PDF redaction mistakes that leak data: overlays, layers, metadata, OCR and versions

A redacted PDF looks safe because all you see are black boxes. But a PDF is not a sheet of paper. It is a container holding text, images, annotations, form fields, metadata and sometimes several versions of the same document stacked on top of each other. Redaction only protects you if it removes the data from every one of those places. Otherwise, copy and paste, Ctrl+F or simply opening the file in a different viewer brings back what you meant to hide.

This is not a theoretical risk. In January 2019, lawyers for Paul Manafort filed a document in a US federal court whose “redacted” passages could be copied and pasted, exposing information that was supposed to stay sealed; the American Bar Association's Judges' Journal later used it as a textbook redaction failure. In the UK, the ICO reprimanded a London borough council in May 2025 after a Freedom of Information response published as a spreadsheet carried 35 hidden worksheets containing personal data of 6,528 people. This article walks through the technical mistakes behind leaks like these and how to catch them before a document goes out.

Six mistakes that leave the data inside the file

1. Overlay boxes and black highlighting

The classic error: drawing a black rectangle with a shape or comment tool, turning the text black on black, or using a dark highlighter. It looks perfect, but the text is still in the content layer. Anyone can select it, copy it, find it with the viewer's search or pull it out with a text extraction tool. The same thing happens when text is highlighted black in Word and then exported to PDF: the words travel with it.

2. Hidden layers and objects

A PDF can contain annotations (sticky notes, comments), form fields with filled-in values, optional content layers that are hidden by default, embedded attachments and bookmarks whose titles include a person's name (“Witness statement of John Smith”). A tool that only redacts visible text leaves all of that untouched.

3. The invisible OCR layer on scans

When a scanned document is run through OCR, the PDF stores the page image plus an invisible text layer underneath so you can search and copy. Cover the image without removing the recognised text and the “redacted” name still turns up in search. The reverse also happens: the text is removed, but the scanned image still shows the data because the box did not cover it entirely. Our guide on redacting a scanned PDF covers this in depth.

4. Metadata and document properties

Title, author, subject, keywords, XMP metadata and the producing application all travel with the file. It is common for the title to be the data subject's name or for the author to be the person who wrote a confidential report. Check them and remove PDF metadata from the copy you publish, never from the original you keep on file.

5. Incremental saves

The PDF format lets applications save changes by appending them to the end of the file instead of rewriting it. That is fast, but it means the pre-redaction version may still be inside the file and recoverable with specialist tools. Always save the result as a new, fully rewritten file rather than pressing “Save” on the working document.

6. What sits outside the document: file names and context

“Disciplinary_decision_Mary_Jones_redacted.pdf” (a fictitious example) undoes the best redaction in the world. So does the subject line of the covering email, a folder path visible in a public URL, or a name in a footer or table of contents that nobody checked. And do not forget earlier unredacted versions that are still live at another link.

Judgement errors, not just tool errors

Even with the right tool, some leaks come from review decisions:

• Incomplete redaction: the name is removed from the body but not from headers, footers, annexes, tables or the signature block.
• Indirect identifiers: the name goes but a unique job title (“the head teacher”), an exact address or a date and place combination still points to one person.
• Revealing box length: a box sized exactly to a short village name can be enough to guess it.
• Pixelating or blurring images instead of replacing them: with low resolution or predictable text, the content can sometimes be reconstructed.
• Redacting where pseudonymising was needed: if readers must tell the parties apart, a wall of black boxes is unreadable and someone ends up sending a “more useful” version outside any control.

How to check a PDF before it goes out

These checks take five minutes and catch most failures. Run them on the final file, not the working copy:

The ICO's July 2025 guidance on disclosing documents to the public covers the same ground for spreadsheets and office files: hidden rows, columns and worksheets, active filters, metadata, converting to simpler formats and avoiding ineffective techniques. In US federal courts, Rule 5.2 of the Federal Rules of Civil Procedure also limits what may appear in filings (for example, only the last four digits of a Social Security number), which makes reliable redaction a routine part of litigation.

A process that prevents mistakes by design

The safest way to avoid these failures is not to rely on the attention of whoever is redacting. A robust process always works on a copy, finds the data systematically (including repeats in headers and annexes), removes the content rather than covering it, cleans metadata, produces a new file and keeps a human review before sign-off. For the organisational side, see our article on common mistakes when redacting PDFs manually.

Anonimatum is built around that approach. It detects personal data with its own AI running on EU servers and with patterns (ID numbers, IBANs, phone numbers, emails), handles scanned PDFs with OCR, shows a preview so you can review and correct before applying, and produces a document in which redacted data is irreversibly removed. It also includes metadata removal and visual redaction of zones for stamps, signatures or photos.