A small agency sealed a client contract two years ago. Now the client writes: the work is over, please erase my data. The agency wants to do that. It also wants proof that the contract existed in that form.
Both can happen. The seal holds less than most people think.
What leaves your folder when you seal
Only a fingerprint of your file is sent out. The file itself stays in your folder.
You upload the file into a folder on Swiss Trust Layer. The portal then computes a cryptographic fingerprint of it. A fingerprint, or hash, is a short code unique to that exact content. Only the fingerprint is sent to Swisscom Trust Services, the qualified trust service provider. It signs the fingerprint with a key that never leaves its hardware. The signature carries a timestamp under RFC 3161. For a PDF, the signature is embedded in the PDF. The original file is never altered.
Each sealed folder version also gets a certificate of proof, itself a signed PDF. It lists every file with its name, its fingerprint and the sealing time in UTC. It does not contain the file. A fingerprint cannot be turned back into the document. Any change to the file gives a different fingerprint, so a change is detectable. The document and its proof are two separate objects.
Is a fingerprint personal data? The test, not the verdict
The GDPR gives a test for what counts as personal data. It does not rule on hashes.
Article 4(1) of the GDPR defines personal data as "any information relating to an identified or identifiable natural person", directly or indirectly (text re-checked on EUR-Lex, 15 October 2026). Article 4(5) defines pseudonymisation. That is processing so that the data "can no longer be attributed to a specific data subject without the use of additional information". That extra information must be kept separately.
Recital 26 says that to decide whether a person is identifiable, "account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person".
A hash alone cannot be turned back into the document. Whether it still relates to a person is judged by that test. One means is plain: anyone who holds the original file can compute its fingerprint and confirm the match.
What the right to erasure asks for
A person can ask you to erase their data. The GDPR lists when that right applies and when it does not.
Article 17(1) gives a person the right to have personal data erased without undue delay. One of its grounds must apply. For example, the data "are no longer necessary in relation to the purposes for which they were collected or otherwise processed". Or consent is withdrawn and no other legal ground remains. Or the data "have been unlawfully processed".
Article 17(3) lists when the right does not apply, where processing is necessary for a listed purpose. Letter (e) is the one that matters for proof: "for the establishment, exercise or defence of legal claims". Whether it covers your contract is a question about your situation, not about the seal.
The practical design: erase the document, keep the proof
Delete the document when you must. Keep the certificate, which holds no content.
When an erasure ground arrives and no exception applies, delete the document. The sealed PDF carries the content, so it goes too. Keep the certificate of proof: file name, fingerprint and time, not the content. Someone may later ask whether this contract existed on that day. If the other party still holds their copy, the fingerprint on the certificate answers it.
Under Article 41(2) of the eIDAS Regulation, a qualified electronic time stamp is presumed accurate in its date and time. The data bound to it is presumed unchanged. The certificate preserves exactly that: the fingerprint and the time.
On the platform, a folder can be deleted. The portal warns that this cannot be undone. Account deletion is a request. After approval it permanently deletes your profile and every uploaded or sealed file. It also deletes the signing history, the issued certificates and the billing records. So download your data first. Copies you already downloaded stay valid on their own. The public validator at swisstrustlayer.com/validate reads only the PDF and never stores the document. The erasure duty for any copy you hold stays with you.
File names are public to anyone with the link
The verification page needs no login. Anyone with the link can read your file names.
The QR code on the certificate opens a verification page on the portal. Anyone who holds the link or scans the code can open it. They see whether the signatures are valid, who issued the signing certificate, who it was issued to, the signed date and the expiry. They can also download the certificate PDF. That PDF shows the account holder's name, every file name and every fingerprint.
A file called "termination-letter-anna-muster.pdf" therefore sits on a certificate issued for that version. The hashes of an issued version never change. Name files with a reference before you seal them: a case number, a date, a project code. Not a person. Keep the list that maps references to people in your own system, where you can erase it.
A version may be sealed after identity verification. Then the certificate also shows the account holder's surname, name, date of birth and country. The passport number appears as asterisks. A later identity change never rewrites an issued certificate. Sealing itself does not require identity verification.
The limit, stated plainly
We explain the law and the seal. We do not decide your case.
We do not decide whether a given fingerprint is personal data in a given case. We do not decide whether Article 17(3)(e) covers your records. Those answers depend on who else holds the original, what the data is for and which claims are live. The seal only keeps the proof small: a name, a fingerprint, a time. Small enough that erasing the document does not erase your evidence that it existed.
One step this week
Read your file names as a stranger would. Rename any that name a person.
Open the folder you seal most often. If a name tells you who a person is, rename the file with a reference. Do it before the next version is sealed. Then download the certificate for one sealed version and look at what it shows: a name, file names, fingerprints, a time. The mechanism is on how it works. The wider view is in our GDPR and document sealing guide.
Seal your first document on Swiss Trust Layer and keep the proof without keeping the person.
