GDPR and customer support screenshots: bar EU PII first
Support teams: black-bar emails, phones, and addresses on screenshots before Slack or vendors. Practical GDPR-minded habits.
GDPR customer support screenshots are where EU personal data (PII) escapes: a Zendesk paste that still shows a shopper’s email, phone, and shipping street while you only needed the decline toast. Bar personal data on-device — Markup, Paint, Preview, or a browser tab — before the PNG hits Slack, a vendor, or a public status page.
How to redact GDPR PII in a support screenshot (step by step)
Cover email, phone, address, and government ID strings with Black bar. Soft Blur for faces in ID photos. Crop the CRM sidebar when other customers’ names are in the rail. Download PNG; do not forward the original capture.
On your phone or computer
Windows: Paint after Win + Shift + S — filled black rectangles over email, phone, address, and government ID strings in the ticket.
Mac: Preview Markup with a filled shape over the same PII. Soft blur on a short email is still readable.
Customer phone captures: Photos Markup or Android gallery solid covers first, then escalate the barred copy — not the original from Recents.
Or finish in a browser (optional)
Want to do it in a tab with no install? BlurThis is one free option. The file stays on your device. Other browser tools work too if they paint on the page and do not upload the image.
- Open the editor in your browser. No account needed for BlurThis.
- Drop the screenshot, tap Upload from PC or Mobile, or paste with Ctrl / ⌘ + V on a computer.
- Pick Box or Draw. Use Black bar for phone numbers, emails, and OTPs. Use Blur for faces when a soft cover is enough.
- Drag over each private spot. Pinch or use + / − to zoom. Leave a little padding so no letter peeks out.
- Tap Download PNG. Send that file. Keep the original out of the chat or ticket.
What support teams should bar before sharing
- Email addresses and phone numbers in headers and signatures.
- Postal addresses, apartment numbers, and map pins.
- Names paired with order IDs on public or multi-tenant channels.
- Government IDs, tax numbers, and KYC document photos.
- Payment PAN / IBAN fragments and card expiry / CVC.
- IP addresses and precise location if visible in admin tools.
- Other data subjects in queue lists and related-ticket panels.
- Internal URLs with tenant slugs or session tokens.
Ask only for the error UI when you request a customer screenshot. Many will still send the whole desktop — bar it before you escalate. A fuller ticket checklist is in redact a customer support screenshot.
Minimisation in practice
GDPR pushes data minimisation. The screenshot should answer “what did the product show?” — not “who is this person and where do they live?” Type the order ID into the private ticket field; bar it in images that leave the company. Public changelogs should not show a name next to a refund amount.
Slack is not a vault. Threads get shared to vendors and other pods. Assume the audience is wider than the channel topic. Same habit as Slack screenshot privacy.
On-device redaction and processors
Uploading a raw customer screen to a random consumer blur site creates another copy of personal data on infrastructure you do not control. A browser tool that paints locally avoids that extra hop for a quick cover. Your company’s DPA / processor list still governs official tooling — follow that when policy is stricter.
FAQ: Can we leave the order ID visible?
Internally, if policy treats it as a non-secret reference and the rest of the frame is barred, often yes. On public pages or shared vendor forms, prefer typing the ID into a controlled field and barring it in the image when a name or email is also present.
FAQ: Are support agents “controllers” for a pasted PNG?
Your organisation’s roles are a legal question for counsel / DPO. As an agent habit: do not create unnecessary copies, bar PII before wide sharing, and keep unredacted files only in systems built for them.
FAQ: What about screenshots from non-EU customers?
Use the same bar-first habit. Many teams run one global playbook so EU tickets are not the only safe ones. Extra care never hurts.
FAQ: Is crop enough for a long email thread?
Crop removes area; it does not remove quoted signatures, account chips, or toasts. Cover every repeat of the address and phone, then crop. Hide phone and email covers the digit and mailbox case.