Redaction and privacy law: what a badly redacted PDF actually is

General information, not legal advice. What applies to you depends on your jurisdiction, your role and the document — check with counsel before relying on any of this.

One test, in every jurisdiction: can the person still be identified?

Privacy laws differ on scope, penalties and paperwork. They converge on the question that decides this one: after your disclosure, can someone still work out who the information is about?

The European GDPR — and its close relatives, the UK GDPR, Switzerland's revised FADP and Brazil's LGPD — put genuinely anonymous information outside their scope, but only where identification is no longer possible at all. Information that has merely been made harder to read remains personal data, carrying every obligation. Canada's federal and provincial laws, several US state statutes and Australia's Privacy Act draw the same distinction in their own vocabulary: de-identified, redacted or anonymised means the identity cannot be recovered, not that it has been made inconvenient to recover.

A black rectangle drawn over a name fails that test in the most literal way available: the name is still in the file, and recovering it takes a copy-paste. The document was not anonymised. It was decorated.

What that makes the disclosure

Sending such a file to someone who should not see what is underneath is a disclosure of personal data, not a formatting mistake. Under most regimes it is a reportable breach, and the shape of the duty is remarkably consistent: notify the regulator promptly — the GDPR's 72 hours is the best-known deadline, and comparable laws in Canada, Brazil, Australia, Singapore, South Africa and a majority of US states run on similar or shorter timelines — record the incident internally, and tell the people affected when the risk to them is serious.

The uncomfortable part is the timing: the clock starts when you become aware, and with this failure mode you usually become aware because someone else found the text.

Where redaction is an obligation, not a courtesy

• Answering an access or subject request. A person is entitled to their own data — not to the third parties who appear in the same file. Those have to come out before you send it.
• Data minimisation. Sharing a document with a partner, an insurer, a contractor or a regulator means sharing what they need, not everything the file happens to carry.
• Publication and disclosure. Court filings, public registers, freedom-of-information responses, research datasets, transparency reports — anything that leaves a controlled circle.
• Cross-border transfers. Whatever mechanism you rely on, less data crossing the border is less to justify.

What you should be able to show

Accountability is the part people forget. Being right is not enough; you are expected to be able to demonstrate it — that is explicit in the GDPR and increasingly so elsewhere. In practice it means keeping, for each document you release:

• what was removed, and on which pages;
• who did it and when;
• evidence that the removal was verified rather than assumed.

Caviardeur produces a report alongside the redacted file for exactly this: what was taken out, by which rule, on which pages. And the export is refused outright if any string that was supposed to be gone can still be extracted from the file it just produced — the check happens before you are handed anything, not after you have sent it.

Two traps worth naming

Metadata. Author, title, producer, revision history and file attachments live outside the page content and survive any amount of drawing on the page. They have to be stripped separately.

Re-identification. Removing the name is not always removing the person. A postal code, a date of birth and a job title can be enough between them — a point regulators have made repeatedly, and one no tool can settle for you. That judgement is yours.