What to Redact: A Checklist for Personal & Financial Data

Knowing how to redact is only half the job. The other half is knowing what to redact. This checklist covers the information most often left exposed and shows what to remove from common documents.

Direct identifiers

These identify a person on their own:

• Full names (and nicknames, initials and maiden names)
• Home and mailing addresses
• Email addresses and phone numbers
• Dates of birth
• Government ID numbers: Social Security numbers, National Insurance numbers, Tax File Numbers, Aadhaar or PAN numbers, passport and driver’s licence numbers
• Photographs of faces, and signatures

Financial information

• Full bank account numbers and IBANs
• Payment card numbers, expiry dates and security codes
• Account balances and transaction details that aren’t needed
• Salary, bonus and tax details
• Loan and mortgage reference numbers

A common compromise is to keep the last four digits of an account number so the recipient can confirm which account it is, while redacting the rest.

Indirect identifiers

These can identify someone when combined:

• Job titles in small organisations (“the only HR manager”)
• Specific dates linked to events (a hospital admission, a complaint)
• Postcodes or small towns combined with age or gender
• Vehicle registrations, case and claim numbers, employee IDs
• Names of relatives, schools or employers

Hidden information

• Metadata: the document’s author, title, company and creation software
• Comments and tracked changes left over from editing
• Bookmarks and outlines that repeat headings
• Attachments embedded in the PDF
• Form field values, which can persist even if the visible field is covered
• OCR text layers behind scanned pages

A tool that builds a new, flattened file — like our Redact PDF tool — removes these automatically on redacted pages, and never copies document metadata.

Document-specific examples

Bank statement for a rental application. Keep your name, the bank name, the statement period and income deposits. Redact the full account number (keep the last four digits), individual purchases that aren’t relevant, and any card numbers.

Payslip. Keep the employer name, pay date and gross and net pay if the recipient needs income proof. Redact your tax ID or Social Security number, bank details and employee ID.

ID document copy. Many organisations only need to see your name and photo. Redact the document number, machine-readable zone (the two lines of characters at the bottom), and date of birth if not required. Adding a note like “Copy for [purpose] only” is also good practice.

Medical records. Redact identifiers of anyone other than the patient, unrelated conditions, and insurance numbers unless they’re needed.

Contracts shared as examples. Redact the other party’s name, prices, signatures and any confidential terms.

Emails produced as evidence. Redact email addresses and phone numbers of people not involved, and check email headers and signatures.

Before you send

1. Search the exported file for each redacted item.
2. Read every page one last time.
3. Check the file properties.
4. Send only to the people who need it.

Redaction is about sharing the minimum necessary. When in doubt, ask the recipient exactly what they need — you may be able to remove far more than you think.