How to Redact a PDF (and Check That the Redaction Actually Worked)

Contracts, court filings, medical records, HR files, FOIA responses: before a PDF goes out, teams redact names and contact details by blacking them out.

The document looks protected.

But in many cases, the information is still there.

Why a black box is not redaction

A PDF is made of several layers: text, images, annotations and shapes.

Drawing a black rectangle simply adds a shape on top of the text.

The text itself has not moved.

It stays in the file, ready to be searched, selected or copied.

This is one of the most common causes of leaks when documents are redacted by hand.

The most common PDF redaction mistakes

1. Drawing a black rectangle.
   The shape hides the text on screen without removing it.
2. Highlighting in black.
   The highlight only changes the background color, and the text can still be selected.
3. Turning the text black on a black background.
   The text becomes invisible to the eye, but a search finds it.
4. Marking areas without applying the redaction.
   Many tools first mark the areas to redact, then ask you to apply the redaction. Until you do, nothing is removed.
5. Forgetting the metadata.
   The author, the creating software or the document title can contain a name or internal information.

How to redact a PDF properly

Real redaction removes the information from the file instead of just covering it.

1. Work on a copy.
   Keep the original intact in a separate folder, so you can compare the two before sharing.
2. Find every piece of data to redact.
   Names, addresses, emails, phone numbers, account numbers, Social Security numbers: check the whole document, not just the passages you spotted at first glance. The search function helps you find every occurrence of a name.
3. Use a real redaction tool.
   A dedicated redaction function in your PDF editor removes the text under the marked area instead of drawing over it.
4. Apply the redaction.
   Confirm the final step that applies the redaction, then save the document as a new file.
5. Clear the metadata.
   Remove the author, the creating software and the XMP metadata from the document properties.

If your tool has no real redaction function, a safe fallback is to rebuild the affected pages as images after blacking them out: the text of those pages no longer exists in the file.

How to check that a redacted PDF no longer contains the data

Three simple checks, to run before any PDF leaves your hands:

1. Search.
   Open the PDF and search for the redacted name or number (Ctrl + F or Cmd + F). There should be no result.
2. Copy and paste.
   Select the blacked-out area and paste it into a text editor. Nothing should come out.
3. Extract the text with another tool.
   Convert the PDF to text or to Word. The data should not appear anywhere.

If any of these checks brings the data back, the document is not redacted.

Also open the document properties and check that no name remains in the metadata.

Should you use an online PDF redaction tool?

Online tools are convenient for a one-off document with nothing confidential in it.

To process the file, they need you to upload it first.

For a contract, a patient record or an employee file, that upload means the document leaves your control before it is redacted.

A tool installed on your own computer or your own servers does the same job without the file going anywhere.

Redacting a whole folder of PDFs

These precautions are easy to take on one document.

They become hard to keep up on hundreds of PDFs: the documents of a legal case, the reports of a department, the attachments of a claim file.

For a whole folder, you need automatic processing that:

1. Scans every document in the folder and its subfolders.
2. Redacts the same way everywhere, without depending on each person’s attention.
3. Produces an audit report that records what was processed, document by document.

This is where most organizations move from manual redaction to a dedicated tool, as we explain for legal document redaction.

With NymData

NymData detects and redacts personal data in PDF, Word, Excel, PowerPoint, CSV and text files, on your own servers:

1. Detection across the whole document.
   Rules recognize known formats (emails, phone numbers, IBANs, bank card numbers, US bank account and routing numbers), and contextual analysis finds names and personal details in free text.
2. Real redaction.
   Each detected item is covered by an opaque black box burned into the page: pages that contain personal data are rebuilt as images, so their text is no longer in the file.
3. Mapping mode.
   A first scan changes nothing and lists the data found, so you can review it before any redaction.
4. Review by confidence level.
   Detections are ranked high, medium or low confidence, so uncertain cases are checked first.
5. Allow list.
   Terms that must never be redacted, such as your organization’s name, stay untouched.
6. Originals kept intact.
   Redacted files are written to a separate mirror folder, with an audit report for each run.

To redact other formats, see our guide to PII redaction, or how NymData handles Word and PowerPoint files.

Details on PDFs are on our PDF redaction page.

Request a demo