Redacting Third-Party Information in a PDF

The file is about your matter, your claim, your dispute — and it is full of other people. Colleagues on a cc line, the other party to a transaction, a witness, a clinician, a neighbour who filed a complaint. You are now making a privacy decision on behalf of someone who is not in the room.

PDF

Drop a PDF here, or click to choose

Your file never leaves your device.

Burning in redactions…

Preparing pages…

Most redaction advice, including most of the advice on this site, quietly assumes one thing: that the sensitive material is yours. You are covering your own account number, your own salary, your own address, and the only interests in the room are yours and your recipient's. If you cover too much you inconvenience yourself. If you cover too little you expose yourself. Either way, the person bearing the consequences is the person holding the mouse.

A very large share of real documents do not work like that. An HR file about one grievance names the manager, two witnesses and the colleague who reported it. A medical record carries the referring doctor, the transcriptionist and sometimes a family member's details in the history. A bank statement shows who you paid. An email thread printed to PDF carries a cc list nobody thought about. A set of minutes names everyone who spoke. The document is about your matter, but it is made of other people's information.

That changes the problem in a way worth naming before you draw a single box. You are no longer managing your own risk; you are exercising a judgement on behalf of people who did not choose to be in your document, cannot see what you are about to send, and will not be told. Getting it wrong in one direction exposes someone who trusted a process. Getting it wrong in the other direction withholds something a recipient may be entitled to. Neither error lands on you first, which is exactly why this decision deserves to be made explicitly rather than by reflex.

Two duties pointing in opposite directions

Nearly every difficult case on this page is a collision between an obligation to hand something over and an obligation not to expose someone. It is useful to see that the collision is recognised in formal processes rather than being a problem you invented.

The United States federal public-records regime, for instance, summarises one of its own withholding grounds in exactly these terms: information that, if disclosed, would invade another individual’s personal privacy — the wording foia.gov uses for Exemption 6. The word doing the work there is another. The scheme starts from a presumption of disclosure and then carves out other people, which is a reasonable description of the shape your own task has.

What you cannot safely do is generalise from that to your situation. Public-records statutes, court rules on filing, discovery obligations, data-protection law, employment procedures and the terms of a specific benefits claim all treat third-party material differently, and a few impose their own redaction conventions, notice requirements or logs. If your document is going into a formal process, the rule that governs that process is the one that decides this, not a general principle and not this page. Where no formal process applies and you are simply sending a file to someone who asked for it, the balance tips the other way: nobody is entitled to the third-party details, so covering them is close to free.

Four kinds of third party, and why the label changes the answer

Before deciding anything, sort the people in the document. Most files contain more than one of these categories, and they do not get the same treatment.

The incidental bystander. Someone whose information is in the file for no reason connected to why you are sending it — a colleague copied on an unrelated paragraph of an email chain, another customer whose transaction appears on the same printed page, a second patient on a batched lab report. This is the easiest category: there is no argument for disclosure, and their details should go.
The co-subject. Someone the document is genuinely partly about: a joint account holder, the other parent, a co-tenant, a co-defendant. Their information is entangled with yours and often cannot be separated without destroying the document's meaning. This is the hardest category and usually the one to raise with the recipient rather than decide alone.
The person in a role. The clinician, the officer, the caseworker, the signing manager, the witness to a signature. They appear because a function had to be performed and recorded. Their name in that capacity is normally part of what makes the document a record at all; their private contact details are not.
The counterparty. The other side of the transaction or dispute — the vendor you paid, the employer you are claiming against, the person who complained. Whether their details stay often depends entirely on the process, because they are frequently the very thing the recipient is trying to establish.

The sorting takes a few minutes and pays for itself, because it converts a vague anxiety about “other people's data” into four concrete decisions you can explain if challenged.

Where other people's information actually hides

Third-party details cluster in the parts of a document nobody reads, which is precisely why they survive a careful redaction of the body text. Work through this list explicitly:

Headers, routing stamps and cc lines. An email printed to PDF carries From, To and Cc on every message in the thread, and long threads carry dozens of addresses in the quoted history further down.
Signature blocks and footers. Job title, direct line, mobile number, assistant's name, office address — repeated on every page of some templates.
Adjacent rows and columns. A statement, register or ledger extract usually shows neighbouring entries that have nothing to do with you. Covering your own row is not the task; covering theirs is.
Witness and notary details. Often the only place in a document carrying a private individual's home address.
Handwritten margin notes and initials. These identify who handled the file and when, and they are easy to skim past because they are not typed.
Reference and case numbers belonging to someone else. A claim number or employee identifier is a name by another route if the recipient can look it up.
Photographs and scanned images on the page. A photo of an accident scene or a workplace may show faces, a vehicle registration or a door number.
Distribution lists at the end of reports. Appendices and circulation lists name everyone who received the document, which is rarely relevant to your matter.

Two cautions carry over from elsewhere on this site and apply with extra force when the people are not you. Covering a name is not the same as removing the identification: a document that still says “the night-shift supervisor who raised the September complaint” has identified someone to any reader who knows the workplace, which is the problem set out in why redacting names isn't enough. And the opposite failure is just as real: blacking out every proper noun in sight produces a document nobody can act on, with the consequences described in over-redacting a PDF.

A workable pass through the file

The sequence matters more than the speed, because the expensive mistakes here are inconsistencies rather than individual misjudgements.

Read the whole document first, drawing nothing. Write down every person who appears and which of the four categories they fall into. A file with nine people in it cannot be redacted reliably while you are still discovering who they are.
Decide per person, not per page. For each name on your list, settle one rule: covered everywhere, covered except where they signed, or left alone. Write the rule down. This is what keeps page eleven consistent with page three.
Apply the role-versus-person test to anyone in a role. Keep what identifies the function; cover what identifies the private human behind it.
Work page by page in order, cc lines and footers first. Do the repeating furniture before the body text, because that is the part your eye stops seeing after page four.
Re-read with your list in hand. Check off each person, each page. The question is not “does this page look redacted” but “is each rule on my list honoured here”.
Note what you covered and why, in category terms. “Third-party personal contact details” and “unrelated customer entries” are defensible labels that disclose nothing. If the production is formal, this note is often the difference between a scope question and a reopened request.

What the tool here does, and what it leaves to you

Being precise about this matters for a multi-person document, because the gap between what people assume and what actually happens is where third parties get exposed.

HidePDF has no text search, no pattern matching and no detection of names or numbers of any kind. You open a PDF, it is read by code running in your browser tab with no upload required, and you move through it with the Prev and Next controls drawing black rectangles by hand. The status bar reports only how many boxes sit on the page currently displayed. Undo removes the last box on that page; Clear page removes all of them on that page. There is no cross-page view and nothing that tells you a name you covered on one page appears again on another — the tool never knew it was a name. Consistency across a long file is entirely a function of your written list.

What the export does give you is finality. When you download, every page of the document is re-rendered as an image, your rectangles are painted on as solid black pixels, and a fresh PDF is built from those images. The covered material is not hidden under a shape; it is not in the file. The trade-off is that the whole document becomes page images, so nothing in it stays searchable or selectable — including the parts you kept. For a production that someone needs to quote from or search, decide that before you export rather than after.

Common mistakes and misconceptions

Treating “it mentions someone else” as a reason to cover it. Mention is not the test. A document whose every third party is blacked out is frequently a document that no longer proves what you sent it to prove, and in a formal process it can read as evasive.

Covering the role along with the person. Removing the name of the doctor who wrote the note, the officer who signed the report or the manager who approved the decision usually destroys the document's value as a record. Their private contact details were the thing to remove.

Redacting page by page without a list. This is the single most common way third-party information survives. Attention drifts, the cc line on page eleven goes unexamined, and one missed instance undoes every other box covering that name.

Assuming consistency across separate files. If you are producing several documents about the same matter, a person covered in one and visible in another is identifiable from the pair. The problem compounds when files are redacted on different days by different people.

Forgetting that you are not the only person who can consent. You can waive your own privacy by sending a document. You cannot waive anyone else's. Conversely, asking a third party whether they mind being named often dissolves a problem that would otherwise cost an hour of careful judgement.

Deciding alone on a genuinely entangled co-subject. Where the document is as much about someone else as about you, the right move is usually to tell the recipient that third-party material is present and ask how they want it handled, rather than silently covering it and hoping.

Relying on initials or partial masking. Covering a surname and leaving “J. M.”, or masking all but the last four digits of an identifier, protects nobody in a small population. Within one workplace, one family or one street, a partial is a full identification.

Overlooking the people in the images. Faces, vehicle plates, badge numbers and house numbers in an embedded photograph are third-party information exactly as much as typed names, and they are the detail most often reviewed last and least.

Related guides

Explore more ways to redact PDFs privately, or use the redaction tool above:

Frequently asked questions

The document is about me. Do I have to redact other people's names before I hand it over?

It depends on who is asking and under what process, and the honest answer is that the duty is rarely all-or-nothing. If you are sending the file voluntarily — to a landlord, a lender, a prospective employer — nobody is entitled to the parts you cover, so covering other people's details costs you nothing and is usually the right default. If you are producing the document under a court order, a records request, an audit or a benefits process, the recipient may be entitled to specific content and you cannot cover it simply because it mentions someone else. The rule that governs your particular process is the thing to check, because processes differ sharply on this. What is consistent across them is the shape of the question: not 'is this person mentioned' but 'does this particular detail about this particular person serve any purpose the recipient has a legitimate claim on'.

Someone else's name is in the document because of their job. Does that count as personal information?

Usually it is treated differently, and the distinction is worth applying deliberately rather than by feel. A person acting in an official capacity — the officer who signed the report, the clinician who wrote the note, the caseworker who processed the claim, the notary who witnessed the signature — appears in the document because a role had to be filled and a record made of who filled it. Covering that typically breaks the document's usefulness as a record and is hard to justify. The same person's private details, though, are a separate matter: a direct mobile number, a home address, a personal email, an employee identifier, a signature image. Those are not what the role required, they simply travelled alongside it. The practical form of the test is to ask whether the detail describes the function or the human, and cover the ones that describe the human.

Can HidePDF find every mention of a third party for me?

No, and for this job in particular it is important to know that. HidePDF has no text search, no pattern matching and no automatic detection of names. You open the file, move through it page by page, and draw black rectangles by hand wherever you decide one belongs; the status bar tells you how many boxes sit on the page you are looking at and nothing more. Every judgement about who counts as a third party and which of their details matter is yours. The consequence for a document with several people in it is that consistency becomes your responsibility: a name covered on page three and missed in a cc line on page eleven is not caught by the tool, because the tool never knew there was a name. Reading the file once with a written list of the people in it, before you draw anything, is the cheapest protection against that.

What if covering the other people makes the document useless as proof?

That is the signal to stop and reconsider the document rather than the redaction. If a reference letter without the referee's name proves nothing, or a payment record whose counterparty is covered no longer shows what you needed it to show, the black boxes have removed the point of sending it at all. Three ways out are usually better than redacting anyway. Ask the third party whether they mind being named, because consent dissolves the problem entirely. Ask the recipient whether a narrower document would satisfy them — a single statement rather than a year of them, a summary from the issuer rather than the underlying record. Or cover the private details while leaving the role intact, which keeps the document evidentially meaningful while removing what was never needed. Sending a document so heavily covered that it cannot do its job tends to produce a request for the original, which puts you back where you started.