PDF redaction: the risks of a badly redacted document

When a document contains personal, confidential or sensitive information, hiding it visually may therefore not be enough to prevent its disclosure.

The essential question: is the information still reachable?

When a document is shared, what it looks like on screen is not always enough to tell whether a piece of information has actually been removed.

Information can remain reachable in several ways:

• The text is still present underneath a rectangle or an annotation.
• The content can still be selected, copied, searched or extracted.
• Comments, annotations, form fields, layers or embedded objects are still there.
• Metadata, attachments or technical information may reveal things that are not visible.
• What is left can identify a person once it is combined with other data.

Actually removing the content, examining the final file and assessing the risk of re-identification are therefore distinct from simply covering an area on screen.

Why a black rectangle may not be enough

When a graphic rectangle is merely laid over text without removing the underlying content, the hidden information may remain present in the file.

In some situations, a person with access to the PDF can still select, copy, search, extract or recover content that appeared to be hidden.

The visual result can therefore give the impression that the information was removed while the digital content remains reachable.

Hiding information visually and removing that information from the file are two different operations.

Digital redaction aims to remove the information concerned from the produced document, rather than to cover it over.

What can an incomplete redaction lead to?

Unintentionally disclosing information to someone who was not authorised to see it can have significant consequences.

Depending on the context, it may:

• Expose personal or confidential information.
• Reveal commercial, financial, medical, legal or professional information.
• Constitute a security or confidentiality incident.
• Create management, documentation, reporting or notification obligations.
• Lead to contractual, regulatory, reputational or operational risks.

Which consequences apply depends on the laws, contracts, internal policies and professional obligations concerned.

When is redaction useful?

Redaction can be useful when a document has to be shared, transmitted, published or archived while some information must remain out of the recipient's reach.

• Access or disclosure requests. A document may contain information about several people, files or subjects.
• Sending a file to a client, supplier, partner or adviser. It may be appropriate to limit what is shared to what is necessary.
• Publishing documents. Reports, decisions, case files, studies, administrative documents or public material may need certain information taken out first.
• Internal documents. Contracts, HR reports, investigation files, legal correspondence, financial files or governance documents may contain sensitive information.
• Sharing with external systems or services. It may be necessary to limit what a document carries before uploading, transmitting or processing it with a third party.

That a redaction is technically possible does not mean a piece of information has to be removed. That decision depends on the context, on the applicable obligations, and on the person or organisation responsible for the document.

Keeping track of the redaction process

For organisations that handle sensitive documents, being able to trace the process can support better control and governance practices.

Depending on the context, it can be useful to record:

• The areas or items that were processed.
• The redaction rules or actions applied.
• The pages concerned.
• The date and time of processing.
• The checks carried out on the final document.
• The limits, warnings or exceptions identified during processing.

Such records can support internal controls and investigations after an incident. They do not, on their own, constitute proof of compliance with a law, a regulation or a contractual obligation.

How Caviardeur handles redaction

Caviardeur is designed to support the digital redaction of a PDF, rather than to add a graphic shape on top of the content.

When the verification features are used, Caviardeur analyses the produced file in order to detect — within the capabilities and the limits of the feature used — whether some content marked for removal appears to remain extractable.

Caviardeur can also produce a report alongside the processed document, to help trace the process. Depending on the features used, that report may indicate the items processed, the rules applied and the pages concerned, without reproducing the redacted values themselves.

How far the verification reaches depends on the structure of the PDF, the type of content, the features used and the technical limits of the software. An automated check can reduce some risks, but it does not replace the user's own examination of the final document.

These features aim to reduce the risk of an incomplete redaction. They do not constitute a legal certification, a guarantee of regulatory compliance, or legal advice.

The user remains responsible for deciding which information must be redacted and for checking that the final document meets the requirements applicable to their context.

Two traps to watch for

Metadata and invisible elements

The visible content of a page is not the only place information can live.

A PDF file may also contain metadata or internal elements, among them:

• The author's name.
• The document's title or subject.
• The name of the software used to create or modify the file.
• Comments or annotations.
• Attachments.
• Form fields.
• Layers, bookmarks or embedded objects.
• Version, history or document structure information.

Redacting the visible content therefore does not necessarily mean that every piece of information in the file has been removed.

Re-identification

Removing a person's name is not necessarily enough to prevent them from being identified.

A combination of apparently harmless details — a date, a job title, a location, an employer, a file reference or a specific event — can sometimes identify a person once it is cross-referenced with other available information.

Redaction and anonymisation are therefore not necessarily the same thing.

Checks before sharing a PDF

Before sending a document containing personal, confidential or sensitive information, it is worth checking:

1. Which information may be shared.
2. Which information has to be removed.
3. Which legal, regulatory, contractual or internal obligations apply.
4. That the removed information is no longer reachable in the final file.
5. That the final document carries no metadata, annotations, attachments, fields, layers or other elements not intended for the recipient.
6. That what remains does not create an inappropriate risk of re-identification.
7. That the final PDF was opened and examined independently before being shared.

For complex situations, sensitive documents or high-risk contexts, legal, technical or professional validation may be appropriate.

Further reading

Read on for why a black box on a PDF hides nothing and how to redact a PDF without uploading it.

Important notice