How to Redact Sensitive Information from Documents Before Sharing
Redaction is the process of removing or obscuring sensitive information from a document before it is shared with others. It's standard practice in legal, healthcare, and government contexts — and increasingly necessary for anyone sharing documents with third-party services, contractors, or AI tools.
Why Redaction Matters
Documents regularly contain more sensitive information than they appear to at first glance. A client proposal might include their company's financial data. An HR letter might reference a medical condition. A support ticket might contain payment card details. A forwarded email chain might have names and contact details from three different organisations in the thread.
Sharing these documents without redacting the sensitive content — whether with a supplier, via email, or by pasting them into an AI tool — creates exposure. Under data protection law, the organisation sharing the document is responsible for ensuring personal data is handled appropriately.
What to Look for Before Sharing
Before redacting a document, scan for the following categories of sensitive information:
- Personal identifiers: names, email addresses, phone numbers, home addresses
- Financial data: bank account numbers, sort codes, card numbers, salary figures
- Government identifiers: National Insurance numbers, passport numbers, NHS numbers, driving licence numbers
- Location data: postcodes, GPS coordinates, specific addresses
- Health information: diagnoses, medications, medical history
- Login credentials: usernames, passwords, API keys, access tokens
- Legal information: case numbers, legal opinions, privileged communications
Redaction Methods
Manual redaction in PDF
Adobe Acrobat Pro has a dedicated redaction tool (Tools → Redact) that permanently removes text and images. Covering text with a black box in a PDF editor does NOT redact it — the text remains in the file and can be recovered. True redaction removes the underlying content, not just the visual layer.
Manual replacement in word processors
In Word or Google Docs, use Find & Replace to locate specific terms and replace them with placeholders like [REDACTED] or [CLIENT NAME]. This is effective but slow and error-prone for long documents or multiple categories of data.
Automated PII scanning
For text-based content — emails, reports, meeting notes, documents pasted for AI processing — automated scanning is faster and more reliable than manual review. Mutant Data Safety Layer scans pasted text for over 12 categories of sensitive data and replaces each item with a typed placeholder, all within your browser. Nothing is uploaded anywhere.
For AI tools specifically: Copy your document text into the scanner first. Review what it finds, check the redacted version, then paste the clean text into ChatGPT, Copilot, or Claude. Takes about 30 seconds per document.
Common Redaction Mistakes
- Covering text with a black box: In most PDF editors, the original text is still in the file. Use proper redaction tools.
- Missing metadata: Word documents and PDFs contain metadata — author name, tracked changes, comments — that can reveal information not visible in the document body.
- Partial redaction: Removing a name but leaving a unique job title, department, and company combination can still identify someone uniquely.
- Inconsistent replacement: Replacing a name in the body but missing the same name in headers, footers, or captions.
Best Practice for Sharing Documents with AI Tools
AI tools are particularly high-risk because the text you submit is processed on third-party servers and may be used for training. The safest workflow:
- Paste the document text into a local PII scanner
- Review what it identifies
- Copy the redacted version
- Paste the redacted version into the AI tool
Frequently Asked Questions
Does covering text with a black box in PDF redact it properly?
No. Covering text with a coloured shape in a standard PDF editor leaves the underlying text intact — it can be recovered by copying the text or analysing the file. Proper redaction requires burning the removal into the file permanently, which tools like Adobe Acrobat Pro's redaction feature do.
How do I redact an email before forwarding it?
Copy the email text into a plain text editor and manually replace sensitive content with [REDACTED] placeholders. Or paste it into Mutant Data Safety Layer which identifies and replaces personal data automatically, then copy the clean version.
Is it safe to use an online redaction tool?
Only if the tool processes documents locally in your browser without uploading them to a server. Any tool that requires file upload means your sensitive document has left your control. Mutant Data Safety Layer processes everything locally — nothing is sent anywhere.