Redacting a PDF: why a black rectangle is not enough

Date: 8 November 2026. Author: Riducta Editorial Team. Publisher: X20 Digital Trust Services S.r.l.

Drawing a black rectangle over a name in a PDF may leave the original text recoverable. To share a copy without particular data, remove the relevant content, check the file's other elements and verify the result after saving. The page's appearance alone does not establish that information has been deleted.

Before making changes, establish which parts you may share and with whom. Technical removal does not settle access rights or confidentiality obligations. These instructions describe a general document check; they do not authorise changes to originals or evidence that must be preserved, and do not replace rules applicable to a particular proceeding.

Preserve the original and prepare a copy

Work on a separate copy, retaining the original according to the file's rules. Give the copy a name reflecting its destination without including the very data you intend to remove. If there are several attachments, identify those actually needed. Do not automatically send the entire folder because that is easier than selecting relevant documents.

Prepare a short internal note of what must be excluded. This may concern names, signatures, addresses or financial details not intended for the recipient. The note supports consistent checking across pages. It must remain internal if it repeats removed information: attaching it to the shared copy would undo the work.

Distinguish annotation from removal

A graphic annotation can cover text without deleting it. The same applies to text coloured to match the background. If the recipient selects the content, copies it or removes the overlaid object, the information may reappear. Highlighting should not be treated as a secure removal tool.

The NHS Counter Fraud Authority guidance of 13 August 2026 addresses these risks and recommends checking the document afterwards. This British public source is used here for technical file behaviour. Its guidance does not determine which information an Italian organisation may or must disclose.

Use a function designed to delete content and complete any stage that applies the redactions. Some programs separate marking areas from actual removal: saving only the markings may leave the document intact. Consult documentation for the program version being used rather than assuming a similarly named command always produces the same result.

Check information outside the visible page

A PDF may include attachments, comments and document properties. A scanned document may contain a visible image and an automatically recognised text layer. Removing a name from the image without checking that layer can leave the same information searchable. Links or bookmarks may also contain details missed during ordinary reading.

This check depends on the file structure. A simple document does not require the same tools as a collection containing forms and embedded attachments. If you cannot inspect these elements, request technical review before sharing. Format conversion may change what is present, but arbitrary conversion does not guarantee a clean document.

The ICO provides a guide to hidden personal information in documents. The source also suggests assessing the disclosure format. It is cited here for document risks, without automatically extending its British legal framework to Italy.

Verify the final file

Close the document and reopen the copy you intend to send. Search for some removed values and try selecting and copying text in the affected areas. Visually check every page for repeated information in headers or signatures. These tests help, but do not exhaust the examination of metadata and embedded objects.

For sensitive material, have a second authorised person check the copy using a suitable procedure. They should examine the final file rather than a screenshot. Finally, check the sending message: the wrong attachment, email subject or a link to the original folder can reintroduce information excluded from the document.

A fictional example

A company must send a contract extract to a technical consultant. It removes the contact's private telephone number and signature from the copy. During verification, however, it finds the same number on the last page and in the name of an embedded attachment. It removes the unnecessary occurrences and repeats the check on the exported copy.

The document retains a detailed description of the transaction needed for the consultant's work. The company does not label it anonymous: it could still concern identifiable people in context. It keeps the original in the file with appropriate access restrictions and sends only the verified copy. These facts are invented and do not describe an actual engagement.

Removal and anonymity are different decisions

Article 5(1)(c) of Regulation (EU) 2016/679 of 27 April 2016 requires data to be adequate, relevant and limited to what is necessary. Recital 26 concerns identifiability. Source: GDPR. Deleting some fields can support minimisation, but does not automatically make content anonymous or replace other processing conditions.

Record which final copy passed the review so that later users do not accidentally distribute an earlier draft. If the file is subsequently edited, repeat the relevant checks before release. A successful check applies to the version examined; it should not be treated as a permanent guarantee for every later document bearing a similar filename.

For workflows involving text masking before AI use and restoration in the answer, read about Riducta's features.