When Someone Challenges Your PDF Redactions
The file is already delivered and the reply says: justify this, or lift it. That is an argument about scope, not about technique — and the copy you sent can no longer help you win it.
Nearly every guide on this site treats the download as the finish line. You decide what has to go, you cover it, you check the exported file, you send it. The pages that look past that moment are about things going wrong mechanically — a box in the wrong place, a text layer that survived, the wrong version attached to the wrong email.
This page is about a different ending, and it is a common one. Nothing went wrong. The redaction worked exactly as intended, the file went out, and the reply came back disputing it. A requester says the withholding is too broad. Opposing counsel asks you to identify the basis for each mark. A client wants to know why half of page nine is black. A regulator asks for the unredacted figure. An employee responding to their own data request points out that they can see a black box where their manager's assessment should be.
That is not a redaction failure, and treating it like one leads people straight into the two worst responses: defending the marks reflexively because lifting them feels like an admission, or caving immediately and emailing the original. The useful framing is narrower. A challenge is a request to change a decision you have already documented, applied and delivered — so the work is partly about the rules that govern the decision, and partly about the awkward fact that the flattened file in the recipient's hands contains no trace of how you made it.
Work out which of four things is actually being asked
Challenges arrive as a single sentence of complaint and almost always resolve into one of these. Naming it before you reply saves most of the argument.
- Explain the basis. The challenger accepts the withholding in principle but wants the rule, exemption or privilege named. This usually costs you nothing except the admission that you should have labelled the marks in the first place, and in some regimes labelling them was mandatory.
- Describe the extent. How much is under there, how many pages are affected, is a whole paragraph gone or two words. Answerable from your log, unanswerable from the delivered file.
- Narrow it. Lift some items and keep the rest. This is the only one that produces a new file, and it is the one with real procedural consequences.
- Lift it entirely. Either because the basis was wrong, or because a court, regulator or senior decision-maker has overridden you. At that point you are producing a different document, not amending a redaction.
A fifth thing sometimes wears the same clothes and must be split off immediately: a claim that the redaction is defective rather than excessive — that the covered text can still be selected, searched or copied. That is an exposure, not a negotiation, and it goes down the incident path instead.
Why the file you sent cannot answer any of this
This is the part that surprises people, and it is a direct consequence of how a real redaction works here.
The export renders every page of the document — including pages you never marked — to an offscreen canvas at a fixed scale of two, roughly 144 dots per inch, paints your rectangles as solid black, encodes each page as a JPEG, and builds a brand new PDF from those images. The new document is created empty and receives only the page images. Nothing from the original object tree comes with it: no annotations, no comments, no form fields, no bookmarks, no layers. The title is set to Redacted Document, the producer and creator to HidePDF, and a creation and modification date are stamped at the moment of export.
Three consequences follow, and all three bear on a challenge:
- There is no covering object to remove. Not for the challenger, and not for you either. The content under a black rectangle is absent from the delivered file, so there is nothing to selectively reinstate. A lift is always a re-export from the original, never an edit of the copy.
- The file carries no record of your reasoning. No author tag, no annotation trail, no edit history, and dates that describe only the export. If you did not keep a written redaction log, your answer to “why is this covered” is a memory test weeks after the fact.
- Nothing was kept anywhere on your behalf. The work happened inside the browser tab in front of you; no upload is required at any point and there is no account, no archive and no copy to retrieve. Your ability to revisit the decision rests entirely on the original file still existing on your own storage, which is why how long you keep the unredacted original stops being a filing-hygiene question the first time somebody pushes back.
What the rules tend to require you to say
The specifics depend on the regime you are in, and the examples below are illustrative rather than a list of your own duties. They are worth reading anyway, because the shape repeats: you owe a description and a basis, never the content.
Under the United States Freedom of Information Act, 5 U.S.C. § 552(b) provides that the amount of information deleted, and the exemption under which the deletion is made, shall be indicated on the released portion of the record — unless including that indication would itself harm an interest protected by the exemption — and that if technically feasible, the amount of the information deleted shall be indicated at the place in the record where the deletion is made. A challenge to a FOIA response is therefore often a complaint about missing annotation rather than excessive withholding, and it can be answered without lifting anything.
In United States civil discovery, Rule 26(b)(5)(A) of the Federal Rules of Civil Procedure requires a party withholding otherwise discoverable information on a claim of privilege or trial-preparation protection to expressly make the claim and to describe the nature of the documents, communications or things not produced, in a manner that — without revealing the protected information itself — will enable other parties to assess the claim. That is the origin of the privilege log, and it is the written answer to a “justify this” challenge.
In a European data-protection subject access response, Article 15(4) of the GDPR puts the same tension the other way round: the right to obtain a copy shall not adversely affect the rights and freedoms of others. Third-party redactions in a subject access file are grounded there, so the explanation you give the requester is about other people's rights, not about your own convenience.
Court orders, protective orders, sector regulators and national data-protection law all layer on top of this, and the detail varies enough that it is genuinely not safe to generalise. Check the rule that applies to your matter, and where a decision has real consequences, take it to someone qualified in that jurisdiction.
How to lift a box properly
- Get the challenge in writing, and get it specific. Page and location, and what is being asked for. A verbal “this is over-redacted” is not something you can act on or later show you acted on correctly.
- Do not touch the delivered file. It is now a record of what you released. Keep it exactly as sent, as its own generation.
- Confirm you still hold the original, and preserve it. If the matter is live, destroying the original is the one irreversible move available to you, and preservation duties can attach before anything is filed.
- Revise the decision list, not the boxes. Change the entry that says “supplier pricing — commercial confidence” to “disclose”, with a date and who approved it. The boxes follow from the list; if you start with the boxes you will miss instances.
- Apply the revised list to the whole document. An item you lift on page nine almost certainly appears on other pages. Partial lifts are how a document ends up internally inconsistent and the challenger ends up with two arguments instead of one.
- Check the nesting before exporting. Everything still covered must have been covered in the first release too. If the revision also covers something new, you have created a pair of files that can be subtracted from one another — the trap described in sending two different redacted versions of the same PDF.
- Re-export from the original and verify the new file. Page through the preview, then test the download itself: nothing selects, the lifted content is readable, everything else is still covered, page count and dimensions unchanged.
- Name it for what it is and transmit it with an explanation. Not
-redacted-redacted. Say which items were lifted, on what basis, and that the earlier copy is superseded — recipients who are not told will keep circulating version one.
Common mistakes and misconceptions
Trying to undo a redaction in the delivered copy. Painting white over the black rectangle produces a white rectangle. The pixels underneath were never in that file. This is the same property that makes the redaction trustworthy, so it is not a limitation to be worked around.
Treating a defect report as a scope argument. “Your redaction is too broad” and “I can read what is under your redaction” require opposite responses on opposite timescales. Read the complaint twice before you decide which one arrived.
Sending the original as a shortcut. Under pressure, handing over the unredacted file feels like candour. It discloses every other person's information in the document as well, including everything nobody challenged, and it cannot be recalled once sent.
Lifting one instance of a recurring item. Names, account numbers and amounts repeat. A lift decided per-box rather than per-item leaves the same word visible on page four and covered on page eleven, which invites exactly the scrutiny you were trying to close down.
Negotiating without a record. If the lift was agreed on a call, write it down and send it. In a disputed matter, the question “who authorised disclosing that?” is asked later and asked seriously.
Destroying the original once a challenge lands. The impulse to clean up is the worst possible timing. A challenge is notice that the matter is live, and the original is the only thing that lets you comply with any outcome of it.
Assuming an exemption label is optional. In several regimes the indication at the point of redaction is required where it is technically feasible. Marking as you go costs nothing; retrofitting it to a flattened file means re-exporting the whole document.
Thinking a challenge means anything left your device. It does not. The only copies in existence are the ones you stored and the one you chose to send. There is no remote copy to be produced, subpoenaed or leaked — and equally none to rescue you if you deleted your own original.
Related guides
See also, or use the redaction tool above:
- How Long Should You Keep the Unredacted Original PDF?
- Sending Two Different Redacted Versions of the Same PDF
Frequently asked questions
Can I just remove one of the black boxes from the PDF I already sent?
No, and not because the tool withholds the ability from you — the content is not in the file any more. The export renders every page to an image at a fixed scale of two, burns the rectangles in as solid black pixels, and assembles a new PDF from those images. There is no covering object sitting on top of live text, no layer to switch off and no annotation to delete, because nothing from the source document's object tree is carried across. Opening the delivered copy in an editor and painting white over a black rectangle gives you a white rectangle. The route to a narrower version is always the same: go back to the unredacted original you retained, re-open it, apply the smaller set of boxes, and export a fresh file. If you no longer hold the original, the lift is not difficult — it is impossible, which is the practical reason retention policy and challenge handling are the same subject.
The challenger says my redaction is defective, not that it is too broad. Is that the same conversation?
No, and conflating the two is the most expensive mistake on this page. A scope challenge says you covered something you were not entitled to cover; it is an argument you can lose politely and answer with a narrower version. A defect report says the covered content is still readable — text selects under the box, a search finds it, a copy-paste returns it. That is an exposure, and the clock on it starts the moment you are told. Verify it yourself from the exact file you sent rather than from your working copy, because the two can differ. Then work out who else holds that file, including anyone your recipient forwarded it to, and handle it as an incident with whoever owns that process where you work. In United States federal practice, Rule 26(b)(5)(B) of the Federal Rules of Civil Procedure sets out a specific route for material produced in discovery that is subject to a claim of privilege: the producing party may notify any party that received the information of the claim and the basis for it, and after being notified a party must promptly return, sequester, or destroy the specified information and any copies it has, and must not use or disclose it until the claim is resolved. Other regimes and other jurisdictions handle inadvertent disclosure differently, so take the procedural question to someone qualified in yours.
Am I obliged to tell the challenger what is under the box?
Almost never what is under it, but frequently something about it — and the something is usually prescribed. Under the United States Freedom of Information Act, 5 U.S.C. § 552(b) provides that the amount of information deleted, and the exemption under which the deletion is made, shall be indicated on the released portion of the record, unless including that indication would harm an interest protected by the exemption, and that if technically feasible the amount of the information deleted shall be indicated at the place in the record where the deletion is made. In civil discovery, Rule 26(b)(5)(A) of the Federal Rules of Civil Procedure requires a party withholding information on a claim of privilege or trial-preparation protection to expressly make the claim and to describe the nature of what is not produced in a manner that, without revealing the protected information itself, will enable other parties to assess the claim. In a European data-protection subject access response, Article 15(4) of the GDPR frames the limit the other way round: the right to obtain a copy shall not adversely affect the rights and freedoms of others. The common shape across all three is that you owe a description and a basis, not the content. Your own obligations depend on your jurisdiction, your regulator and any order in your matter, so check those rather than generalising from these examples.
If I release a less-redacted version, can the two copies be compared against each other?
Yes, trivially, and you should assume it will happen. The export writes one output page per input page at the original page dimensions, so two exports from the same source line up pixel for pixel and an ordinary image difference lights up exactly the regions you treated differently. That is harmless when the second version is a strict superset of the first — the only thing the comparison reveals is the content you decided to disclose. It becomes a real problem when a revision moves sideways rather than outward: if you lift one item while newly covering another, the pair of files read together can disclose more than either was meant to. The rule that keeps you safe is nesting. Everything covered in the more generous copy must also be covered in every less generous copy, so that no two releases can be subtracted from one another. Decide the revision as a change to one decision list, re-export from the original, and never hand-edit a previously delivered file into a new version.