A page that looks fully redacted can still give the information away. The visible text is only one of the places a PDF stores facts about people. Filenames, document properties, comments, attachments, form fields and invisible text layers survive a lot of "redaction" workflows, including ones that handled the page itself correctly.
This is the checklist to run after the marks are applied — the part that happens after the document looks finished.
Companion to why drawing a black box isn't redaction, which is about the page content itself. Read that first if you have not already confirmed the underlying text is actually gone.
The filename
Smith-disciplinary-final.pdf tells the recipient who the file is about before they open it. So does FOI-Jones-complaint-redacted.pdf. So does the original path if it is still embedded somewhere in the properties.
Save the finished file under a name that describes the release, not the subject: SAR-response-bundle-3.pdf, statement-page-2.pdf. Do this as a last step, after everything else, so you do not keep working in a file that already names the person.
Document properties
Every major PDF producer writes metadata:
- Author — often the Windows or Mac account name of whoever exported it
- Title — frequently the original Word document name
- Subject / keywords
- Creator / producer — which tool wrote the file
- Creation and modification dates
On a Mac, Preview → File → Properties. In Acrobat, File → Properties, then the additional Remove hidden information / sanitise pass. In a pinch, any PDF inspector that shows the Info dictionary and XMP stream.
Clear the fields that identify a person or a case. "Created with Preview" is harmless. "Author: Jane Smith, HR" is not.
Comments, markup and previous revisions
Comments, sticky notes and review markups are separate objects from the page content. A workflow that redacts the body and leaves the comment thread intact has not finished.
Some editing tools also keep earlier versions of the page inside the file. "Deleting" a page from a stack of scans can leave the old page recoverable. Flattening is not the same as removing — flattening merges annotations into the page; it does not delete the text underneath them.
If the PDF started life as a Word document, assume tracked changes and comments existed. Exporting to PDF does not always strip them. The safe path is: accept or reject the tracked changes, delete the comments, then export, then redact the PDF.
Attachments and embedded files
PDFs can carry other files inside them — the original spreadsheet, an earlier draft, an email. They do not show on the page. They extract in one click from any serious PDF tool.
Check the attachments pane before release. If you do not recognise something, it should not be in the bundle.
Form fields
A filled PDF form stores the field values as data, not only as marks on the page. Redacting the appearance of a field and leaving the value in the form structure means the original text is still extractable.
Flatten the form (so values become page content) and then redact that content — or fill a fresh, empty copy of the form with only what you intend to release.
The invisible text layer
Searchable scans are two documents stacked: an image you see, and a text layer from an earlier OCR pass that you do not. Redacting the image — drawing on the picture — leaves the OCR text sitting underneath, selectable and searchable.
This is one of the highest-yield failure modes on "scanned" correspondence. The test is the same as for ordinary text: select all, copy, paste into a plain editor. If words appear that you cannot see on the page, there is a text layer you have not removed.
A real redaction tool takes that layer out, or replaces the page with a new image that has no layer. eleyed's default PDF path does the second of those: it reads the pixels, takes what it finds off the page, and discards the original content stream. A rectangle will not.
Headers, footers and running titles
Case references, client names and document titles repeat on every page, usually in a smaller font, often outside the area people read. Search the whole file for the strings on your withhold-list, not just the body.
How to verify, in order
- Filename — does it identify anyone?
- Properties — author, title, subject.
- Attachments pane — anything embedded?
- Comments / markups — anything still live?
- Select-all, copy, paste into a plain text editor. Read what comes out. Search it for every name, email, phone number and reference you meant to remove.
- Open the file on a different machine if you can, or at least in a different reader. Some leaks only show up outside the tool that produced the file.
If step five returns anything you meant to remove, the redaction failed, regardless of how the page looks.
A note on Word, spreadsheets and email
The same class of problem exists outside PDF. Word files carry author properties, comments and a revision log. Spreadsheets hide columns, extra sheets and formula precedents. Email exports carry full header chains.
If the working file is not a PDF, clean that format first, then produce the PDF you will actually send, then run this checklist on the PDF. Cleaning only the PDF of a messy Word export leaves a surprising amount standing.
For the page-content half of this job — removing the words themselves — start with how to redact a PDF.