What to redact, and what leaks anyway
A technically perfect redaction still discloses if the wrong things were left in. This is the judgement half of the job, and no tool can do it for you — but the failure patterns are consistent enough to be worth knowing before you start marking boxes.
The obvious layer
Names, addresses, phone numbers, email addresses, national identification and tax numbers, account and card numbers, dates of birth, signatures, photographs. These are the ones people remember. The two that get missed are email addresses inside long text — because they are read as a block rather than as a name — and signatures, which are images and therefore invisible to a text search. If you are working from a search rather than reading every page, signatures will survive.
The layer that identifies without naming
Someone is often identifiable from a combination of details none of which is a name: a job title plus a department plus a date; a rare condition plus an approximate age plus a town; the only person who was in a particular meeting. This is the failure that survives careful redaction, because each individual fact looks harmless. The test is not "is this a personal detail" but "how many people does what remains describe". If the answer is one, you have not redacted anything.
The arithmetic layer
Numbers give each other away. Redact one line of a table and leave the total, and the missing figure is a subtraction. Redact a salary but leave the percentage increase and the previous figure. Redact one month of a series that has a stated annual sum. Redact the price but leave the quantity and the line total. This is a systematic problem and the fix is systematic: after redacting numbers, look at what is left and ask whether the removed value can be derived. If it can, redact the total as well, even though the total looks innocuous.
Redact consistently, then read it cold
The same detail has to go everywhere it appears — body, headings, footers, signature block, email addresses, file name and document properties — because one survivor undoes the rest. When you have finished, read the document as an adversary would: not checking that you removed what you meant to, but trying to work out what was removed. That reading finds the total that gives back the line, the initials in a footer, the date that narrows it to one person. It takes a few minutes and it is the only part of the process that catches this category of mistake.
Frequently asked questions
What counts as personal data that must be redacted?
That is a legal question and it depends on your jurisdiction and the matter. This guide covers technique; take the obligation from your lawyer or data protection officer.
Is it enough to redact names?
Often not. People are routinely identifiable from a combination of role, date and location with no name present at all.
Should I redact partial identifiers, like the last four digits?
Be careful. Partial identifiers are frequently enough to confirm a guess, and combined with other fragments they reconstruct the whole.
Do I have to redact the totals in a table?
If a redacted line can be derived from the total and the remaining lines, yes. Otherwise you have published the number you removed.
What about signatures?
Treat them as identifying, and remember they are images — a text search will not find them, so you have to look.
Should I keep the unredacted original?
Usually yes, stored separately and clearly labelled. Retention obligations are a legal matter, but a redacted copy is not a record of what the document said.
Remove the text, then prove it is gone. Redact takes the words out of the page rather than covering them, then reopens the file it just made and searches it twice — by text extraction and by raw stream scan — before letting you download. The file never leaves your browser.
Redact a PDF in the browser