How to Redact a PDF Safely Before Sharing in Africa

Redacting a PDF means permanently removing information from the copy that will be disclosed. It is not the same as placing a black shape over text, changing the text colour, cropping a screenshot or hiding a layer. Those shortcuts can leave names, identity numbers, account details, signatures or confidential passages available to search, selection, copy and paste, or later editing.

Use the AfroTools PDF Redactor to work locally in your browser, mark areas for removal and export a flattened copy. The tool does not upload the PDF to AfroTools. You still decide what must be removed, review every page and verify the saved output before sending it. The technical and privacy sources in this guide were checked on August 14, 2026.

Start with the disclosure decision

Redaction is one control inside a wider disclosure process. Before opening a tool, record why the document is being shared, who will receive it, which pages or fields they need and which authority governs the handoff. The answer may come from a court direction, procurement rule, employer process, customer request, regulator instruction, contract, access-to-information procedure or internal policy. A technically clean PDF does not create permission to disclose it.

Africa does not have one redaction law or one universal list of fields to remove. Follow the law and instructions that apply to the organization, person, country and transfer. The Kenya Office of the Data Protection Commissioner, for example, lists names, identification numbers, dates, addresses, telephone numbers, location data, online identifiers, photographs, video, audio and biometric information among information that can identify a person. It also distinguishes sensitive categories that need additional protection. That list is useful for a Kenyan review, but it should not be copied as the complete legal test for every African jurisdiction.

Use data minimisation as an operational question: does the recipient need this exact field to complete the stated task? If a tender evaluator needs evidence of experience, they may not need an employee's home address or full identity number. If a claims reviewer needs a transaction, they may not need unrelated transactions on the same statement. The governing process, not convenience, determines what can be withheld.

Preserve the original and create a controlled copy

Keep the source document unchanged in its approved storage location. Create a working copy with a clear version name such as the document reference, disclosure purpose, review date and a status label. Do not overwrite the only original. The UK Information Commissioner's Office and The National Archives both advise carrying out redaction on a copy, because the redacted version is a disclosure derivative, not the master record.

Limit access to both files. The original may contain the very information the redaction is meant to protect. Do not place it in a public link, analytics event, casual group chat, shared test fixture or unprotected email draft. If the source is password protected or digitally signed, use the authorized access route. Do not bypass document security. A flattened derivative is also not the signed original and should not be represented as retaining the original digital signature.

Record the source filename and a stable internal reference without putting sensitive values into the public filename. Mark the working copy clearly so a reviewer cannot accidentally send the original. If the disclosure is later corrected, the version trail should show which file was reviewed, approved and sent.

Identify what kind of PDF you have

A PDF page can contain selectable text, a scanned image, an optical character recognition text layer, form fields, annotations or a mixture of these. The visible page alone does not tell you which components are present.

• Native text PDF: text can usually be selected and searched. A drawn rectangle may sit above the words while leaving them intact underneath.
• Scanned PDF: each page may be an image. Text search can miss everything, so the reviewer must inspect the page visually.
• OCR PDF: the page looks like a scan but includes an invisible or aligned text layer. Search helps find terms, but OCR errors can miss characters and values.
• Mixed PDF: some pages are searchable while others are images, attachments, forms or exported screenshots. One search result does not prove that the rest of the file was checked.

Test several pages by selecting text and searching for a known word. Review thumbnails, rotated pages, blank-looking areas, appendices and page count. If the document contains embedded files or unusual interactive content outside the rendered pages, use a specialist PDF inspection process. The AfroTools workflow focuses on the visible pages it renders.

Build the redaction list before drawing boxes

Create a review list from the disclosure decision. Include exact names and numbers, common variations, initials, spacing changes and repeated labels. Also list information that a text search cannot reliably find: signatures, faces, photographs, handwritten notes, stamps, QR codes, barcodes, maps, charts and scanned identity documents.

Read the document once for meaning before applying marks. Context matters. Removing a name in the body while leaving the same name in the subject line, signature block, page header or annex index is incomplete. A number may appear both as text and inside an image. A table may continue across pages. A comment or handwritten margin can identify the person even when the central paragraph is clean.

Use a consistent notation for each removal reason. The redacted output does not always need to reveal the reason, but the controlled review record should. This makes a second review possible and helps explain why two similar fields were handled differently.

Mark the PDF locally in AfroTools

Open the AfroTools PDF Redactor, choose the controlled working copy and wait for all pages to render. The current tool processes the file in the browser. It does not send the uploaded PDF to an AfroTools server. This local-first design reduces an unnecessary network transfer, but it does not protect files already stored in an unsafe location or information later sent through an insecure channel.

1. Confirm the file: compare the displayed filename and page count with the review record. Stop if either is wrong.
2. Find likely text: use text search and available pattern suggestions to locate repeated values. Treat the results as leads, not a complete redaction list.
3. Draw manual areas: place a redaction box over the full visible item. Include descenders, neighbouring punctuation and the complete image or signature where required.
4. Review page by page: inspect the rendered page at a useful zoom. Check headers, footers, tables, stamps, images, margins and repeated references.
5. Check every page: use the page review state to track progress, but do not mark a page complete until both search-led and visual checks are finished.

Search cannot prove completeness. The ICO warns that a visual black box can leave underlying text accessible, and its checklist requires the final result to be checked. OCR can misread a digit, split a name or ignore handwriting. Manual inspection is therefore required even when every planned search returns a result.

Place boxes deliberately. A box that clips the last digit of an identity number or leaves part of a signature visible may still disclose the value. At high zoom, check that the mark reaches beyond the content boundary without hiding unrelated information that the recipient is entitled to receive.

Understand what the flattened export does

In the current AfroTools implementation, each source page is rendered in the browser, the redaction areas are burned into the page image, and that image is placed into a new PDF. The output does not carry the source PDF's original selectable text layer into the new file. This prevents a recipient from simply selecting the original words underneath an accurately placed box.

Flattening does not repair a missed redaction. If a name remains visible on another page, it will remain visible in the output image. It also changes the document's capabilities. The resulting pages are image based, so text search, text selection, screen-reader navigation, tagged structure, editable form fields and original digital-signature validation may be lost.

Decide whether that tradeoff is acceptable before export. A court, procurement portal, employer or regulator may require searchable or accessible documents. Ask the recipient for its accepted format. High-risk workflows that must preserve accessibility, tags, legal review codes, signatures or complex PDF objects need purpose-built redaction software and an approved procedure. Do not promise that one flattened file meets every portal or accessibility requirement.

Verify the exported PDF, not the editor preview

Save the flattened PDF with a distinct disclosure filename. Then close the editing view and open the saved output as a new recipient would. The file that leaves the organization is the file that must pass review.

A search returning no results is expected for an image-only flattened file, but it is not enough by itself. Inspect every page visually because protected information can be part of the pixels. Zooming also helps find a box that stopped short of a handwritten note or image border.

Check the output for accidental over-redaction. The recipient should still receive the information authorized by the disclosure decision. Compare against the approved removal list, not by casually reopening the unredacted original in an uncontrolled environment.

The National Archives toolkit says the obscured information must not be seen or guessed. That includes clues left by surrounding text. If removing a person's name still leaves a unique job title, address and event date that identify the same person, return to the disclosure decision and assess the combined context.

Record and send the approved version

Keep a short disclosure record: source reference, purpose, recipient, applicable instruction or policy, fields removed, tool or method, reviewer, verification date, approved output filename and transmission channel. Do not copy the protected values into an unsecured log. The record should prove the process without recreating the confidential document.

Send only the approved output. Recheck the attachment after it is added to an email or portal, because a similar filename can cause the original to be selected by mistake. Use the recipient's required secure channel and confirm access permissions. A technically redacted PDF can still be exposed by a public link, wrong email address or open shared folder.

If an error is found after disclosure, follow the applicable incident and breach process immediately. Do not assume that deleting a message recalls every copy. Preserve the facts needed by the organization's privacy, legal, security or records team.

Know when this browser workflow is not enough

The AfroTools PDF Redactor is suitable for straightforward visible-page redaction when the user can identify every area and an image-based output is acceptable. It is not a legal review system, records-management platform, malware scanner, digital-signature service or guarantee that a disclosure complies with local law.

Use an approved specialist workflow for large evidence bundles, court filings, medical records, child data, protected witnesses, national-security material, complex attachments, mandatory accessibility, signed records or documents where a missed item could cause serious harm. Require trained reviewers and quality assurance appropriate to the risk.

NIST SP 800-122 describes protection of personally identifiable information as context based. That principle is useful here: the sensitivity of the data, the likely harm, the recipient, the document format and the safeguards around transmission all affect the control needed. A reusable checklist supports judgment, but it cannot replace it.