automatically anonymize full body silhouettes and is not designed for video stream anonymization or real-time processing.
There are also interpretative differences regarding license plates. In many European countries, the practice of masking them results from national law and the approach taken by data protection authorities. In Poland, positions are not entirely uniform - the Polish DPA (UODO) and CJEU case law support a precautionary approach to identifiability, while some Supreme Administrative Court rulings have indicated that a license plate alone does not always constitute personal data. In an organizational workflow, the safer option is usually adopted, namely redacting license plates before publishing or sharing footage.
Normative References and Compliance
A video redaction workflow should be linked to a formal information security and data protection management system. There is no single European technical standard that defines image redaction alone, so organizations should rely on a set of legal acts and horizontal standards.
- GDPR - Regulation (EU) 2016/679 - principles of data minimization, integrity and confidentiality, privacy by design, and security of processing.
- ISO/IEC 27001:2022 - information security management system, access control, logging of administrative actions, and incident management.
- ISO/IEC 27701:2019 - privacy extension for organizations processing personal data.
- ENISA - data security and privacy protection guidelines - a risk-based approach and technical safeguards.
A good practice is to maintain process documentation without storing logs that contain personal data derived from detections. In environments with heightened confidentiality requirements, this is important for limiting secondary data processing.