Redacting scanned documents: OCR risks and how to double-check

Almost every archive holds two kinds of documents: those born digital (a Word file exported to PDF, a decision generated by a case management system) and those that were scanned (a letter received on paper, a posted invoice, a passport photographed on a phone). To a person they look the same. To an anonymisation tool they do not: a scanned document is an image, and before you can search it for personal data you have to turn that image into text with OCR (optical character recognition). Anything OCR misreads, or does not read at all, is invisible to automated detection. That makes scans the weakest point of almost any redaction or anonymisation project.

Why a scan is different from a native PDF

In a native PDF the text exists as text: you can select it, search it and copy it, and a tool can locate a National Insurance number down to the character. In a scan there are only pixels. OCR rebuilds the text from the image and adds an invisible layer holding the recognised words and their positions. Detection runs on that layer, while redaction has to be applied to the image. Two problems follow: if OCR gets a character wrong, detection fails; and if redaction only touches the text layer, or only the image, the data is still there. The second mistake is one of the classics covered in PDF redaction errors that leak data, and the ICO's guidance on disclosing information safely devotes a section to ineffective redaction.

Six typical risks

1. Recognition errors

Copies of copies, faxes, low resolution and poor contrast produce well-known confusions: 0 and O, 1, l and I, 5 and S, ‘rn’ read as ‘m’. One wrong character is enough for a pattern to miss an identifier. A fictitious example: the NI number QQ123456C is read as ‘QQ12345GC’, and a rule expecting six digits no longer matches. The same happens with an account number split across two lines or a hyphenated surname.

2. Handwriting

Margin notes, names filled in by hand on a form, a signature with the signatory's name underneath. Standard OCR handles handwriting poorly, so this data rarely shows up in automated detection and needs manual zones after a visual check.

3. Stamps, signatures and codes

Received stamps with a name and reference number, company stamps overlapping the text, vertical text in the margin, handwritten signatures, or QR codes linking to a record containing personal data. These are graphic elements, often rotated or overlapping, that OCR reads only partially or not at all.

4. Skewed, rotated or photographed pages

A page scanned at an angle or a phone photo taken in perspective degrades recognition and also shifts coordinates, so the redaction box may land slightly off and leave the tops or tails of letters visible.

5. Mixed documents

A native contract with a scanned copy of an ID document at the end, a case file with photographed annexes, an email with an image attachment. Reviewers who see clean, well-detected first pages tend to trust the rest.

6. Inherited OCR layers

Many scanners create their own text layer, sometimes of poor quality. If you redact the image but keep that layer, the original text can still be copied or searched. Remove it along with the PDF metadata.

Double-checking: a practical method

The law does not prescribe a technique, but the UK GDPR and EU GDPR require security appropriate to the risk (Article 32) and data protection by design (Article 25), and the ICO's anonymisation guidance stresses checking that anonymisation is effective before you rely on it. For scans, that means a double check:

The second check works best when someone other than the first reviewer does it, because a person who has already been through a document tends to see what they expect. If volume makes a full second pass impossible, focus it on scanned pages and documents with sensitive data, where errors cluster. There is a step-by-step guide in how to anonymise a scanned PDF.

How Anonimatum handles scans

In Anonimatum's scanned PDF anonymiser, OCR is applied only to scanned pages: the app shows which pages need it and asks for confirmation first, and pages that already contain text are not processed again. Pages that go through OCR count double towards your page allowance, so a ten-page document with three scanned pages uses thirteen. In your profile you can choose between a faster and a more accurate OCR engine. Images, including HEIC and multi-page TIFF, are converted to PDF and follow the same path. After OCR, the AI detects names, dates, addresses and amounts, as well as QR codes, stamps and digital signatures; patterns cover emails, phone numbers and bank details. Whatever remains, such as handwriting, can be covered with visual anonymisation using zones and shapes, always with a preview and human review before anything is applied. See the plans and start with your own scans.