Mixed Format E-Discovery: Closing the Compliance Gap
A document production request arrives. The set spans five formats: PDF contracts, Word documents, Excel spreadsheets, CSV exports, and JSON logs. Each format needs a different tool. That is the problem.
A 2025 Everlaw e-discovery report found that legal teams use an average of 3.2 tools for mixed-format productions. The operational cost is high. The compliance risk is higher.
See our legal compliance overview and security practices for how we handle document productions.
Why Tool Fragmentation Creates Gaps
Different tools mean different standards. Three vulnerabilities follow.
Entity coverage varies by tool. Adobe Acrobat searches for text strings you enter by hand. It does not detect entities on its own. A Word macro may catch names and emails. It likely misses 280+ other entity types. Excel find-and-replace only catches what you typed in. The same SSN in a PDF and an Excel file may get different treatment from different tools.
Audit trails split apart. Each tool logs its own actions — or nothing at all. A DPA may ask how all personal data was found and handled. Three separate logs from three tools is a weak answer.
Settings drift over time. The PDF redaction rule set six months ago may not match the Word macro updated last week. The gap stays hidden until a production error reveals it.
Courts have addressed this problem. Sanctions for e-discovery errors have cited inconsistent standards across document types in a single production. Courts expect a systematic process. Format-specific tools work against it.
The DSAR Consistency Requirement
GDPR DSARs have a consistency rule built into the law.
Article 15 requires the data subject to get information about all personal data held. Not all personal data in PDFs and most in Word documents. All of it.
The ICO DSAR guidance is clear on this point. Organizations must apply a systematic approach across all systems and formats. Consistent methodology is required. Format-specific tools with different standards do not meet this bar.
When a DPA investigates a DSAR complaint, four questions come up:
- What process found all personal data?
- What tools processed which document types?
- What entity types were searched in each format?
- What audit trail proves completeness?
Separate tools with separate logs cannot answer questions 3 and 4 cleanly.
The Unified Engine Advantage
A unified engine runs the same detection logic on every format. Four benefits follow.
Consistent entity coverage. A preset with 32 entity types processes a PDF, DOCX, XLSX, and CSV the same way. The SSN in Excel gets the same confidence threshold as the SSN in the PDF.
One audit trail. One log covers all files in a batch. It shows file name, type, detected entities, confidence values, and actions taken. One document proves compliance for the whole production.
Referential integrity. Say "Sarah Johnson" appears in a PDF contract, a Word letter, and an Excel record. The same token — PERSON_0001 — replaces her name in all three. The data subject can trace their record across the full production.
Simpler workflow. Drop 15 files of mixed formats into one batch. Apply one preset. Get 15 anonymized outputs and one audit report. Three separate tool workflows collapse into one.
For more on how presets apply across batch jobs, see our guide on GDPR DSAR batch processing at scale.
Federal FOIA: The Same Problem at Scale
US federal agencies face the mixed-format challenge at higher volume.
FOIA requests span legacy mainframe exports, modern Word documents, scanned PDF archives, and CSV and JSON database exports. No agency uses one format.
The DOJ and HHS have both piloted automated redaction systems. Manual multi-format processing does not scale to their request volumes. Each pilot had the same core requirement: one exemption standard across all formats. A documented audit trail was also required.
The same principle applies outside the federal government. Any organization with multi-format compliance needs the same thing. One standard. One audit trail. That is the base of defensible compliance records.
Law Firm Case Study
A mid-size law firm ran GDPR DSAR responses for enterprise clients.
Before unification, the firm used four different tools. Adobe Acrobat handled PDFs. A Word macro handled DOCX, covering names and emails only. Excel find-and-replace handled XLSX. CSV exports went through manual review. Each DSAR took 8–12 hours. Only 2–3 entity types were checked the same way across all formats.
After, a unified engine handled all formats in one batch. The preset: "DSAR EU Individual." The engine checked 32 entity types the same way across every format. Each DSAR took under one hour. One audit report went to the DPO for sign-off.
The firm can now prove consistent entity coverage across every document type in a DSAR production. One audit document covers each response. Time dropped from 8–12 hours to under one hour. That is a significant operational change. The shift made DSAR compliance a scalable service the firm could offer clients.
Related: document format fragmentation and PII anonymization.
Conclusion
Format fragmentation is a compliance liability. Different tools mean different standards. Different standards create audit gaps. Audit gaps bring regulator exposure.
A unified engine fixes this at the source. One detection standard. One audit trail. One workflow — for every format.