Redacted, Sealed, Anonymized, De-Identified: What Each Term Actually Means
Most redaction mistakes start before anyone opens a PDF. Someone asks for a document to be "anonymized" and means redacted; someone asks for it "sealed" and means withheld; someone asks you to "de-identify" a record and has a specific regulation in mind that you have never read. These words are not synonyms, they have different definitions in law, and they produce different files. This page is the vocabulary, not the how-to.
Nearly every other guide on this site answers a question of the form "how do I get this content out of this PDF." This one answers the question that comes first and gets skipped: what were you actually asked to do? The request almost never arrives as a technical instruction. It arrives as one word in an email from a manager, a client, a case worker or a compliance inbox — and that word has a precise meaning to the person who sent it and a fuzzy one to you.
The cost of guessing runs both ways. Interpret "anonymize" as "draw boxes over the names" and you may hand back a file that still identifies everyone in it. Interpret "redact the personal identifiers" as "remove every number on the page" and you produce a filing so heavily covered it gets rejected. Two closely related distinctions have their own pages here: permanent redaction versus visual redaction covers what the black rectangle actually does to a file, and does password protecting a PDF count as redaction covers the access-control-versus-removal confusion. What follows is the wider vocabulary those two sit inside.
The terms, one at a time
Redact. To remove specific content from a document while releasing the rest of it. The defining feature is that the document still goes out — redaction is a way of disclosing something, not of holding it back. In US federal civil practice the term is narrow and enumerated: Rule 5.2(a) of the Federal Rules of Civil Procedure requires filings to show only the last four digits of a social-security or taxpayer-identification number, only the year of an individual's birth, only a minor's initials, and only the last four digits of a financial-account number. That is a specification, not a principle. Elsewhere "redact" is used loosely for any removal of sensitive text.
Seal. To place a document, or a version of it, outside public access by order of a court. Sealing is a status granted by a decision-maker; redaction is an edit you perform. They interact rather than compete. Rule 5.2(f) lets a person making a redacted filing also file an unredacted copy under seal, which the court must retain as part of the record, and Rule 5.2(g) allows a reference list identifying each redacted item, itself filed under seal. The Advisory Committee note to the rule describes redaction as a possible alternative to sealing rather than a replacement for it. If someone says "get this sealed," producing a redacted PDF does not accomplish that — a motion does.
Withhold. To not release a record, or part of one, at all. In US freedom-of-information practice withholding and redaction are explicitly paired: 5 U.S.C. 552(b) requires that any reasonably segregable portion of a record be provided after deletion of the exempt portions, and that the amount of information deleted and the exemption relied on be indicated on the released portion — at the place in the record where the deletion was made, if technically feasible. That last clause is why agency releases carry exemption codes printed in the margin of the black box. A redaction there is not supposed to be invisible; it is supposed to be labelled.
Anonymize. To render data such that the person is no longer identifiable. This is a claim about an outcome, not a description of an edit, and the bar is higher than most people assume. GDPR Recital 26 says the test takes account of all the means reasonably likely to be used, by the controller or anyone else, to identify the person directly or indirectly — including singling them out — weighing cost, time and available technology. Data that genuinely clears that bar falls outside the Regulation entirely. Data that does not, does not, however many boxes you drew.
Pseudonymize. Defined in GDPR Article 4(5) as processing personal data so that it can no longer be attributed to a specific person without the use of additional information, where that additional information is kept separately and protected. The key word is separately: the link still exists, somewhere, under controls. Recital 26 is explicit that pseudonymized data which could be attributed to a person by use of that additional information is still personal data. Pseudonymization is a substitution — "Patient 0041" in place of a name, consistently — not a covering-over.
De-identify. A term of art in US health privacy. 45 CFR 164.514 offers two routes. The first is expert determination: a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles determines the risk of re-identification is very small. The second, commonly called Safe Harbor, requires removing eighteen categories of identifier listed at (A) through (R) — names; geographic subdivisions smaller than a state; all elements of dates except year; telephone and fax numbers; email addresses; social-security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate and licence numbers; vehicle and device identifiers; URLs; IP addresses; biometric identifiers; full-face images; and any other unique identifying number, characteristic or code — and additionally requires that the covered entity have no actual knowledge that the remaining information could identify someone. The same section also permits assigning a re-identification code, provided it is not derived from the information and the mechanism is not disclosed.
Expunge. To destroy or legally erase a record so that it is treated as never having existed. This is a court or agency action on an official record, generally in a criminal-justice context, and it is not something a document-editing tool performs. If someone asks you to expunge something from a PDF, they almost certainly mean redact — but it is worth confirming, because occasionally they mean a real expungement order and the PDF is beside the point.
Sanitize, scrub, mask, obscure. Informal. "Sanitize" often extends beyond visible content to metadata, comments, attachments and revision data. "Mask" usually means partial disclosure — showing the last four digits of a card number rather than covering it entirely, which is closer to what Rule 5.2 actually requires than full blackout is. None of these have fixed definitions; treat them as prompts to ask a clarifying question.
Translating the request before you open the file
Four questions resolve nearly every ambiguous instruction:
- Does the document go out, or stay in? If it goes out with holes, you are redacting. If it does not go out, you are withholding or seeking a seal, and no amount of editing achieves it.
- Who defines "enough"? If a regulation or rule applies, the standard is already written down and you can check your work against it. If nobody can name the standard, agree one in writing before you start rather than after someone complains.
- Does anything need to stay linkable? If the recipient must be able to tell that record 12 and record 40 concern the same person, you need pseudonymization, not redaction, and a covering tool will not give you that.
- Should the removal be visible? FOIA-style releases require the deletion to be marked and attributed to an exemption. Most commercial sharing does not. This changes what the output should look like.
Common mistakes and misconceptions
Treating "anonymized" as a synonym for "names removed." It is the single most common error in this list. Identification is frequently indirect — a role, a date, a location, a rare combination of ordinary facts. Removing the direct identifiers is the beginning of anonymization, not the whole of it.
Assuming redaction means blacking out everything sensitive-looking. Where a rule specifies what to redact, over-removal is its own failure mode. Rule 5.2 deliberately leaves the last four digits and the birth year in place; a filing that strips them is not safer, it is non-compliant with what the court asked for.
Believing pseudonymized data is outside privacy law. Recital 26 says the opposite in as many words. The separate key is what makes it pseudonymization rather than anonymization, and the key's existence is exactly why the data is still regulated.
Thinking a sealed filing and a redacted filing are alternatives you pick between. In federal practice you can and often do both, and the unredacted copy filed under seal becomes part of the record the court retains.
Promising de-identification because you removed the obvious identifiers. Safe Harbor is a list of eighteen categories plus a no-actual-knowledge condition. If you have not worked the list, do not use the word — say what you did instead.
Where a redaction tool fits
HidePDF performs one operation from this glossary: manual redaction. You draw boxes over the regions you choose, and the export burns them in by rebuilding every page as an image, so no selectable text survives anywhere in the file. There is no text search, no pattern matching and no automatic detection of names, numbers or dates — every judgement about what is sensitive is yours. It does not pseudonymize, because it substitutes nothing; it does not anonymize, because that is a property of the result that only you can assess; it does not seal or expunge, because those are acts of a court. Everything runs locally in the browser tab, with no upload required. Knowing which word the request used tells you whether this tool finishes the job or is only the first step in it.
Related guides
See also:
Frequently asked questions
Someone asked me to anonymize a PDF. Should I just redact it?
Redacting is usually the right first step, but it may not finish the job, so ask what the file is for before you assume. Under GDPR Recital 26, data only counts as anonymous if the person is no longer identifiable taking account of all the means reasonably likely to be used — including singling someone out indirectly. Covering the names in a twelve-person department's appraisal pack does not reach that bar if the job titles, dates and salary bands left on the page identify people anyway. Redaction removes the content you mark. Anonymization is a claim about the result, and it is the requester's standard to define, not yours to guess at.
If I redact a court filing, do I still need to file it under seal?
They are separate mechanisms and the answer depends on the court and the case, so check the local rules rather than this page. In federal civil practice, Rule 5.2(a) requires redaction of a specific short list of personal identifiers, leaving the last four digits of a social-security or taxpayer-identification number, the year of birth, a minor's initials, and the last four digits of a financial-account number. Rule 5.2(f) then gives you the option of also filing an unredacted copy under seal, which the court must retain as part of the record. The Advisory Committee note describes redaction as a possible alternative to sealing rather than a substitute for it, and a judge can order broader redaction under Rule 5.2(e).
Does blacking out names make a document de-identified under HIPAA?
Not by itself. 45 CFR 164.514 sets out two routes and names are only the first item in one of them. Under the expert-determination route, a person with appropriate knowledge of generally accepted statistical and scientific principles has to determine the re-identification risk is very small. Under the other route — commonly called Safe Harbor — eighteen categories of identifier must go, listed at (A) through (R): names, geographic subdivisions smaller than a state, all date elements except year, phone and fax numbers, email addresses, social-security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate and licence numbers, vehicle and device identifiers, URLs, IP addresses, biometric identifiers, full-face images, and any other unique identifying number, characteristic or code. The covered entity must also have no actual knowledge that what remains could identify someone.
Does HidePDF anonymize or pseudonymize a PDF for me?
No — it does redaction, and it does the manual kind. You draw boxes over the regions you choose and the export burns them in; there is no text search, no pattern matching and no automatic detection of names, numbers or dates anywhere in the tool, so nothing decides on your behalf what is sensitive. Pseudonymization in particular is a substitution — swapping a name for a consistent token so records still link up — and that is a different operation from covering a region, one this tool does not perform. Everything runs locally in the browser tab with no upload required, so the judgement about what counts as identifying stays entirely with you.