Managing Redacted and Unredacted Files

Redaction failures rarely happen because someone forgot to hide the sensitive material. They happen because the wrong file was attached, or because a black box was drawn over text that remained fully selectable underneath. A disclosure that reveals a protected name, a bank figure, or a privileged passage cannot be recalled once it has left the office. Managing redacted and unredacted versions is therefore less about the act of redacting and more about a filing discipline that makes the wrong file hard to send.

Keep three versions clearly apart

The safest structure separates a document into three distinct copies, each with its own name and access:

• The source: the complete, unredacted original, held securely and never sent out.
• The working copy: where redactions are proposed and reviewed.
• The release copy: the finished, verified file that goes to the other side.

When these are named ambiguously or sit in the same folder, the wrong one is eventually attached. Distinct, unmistakable names and restricted access to the source are the structural defence against that mistake.

Redact the content, not just the appearance

Drawing a filled rectangle over text hides it on screen while leaving the words intact in the file. Anyone can copy the text out, or lift the box, and read what was meant to be concealed. True redaction removes the underlying content, not merely its display. The same caution applies to any layer a document carries beneath its surface.

Inspect the exported file itself

Never assume the release copy is clean because it looks clean. Open the actual exported file and check for what hides below the visible page:

• Selectable text still present under a redaction mark.
• Comments, tracked changes, and annotations.
• Metadata such as author, edit history, and earlier filenames.
• Hidden layers, cropped-but-embedded images, or thumbnail previews.
• Attachments or embedded files travelling inside the document.

A redaction is complete only when the deliverable, not the working copy, has been inspected and found free of the protected material.

Watch scans and recognised text

Scanned documents introduce a particular trap. A black mark placed over a scanned image may look secure, but if recognition has been run, a text layer beneath the image can still hold the very words the mark covers. Where scanned or regional-language files are involved, confirm that no recognised text survives behind a redaction, and that redacting the image has not left a searchable copy of the original text elsewhere.

Record who approved which file for whom

Before anything is released, record the exact file approved, who approved it, and the intended recipients. This is not bureaucracy; it is the record that lets you answer, later and precisely, what was disclosed and to whom. If a question of over-disclosure arises, that note is the difference between a clear account and a guess.

Verify at the moment of sending

The last line of defence is a deliberate check at the point of attachment: confirm that the file being sent is the approved release copy, by name, and that it goes only to the intended recipients. Most disclosure accidents are caught here or nowhere. A moment's confirmation before hitting send is far cheaper than the consequences of the wrong file leaving the building.

Handled as a filing discipline rather than a one-off task, redaction stops depending on memory and starts depending on structure, which is the only thing that holds up on a busy day.