Document redaction checklist for GDPR, HIPAA and disclosure
Written for the person who has to hand a document to a regulator, a requester, an opposing party or a client, and be able to say afterwards exactly what was removed and how they know. This is operational guidance, not legal advice.
1. Decide what must go, before you open the file
Redacting by eye, page by page, is how things get missed on page 41. Write the list first, then apply it uniformly.
- Under GDPR, the target is personal data — anything that identifies a living person directly or in combination with other information you are also releasing. Remember the combination case: a job title plus a department plus a date can identify one individual as surely as a name. Pseudonymisation still leaves you holding personal data; only genuine removal takes the document out of scope.
- Under HIPAA Safe Harbor (45 CFR §164.514(b)(2)), de-identification means removing all eighteen listed identifier categories — names, all geographic detail smaller than a state, all date elements finer than a year that relate to an individual (and any age over 89), phone and fax, email, SSN, medical record and health plan numbers, account and certificate numbers, vehicle and device identifiers, URLs, IP addresses, biometrics, full-face photographs, and any other unique identifying number or code.
- For legal disclosure, follow the order or protocol you were given, and redact for privilege separately from redacting for privacy — they have different reviewers and different consequences.
2. Redact so the content is removed, not covered
- Black boxes drawn on top of text leave the text in the file. This is the single most common failure — how and why it leaks.
- Never blur, pixelate, lower opacity or swap in a lighter colour. Those are reversible.
- Redact the whole identifying element, not just part of it. A partially masked account number plus a name is often still unique.
- Be consistent across the whole release. One un-redacted occurrence undoes every other instance of the same fact.
3. Handle what is not on the page
- Document metadata: author, title, original filename, timestamps, creating software — how to remove it.
- Embedded images and attachments, which carry their own metadata.
- Earlier revisions retained inside the file by incremental saving.
- Comments, tracked changes, speaker notes and hidden rows or columns, if the PDF came from an office document. Convert and re-render rather than trusting the export.
- Bookmarks, form field names and link targets, which frequently quote the text they point at.
- The filename itself.
Smith_J_disciplinary_final.pdfdiscloses before anyone opens it.
4. Verify, with a test you could show someone
pdftotext released.pdf - | grep -Ei "name|@|[0-9]{3}-[0-9]{2}-[0-9]{4}"
exiftool released.pdf | grep -Ei "author|title|creator|producer|date"
Then open the file and select the whole page in a reader, because copy-paste is exactly how a journalist or an opposing party will find it. Verification is not optional — it is the only step that converts "we redacted it" into "we know it is gone".
5. Record what you did
- Keep the unredacted original, under access control, separate from the released copy.
- Note who redacted, who reviewed, the date, and the basis for each category of withholding.
- Keep the verification output. If a release is challenged, the evidence that you checked is worth more than the assertion that you were careful.
- Release the redacted file itself, not a copy of the original with a covering note.
6. Mind the chain of custody of the tool
A document being redacted is, at that moment, at its most sensitive — it is the version that still contains everything. Uploading it to a third-party web service to be redacted puts an unredacted copy on someone else's disk, which is a disclosure in its own right and one you will have to declare. Prefer a tool that processes the file locally, and be able to state that it did.
Blackline runs entirely in the browser with no upload of any kind — you can verify that by disconnecting from the network and watching it keep working. The Agency tier exists for exactly this requirement: it grants the right to self-host the tool on your own domain, inside your own network, and to use it on client work, so the tool itself becomes part of your controlled environment rather than an external dependency. The Team tier covers ten seats for an internal compliance or legal team.