How to Redact PII from Discovery Documents

Producing documents in discovery means handing sensitive material to the other side, and often to the public record. Before anything goes out, personally identifiable information (PII) that isn't relevant to the case usually has to be removed: Social Security numbers, financial account numbers, minors' names, home addresses, dates of birth, and medical identifiers. Get this wrong and you've disclosed protected data; get it technically wrong and the "redacted" text is still recoverable.

This guide walks through redacting PII from discovery documents the right way: permanently, and without uploading privileged files to anyone's server.

What counts as PII you typically redact

Rules vary by jurisdiction and protective order, but the personal identifiers commonly redacted in filings include:

• Social Security / taxpayer ID numbers (often all but the last four digits).
• Financial account numbers (bank, credit card, brokerage).
• Names of minor children (frequently replaced with initials).
• Dates of birth (often year only is permitted).
• Home addresses and personal phone numbers.
• Medical record numbers and health identifiers.

Always check the governing rules and any protective order before deciding what stays and what goes.

Why "black box" redaction is malpractice-grade risk

If you draw a black rectangle over an SSN in a basic annotator, the number is still in the file, the box is a graphic on top of live text. Opposing counsel, a vendor, or a journalist can copy it out or extract it in seconds. In a litigation context, that's not just embarrassing; it can be a sanctionable disclosure of protected information.

Real redaction removes the underlying content. The most dependable way to do that in a browser is to rasterize the covered area so no text object remains beneath the mark.

Step 1: Keep the file on your device

Discovery documents are confidential by definition. Uploading them to a cloud redaction service to process them means the original privileged file now lives on a third party's servers. Use a tool that runs locally.

PDF Zone's Edit PDF tool processes everything in your browser, the document is never uploaded, and its redaction rasterizes the covered region so the data can't be recovered.

Step 2: Redact every occurrence

1. Open the Edit PDF tool and drag in your production PDF.
2. Select the redaction tool.
3. Use Ctrl + F to locate each PII string so you don't miss one.
4. Draw a redaction box over every instance, including in headers, footers, tables, exhibit stamps, and captions where identifiers repeat.
5. Apply and download the redacted copy.

Long productions repeat the same identifier dozens of times. Work page by page; the cost of one missed SSN is far higher than a careful pass.

Step 3: Strip hidden data

On-page redaction doesn't touch metadata. Discovery files can carry author names, edit history, and comments in document properties. Clear them:

• Edit Metadata: remove title, author, and keyword fields.
• Flatten PDF: collapse any annotation, form, or comment layers.

Step 4: Verify before production

1. Open the downloaded file fresh.
2. Try to select each redacted area, nothing should highlight.
3. Search redacted numbers/names with Ctrl + F, zero results.
4. Optionally run Extract Text and confirm the identifiers are gone.

Step 5: Bates number and produce

Most productions need consistent Bates numbering across the set. Add sequential stamps, keep a privilege log of what was withheld, and, if the protective order calls for it, encrypt the file before sending. To combine multiple documents into a single production set first, use Merge PDF.

Frequently Asked Questions

How do I redact PII from a discovery document for free?

Open PDF Zone's Edit PDF tool, select the redaction tool, box out every personal identifier, apply, and download. The tool rasterizes the covered area so the data can't be recovered, and it runs entirely in your browser with no upload.

Is it safe to redact confidential litigation files online?

Only with a tool that processes files locally. PDF Zone redacts on your device and never uploads the document, so privileged material isn't sent to a third-party server. Avoid any redaction service that requires uploading the file.

What PII is usually redacted in discovery?

Commonly: Social Security and taxpayer ID numbers, financial account numbers, minors' names, dates of birth, home addresses, personal phone numbers, and medical identifiers. Follow the governing rules and any protective order for specifics.

Can redacted PII be recovered from a PDF?

If the redaction was just a black box, yes, the text remains in the file and can be copied or extracted. Rasterized redaction removes the underlying content so nothing is recoverable.

How do I make sure I didn't miss an SSN?

Use Ctrl + F to search the document for the identifier before and after redacting. A post-redaction search returning zero matches confirms every occurrence was removed, including in headers, footers, and tables.

Does redaction remove metadata from discovery files?

No. Redaction removes on-page content you box out; metadata like author and edit history lives separately. Use Edit Metadata and Flatten PDF to clear it.

Can I redact a scanned discovery document?

Yes. On a scan the text is already an image, so boxing the area and flattening removes it cleanly. Redact last, then verify that nothing is selectable or searchable.

Should I encrypt the redacted production?

If the protective order requires it or you're transmitting sensitive material, yes. After redacting, use the Encrypt PDF tool to password-protect the file before producing it.

---

Related: Famous PDF Redaction Fails · How to Redact a PDF · Edit PDF · Encrypt PDF