How to Redact a PDF for Legal Discovery (2026 Guide)
Published April 18, 2026 · 8 min read
In 2023, the Department of Justice released a redacted PDF from the Mueller investigation. Within hours, journalists had extracted the redacted names by copy-pasting from the “blacked out” sections — the black rectangles were just visual overlays, not actual data removal. The same class of mistake has leaked data from Fortune-500 legal filings, NHS trust reports, and US Supreme Court briefs.
Redaction is harder than it looks. This guide explains what “true redaction” means, how to do it correctly, and the three mistakes that account for almost every high-profile leak.
Black box ≠ redaction
A PDF is a structured document with a separate text layer behind the visible rendering. When a tool “adds a black rectangle” over text, it places a visual annotation on top without touching the underlying character data. Three easy ways to recover “redacted” text from such a PDF:
- Copy-paste — highlight the black area and paste into a text editor. The original characters come out.
- Text search — searching for the redacted term finds matches and highlights their locations inside the black boxes.
- PDF-to-Word conversion — converts the PDF to an editable document where the redactions disappear entirely.
True redaction must remove the text from the content stream itself. That's what Adobe Acrobat Pro does (when used correctly) and what dedicated redaction tools like Konomic's Redact PDF do by default.
The three mistakes behind most redaction leaks
1. Using Markup/annotation tools instead of redaction tools
Apple Preview's “Rectangle” tool, Microsoft Edge's highlight, and every generic PDF viewer's annotation feature produce the same result: a black shape layered on top of intact text. If your tool calls it “annotation” or “markup,” it's not redaction.
2. Redacting images of text without OCR awareness
A scanned PDF with a black box over a name looks redacted. But if someone runs the scan through OCR (optical character recognition), the text layer can resurface underneath the image — sometimes including whatever was “blacked out” if the black layer sits above the OCR text. Best practice: flatten scanned redactions or rebuild the PDF from image-only pages where the OCR layer is stripped.
3. Forgetting metadata
PDFs carry hidden metadata: author, original filename, software version, sometimes a full revision history. A 2019 Vatican scandal exposed an internal memo because the redacted PDF still had the original filename embedded, which referenced the sensitive content. Before distribution, strip metadata with a “Save as PDF/A” export or a dedicated sanitization step.
Step-by-step: redacting a PDF with Konomic
- Go to konomic.io/redact-pdf and upload your PDF. Free tier accepts files up to 50 MB.
- In the Text to redact box, enter each term on its own line. Examples:
John Q. Smith SSN: 123-45-6789 Account 4532-XXXX-XXXX-1234
- Click Preview matches. You'll see a table showing how many times each term appears and on which pages. This step is new and important: it catches typos (“John Q Smith” vs “John Q. Smith”) before you commit to the redaction.
- Review the matches. If any term shows 0 matches but should exist, fix the spelling or try a partial phrase. If a term matches too much (e.g. “John” finds “Johnson”), refine it.
- Click Redact PDF. Konomic removes the text from the content stream and replaces it with solid black rectangles — true redaction, not overlay.
- Download the redacted PDF. Verify by:
- Running a text search for the redacted term — should return zero hits
- Copy-pasting a black-boxed region — should return empty or whitespace
- Opening in Adobe Acrobat's “Redaction Properties” inspector
Compliance frameworks that require true redaction
| Framework | Requirement | What counts as compliant |
|---|---|---|
| HIPAA (US) | 18 PHI identifiers removed | True redaction — black boxes over names/DOB/SSN aren't sufficient per §164.514 |
| GDPR (EU) | Data subject access requests with 3rd-party info redacted | Permanent removal; mere obscuring violates Art. 15(4) |
| FRCP 26(b)(5)(A) | Attorney-client privilege protection in discovery | Text must be irrecoverable; courts have sanctioned parties for overlay-only “redactions” |
| FOIA (US) | Exemption markings for released records | Redactions must correspond to specific exemptions (b)(1)-(b)(9) and be permanent |
Frequently asked redaction questions
Can redacted text ever be recovered?
If done correctly — with actual text removal from the content stream — no. The data is gone from the PDF. Keep an unredacted backup of the original somewhere separate in case you need it for later proceedings.
How do I redact by pattern instead of exact string?
For structured data like SSNs or credit cards, use multiple exact strings. Konomic doesn't support regex redaction in the UI because regex-based bulk redactions are historically the source of over-redaction incidents. If you need pattern matching, use our API with a pre-filtering step.
Do I need to redact metadata separately?
Yes, if the PDF came from Word, Photoshop, or another authoring tool that embeds author info, revision history, or comments. Konomic strips document-level metadata during redaction output, but images embedded in the PDF may retain EXIF. For high-stakes cases, flatten to PDF/A-2b after redacting.
Is free redaction sufficient for court filings?
Yes, as long as the tool performs true redaction (not just overlay). Konomic's free-tier redaction uses the same underlying method as its paid tiers — the free/paid difference is processing throughput, not redaction quality. Verify with the copy-paste and text-search tests above.
⚠️ One-minute redaction checklist
- Used a real redaction tool (not annotate/highlight/markup)?
- Searched for each redacted term in the output — zero matches?
- Copy-pasted from a redacted region — empty or whitespace?
- Stripped document metadata (author, filename, history)?
- Kept an unredacted backup in a separate secure location?