Conference 14–15 May 2018 📍 Berlin, Germany

PDF Days Europe 2018 — Berlin: PDF 2.0 Publication Year, PDF/UA Progress, and Digital Signing Interoperability

PDF Days Europe 2018 took place in Berlin shortly after the publication of PDF 2.0 (ISO 32000-2:2017) — making it the first conference dedicated to discussing the new standard with implementers. Sessions covered early PDF 2.0 adoption, PDF/UA implementation experiences, digital signature interoperability under eIDAS, and the XFA deprecation announcement.

Official event page →

Key takeaways

GDPR came into effect 6 days before the conference — personal data in XMP metadata, revision history, hidden text layers, and embedded files created new PDF-specific compliance risks.
True redaction (not black-box drawing) is required for GDPR compliance — underlying content stream text must be removed or replaced, not just visually covered.
PDF 2.0 first implementation reports: major libraries shipping support; errata process already underway; XFA migration assessments beginning.
PDF/UA tooling ecosystem matured by 2018 — PAC 3, axesPDF, CommonLook, and Acrobat Pro all supporting PDF/UA creation and validation workflows.
PDF/A-4 (ISO 19005-4, based on PDF 2.0) work formally began — published 2020.
ZUGFeRD/Factur-X e-invoicing scaling in Germany and France, driven by EU e-invoicing directive implementation in national public sector procurement.

PDF Days Europe 2018 was held in Berlin in May 2018, organised by the PDF Association. The General Data Protection Regulation (GDPR) had come into effect on 25 May 2018 — six days before the conference opened. For PDF practitioners, this was not an abstract legal development: PDF documents routinely contain personal data, and GDPR imposed new obligations on any organisation that created, stored, transmitted, or processed such documents. PDF Days Europe 2018 was therefore the first professional PDF conference where GDPR was a live legal reality rather than a future concern — and sessions addressed its implications with practical urgency. Alongside GDPR, the conference continued to track the first year of experience with PDF 2.0 (ISO 32000-2:2017), published in late 2017, and reviewed the maturing market for PDF/UA accessibility tooling.

GDPR and personal data in PDF documents

GDPR's territorial scope, combined with PDF's ubiquity as a document format, created a broad compliance challenge. Sessions at PDF Days Europe 2018 identified several specific PDF-related GDPR risks: XMP metadata exposure — PDF documents embed extensive metadata in XMP (Extensible Metadata Platform) streams: author name, organisation, revision history, modification dates. In many corporate environments, author names in XMP metadata identify specific employees — personal data under GDPR. Organisations publishing PDFs to websites or sharing them externally needed to audit and sanitise XMP metadata before distribution. Revision history and deleted content — PDF's incremental update mechanism preserves prior versions of a document within the file (see PDF versioning). A contract draft that was revised to remove sensitive terms still contains those terms in the earlier revision objects. Organisations needed to "linearise to remove history" or re-save without incremental updates to eliminate hidden prior-version content. Hidden text layers in scanned documents — Scanned PDFs with OCR text layers may have personal data in the text layer that is not visible in the document image but is searchable and extractable. Data subject access requests could reveal this hidden text. Embedded files and attachments — PDF/A-3 documents with embedded data files may contain personal data in both the visible PDF and the embedded file — requiring coordinated data deletion procedures. Redaction requirements — GDPR's right to erasure (Article 17) and right to rectification (Article 16) created requirements for genuine, permanent redaction of personal data from documents. PDF redaction that merely draws a black box over text (without removing the underlying content stream text) was flagged as inadequate — the text remains extractable. True redaction requires removing or replacing the underlying content. See Redact PDF for practical guidance.

PDF 2.0 first year: early implementation experience

ISO 32000-2:2017 (PDF 2.0) had been published in October 2017. PDF Days Europe 2018 was the first opportunity to report on real implementation experience in the six months since publication. Tool support pace — Major PDF libraries (iText, PDFBox, Foxit PDF SDK) were working through PDF 2.0 support. Complete PDF 2.0 read/write support was not yet widespread. Most tools could read PDF 2.0 files (thanks to version tolerance in PDF parsers) but creating PDF 2.0 output with new features like AES-GCM encryption or new structure elements required newer library versions. Errata process — The first errata for ISO 32000-2:2017 were already being collected. ISO standards processes allow errata to be filed and published as corrigenda; the PDF Association's technical working group was tracking specification ambiguities and errors reported by implementors. XFA deprecation in practice — PDF 2.0's formal deprecation of XFA was having real-world effects. Adobe's LiveCycle/Experience Manager Forms was the primary XFA platform. Organisations with large XFA form libraries were beginning to assess migration to AcroForms or HTML5 forms. PDF/A-4 work begins — With PDF 2.0 now published, formal work on PDF/A-4 (the PDF 2.0-based successor to PDF/A-3) began. PDF/A-4 (ISO 19005-4) would be published in 2020.

PDF/UA tooling matures and ZUGFeRD e-invoicing scales

PDF/UA tooling — By 2018, the PDF/UA tooling ecosystem had matured significantly. PAC 3 (PDF Accessibility Checker 3) was the updated validator. Commercial tools including axesPDF for Word, CommonLook PDF, and Acrobat Pro all offered PDF/UA creation and remediation workflows. Organisations that had committed to PDF/UA compliance were reporting successful at-scale deployments, though the per-document cost for complex documents remained high. ZUGFeRD and Factur-X scaling — Germany was advancing e-invoicing legislation for public sector procurement (implementing EU Directive 2014/55/EU). France had launched Factur-X as the French equivalent of ZUGFeRD. The combined ZUGFeRD/Factur-X ecosystem was seeing substantial growth, and sessions reported on ERP system support maturity from SAP, Oracle, and others. GDPR and ZUGFeRD invoices — The intersection of GDPR and PDF/A-3 e-invoicing raised specific questions: invoices contain personal data (customer name, address). The legal basis for invoice archiving is established in tax and accounting law, which typically overrides or coexists with GDPR data minimisation requirements. However, the precise archiving period and access restrictions for invoice data under GDPR were being clarified across EU member state implementations.

Frequently asked questions

Does GDPR apply to PDF documents?

Yes. GDPR applies to any processing of personal data, regardless of the format — including PDF documents that contain personal data. If a PDF contains a person's name, email address, location, or any other information that identifies them, processing that PDF (creating, storing, transmitting, sharing, deleting) is covered by GDPR for organisations with EU nexus. Key PDF-specific GDPR considerations: XMP metadata may contain author names; revision history may preserve deleted personal content; scanned PDFs may have text layers with personal data; embedded files may contain personal data alongside the visible PDF. See Redact PDF for guidance on removing personal data.

What is incremental update in PDF and why is it a GDPR risk?

PDF's incremental update mechanism allows changes to a document to be appended to the end of the file rather than rewriting the entire file. This preserves the original content and creates a version history within the single file. The risk for GDPR: if a PDF is edited to remove personal data (e.g., a redaction or correction), and the edit is saved as an incremental update, the original personal data remains accessible in the earlier revision objects within the file. To genuinely remove content from a PDF under GDPR, the document must be saved without incremental updates — either by flattening to a new file, or by processing with a tool that strips revision history. This is related to the general principle that PDF's technical architecture preserves content in ways that may not be obvious from a visual inspection of the document.

How does GDPR affect PDF/A archiving?

PDF/A is used for long-term archiving — potentially retaining documents for decades. GDPR's right to erasure (Article 17) creates a potential conflict: can personal data in an archive really be erased if the archive format is immutable? The practical answer involves legal bases: GDPR Article 17(3) exempts erasure obligations where processing is necessary for archiving in the public interest (Article 89(1)). Commercial organisations archiving contracts and invoices typically rely on the legal obligation basis (Article 6(1)(c)) under tax and accounting law, which provides a defined retention period. After the retention period expires, GDPR erasure obligations can be fulfilled by destroying the archive records. The practical guidance: retain PDF/A archives only as long as legally required, implement secure deletion procedures when retention periods expire, and document your legal basis for long-term archiving.

Try it in your browser

The PDF tools and standards discussed at this event are available free — no account needed.

Redact PDF Protect PDF Edit PDF Open editor