How to redact a PDF properly (and the mistake that leaves the text under the black box)

What redaction actually means

Redacting a document means removing information from it for good, so that nobody who receives the file can get it back. The black box is only how removal looks on paper. What matters is that the information no longer exists in the file.

On a printed page, a thick marker and a photocopy do the job (if the marker is opaque enough). A PDF is different. It is not a picture of a page: it is a set of instructions that say "draw this text here, in this font, then draw this shape on top". Remove nothing, add a shape, and every instruction is still in the file.

The mistake: a black box is not a redaction

Most redaction failures come from one habit: hiding text instead of deleting it. The usual ways to do that:

• A black highlight in Word, then "Save as PDF". The highlight is a color behind the text. The text is still there, and still selectable.
• A black rectangle drawn in a PDF editor or in Word. The shape is a new layer on top. The text underneath is untouched.
• Black font color on a black background. The words are there, just hard to see. Change the color and they reappear.
• "Sticky note" or comment covers. They sit above the page and can be moved or deleted by anyone.

Each of these looks perfect on screen and in print. Each of them fails the moment someone selects the text, searches the file, or opens it in another program.

This is not a theoretical risk. Court filings, government reports and company documents have been published with "redacted" passages that readers recovered with a simple copy and paste. It keeps happening because the result looks right.

What else a PDF carries without showing it

Even a page that is properly cleaned can leak through what travels with the file:

• Document properties. Title, author, company, creation software, sometimes the original file name. If the author field says the name of the person you were protecting, the redaction is pointless.
• Comments and annotations. Review notes, highlights and replies stay in the file even when they are collapsed or hidden from view.
• Revision history. Some editors save changes by appending them to the file. Earlier versions of the text can remain inside, below the latest one.
• Hidden layers. PDFs can contain layers that are switched off. Off does not mean gone.
• Form fields. A filled-in form keeps its values as data, separate from what is printed on the page.
• Attachments and bookmarks. A PDF can carry other files inside it, and bookmark titles are text too.

Scans and photos have their own traps

A scanned page is a picture. There is no text layer, so searching for a name finds nothing, and it is tempting to conclude the file is safe. It is not: anyone can read the picture, and any text recognition tool can turn it back into text in seconds. A scan needs the same care as a typed document. The difference is that you can't rely on search to find what to remove; you have to read the page.

Photos of documents add one more layer: EXIF data. A phone photo usually records the camera model, the date and time and, often, the GPS position where it was taken. Send a photo of an ID card from your kitchen table and you may be sending your home address with it.

The principle that fixes all of this: flatten to image

The reliable way to redact is to make sure the final file contains only what you can see. In practice:

1. Mark everything that must go.
2. Turn each page into an image, with the black boxes painted into the pixels.
3. Build a new PDF that contains only those images, with no text layer, no metadata, no comments, no attachments.

Once the box is part of the picture, there is nothing under it. There is no hidden layer to switch on, no text to copy, no property to read. The trade-off: the new file is not searchable and its text can't be selected. For a document you are sending outside, that is usually exactly what you want.

Some professional PDF editors have a real redaction tool that deletes the underlying text and offers to remove metadata. It works when you use that specific tool, not the rectangle or highlight tool next to it, and when you also run the "remove hidden information" step.

A 10-second check for any redacted file

Before you send a redacted PDF, whoever made it, open it and do this:

1. Select all and copy. Press Ctrl+A (Cmd+A on a Mac), copy, and paste into a plain text editor. If any redacted word appears, the redaction failed.
2. Search. Use Ctrl+F to search for a name or number you removed. If it is found, it is still in the file.
3. Open the document properties. In most PDF readers: File, then Properties. Check the title, author and subject fields.
4. Look at the comments panel and the attachments panel, if your reader has them.

If the file passes all four, the visible text is clean. It does not prove there is no hidden layer, which is one more reason to prefer the flatten-to-image approach.

Why it matters under GDPR (in plain terms)

The GDPR asks organisations to share only the personal data that is needed for a given purpose. This is called data minimisation. When you answer a data access request, send a contract to a supplier or file a document with a court, the other people named in it usually have no reason to be in the copy you send. A redaction that can be undone means their data was disclosed anyway.

This guide is practical advice, not legal advice. For what you are required to remove in your situation, ask your data protection officer or a lawyer.

How Sumi does it

Sumi is a redaction tool built around the flatten-to-image principle, with one more rule: your document never leaves your device.

• It runs in your browser. The file is opened, read and redacted on your computer. Nothing is uploaded; turn off your Wi-Fi after the first visit and it still works. You can check that nothing is sent.
• It finds personal data for you to review. Names, emails, phone numbers, IBANs, card numbers, ID numbers, addresses and dates of birth are highlighted. IBANs must pass their checksum and card numbers the Luhn test before Sumi flags them. Scans are read with text recognition on your device, and handwriting it can't read is boxed so you can decide.
• You approve every stroke. Nothing is removed until you have reviewed it. You can keep a finding, remove it, search for a word, or draw a box anywhere.
• The export is flattened. Every page is redrawn as an image with the boxes painted in. The new PDF has no text layer, no metadata, no comments, no attachments. Photos lose their EXIF data.

Sumi's limits, stated plainly: automatic detection can miss things, especially on poor scans and unusual formats. Always read the document before you share it. The 10-second check above works on Sumi's files too.

Free for documents up to 10 pages, with no account.

Questions