You definitely don't want to actually store the pdf itself in most cases when the file can be created/recreated with exsting data from the database. Though regardless the process behind it is basically the issue.

It's doable, mostly need to know what data is to be captured and basically "when" so that either the appropriate log is made, or perhaps the correct filter is applied on the customer's side. Seems almost as if one must be able to reproduce all online actions associated with a customer...