How to redact a scanned document or a photo of a page

A scanned document is a picture of a page. To redact it safely, cover each sensitive area with an opaque box, then export the page as a new flat image so that nothing survives underneath. If the file is a searchable PDF, it also holds an invisible text layer, and that layer must go too.

It works for an office scan or a phone photo. Example: Jane Example, a fictional tenant, must send a scanned bank statement to a landlord without showing her account number.

What is the difference between a scanned PDF and a normal PDF?

A normal PDF stores real characters that you can select, copy and search. A scanned PDF stores a picture of each page. The computer sees dots, not letters, so a search for Jane finds nothing. Software must first run optical character recognition (OCR), which guesses letters from their shapes. Three quick tests tell you which file you have.

• Select one word. If the whole page is selected as one block, it is an image.
• Search for a word you can see. No result means there is no text layer.
• If you can select words on a page that is clearly a scan, it is a searchable PDF. Read the next section.

Why can a scanned PDF still contain hidden text?

Many scanners and PDF programs run OCR for you. They keep the picture and add the recognized words as invisible text, which search and copy use. The documentation of OCRmyPDF, an open-source OCR tool, says this is how it and most OCR tools make a scanned page searchable.

Suppose Jane draws a black box over her account number on the picture. The page looks safe, but the invisible text still holds the number: select all, copy, paste, and it reappears. The UK regulator, the ICO, lists this as ineffective: covering text with black rectangles and leaving the text underneath.

What does OCR miss on a scanned page?

OCR is a guess. On a poor scan it misreads letters, and detection cannot find a misread value. If one letter of Jane's IBAN is wrong, a detector may miss the IBAN.

How should you scan a page before redacting it?

1. 1Scan at 300 dpi, or more for very small print.
2. 2Lay the page flat and straight.
3. 3Use grayscale or color for faint print. Pure black and white can lose pale text.
4. 4With a phone, hold it straight above the page. Adobe advises good light and a straight document.
5. 5Check the scan at full size. If you struggle to read a line, so will OCR.

How do you redact handwriting, signatures and stamps?

By hand. No automatic detector finds a margin note, a signature or a name inside a round stamp. Draw an opaque box over each one, a little larger than the text: the tail of one letter can give a name away.

Think beyond words: an ID photo, a barcode or a QR code can identify someone too. Be careful with a marker on paper. The ICO warns that such text may be read by holding the sheet up to the light, and advises disclosing a photocopy or scan instead. Never hand over the marked original.

How do you check that the redaction worked?

Never trust your eyes alone. Test the final file, not the working copy.

1. 1Select all, copy and paste into a plain text editor. The ICO warns that hidden text can be revealed this way. If a masked value appears, the text layer is still there.
2. 2Search the file for the values you masked, such as the surname.
3. 3Try to move a black box. If it moves, it is only an annotation.
4. 4Zoom in and raise the contrast. The data protection authority of the Swiss canton of Fribourg advises this for scanned marker redactions.
5. 5Check the metadata: author, title and, for photos, date and place.
6. 6Ask a colleague to review the file. The ICO suggests peer or senior review.

Keep your original scan safe and clearly labelled, as the ICO advises. A good redaction cannot be undone. Mistakes count too: in the EU, disclosing personal data by mistake can be a data breach. Under Article 33 of the GDPR, it must be reported to the supervisory authority, where feasible within 72 hours, unless it is unlikely to result in a risk.

Which tools can redact a scan properly?

Several routes work, as long as the result is flat. For PDFs, the ICO names Adobe Acrobat's redaction tool. Without it, the ICO describes black rectangles over the scanned page, then a round trip through BMP. For images, it advises a format without layers or edit history, such as PNG or JPEG.

As of September 2026, the OCRmyPDF documentation shows how to strip an invisible text layer or rebuild every page as an image. The low-tech route works too: print, mask, photocopy, scan, check.

Browser-based tools are another route. ONYRI Sanitize, for example, reads scans with on-device OCR in English, French or German, so the file is not uploaded. You review each value found, and the export is always a flattened PDF or PNG with no text layer. It masks only text that OCR could read: handwriting and signatures are not read, and a stamp may be missed. No tool replaces the final check.

Is a redacted scan anonymous?

Not automatically. A rare job title, a date or a small town can still point to a person. In the EU, replacing names with labels such as NAME1 is a form of pseudonymisation, defined in Article 4(5) of the GDPR. Recital 26 says such data should still be treated as information about an identifiable person.

So treat redaction as a way to share less, in line with data minimisation under Article 5(1)(c) of the GDPR. It lowers the risk but does not replace your other duties.