Home › Blog › Privacy

Privacy

Redact Personal Data Before Sharing a Document

By Sourav Mahapatra · 26 July 2026 · 7 min read

You export a spreadsheet to send to a vendor. You forward an invoice to your accountant. You share a screenshot with a support agent so they can see the error.

Each of those is routine. Each of them, done carelessly, hands someone else a PAN number, a home address, a full salary line, or a customer list you had no right to pass on.

This stopped being merely embarrassing

The November 2025 DPDP Rules have staged commencement. Reporting duties depend on the applicable provision and incident; do not use a single headline deadline for every situation. See the DPDP preparation guide and official commencement source.

For document sharing, start with two practical checks:

• Incident handling. Know who reviews a suspected disclosure and determines which notifications and deadlines apply.
• Access and retention. Decide who needs the information and how long each copy must remain available.

You cannot leak data you never sent.

Redaction can reduce unnecessary disclosure, but review the final exported file. Visible masking alone is not enough to establish that underlying text, attachments or metadata have been removed.

What to strip, in order of regret

Work down this list before anything leaves your hands:

• Government identifiers. PAN, Aadhaar, passport, voter ID, driving licence. These are the keys to identity theft and they are almost never needed by the person you are emailing.
• Financial account details. Bank account numbers, IFSC, card numbers, UPI IDs tied to an individual.
• Contact and location data. Personal phone numbers, personal email, home addresses. Work contact details are usually fine; residential ones rarely are.
• Compensation. Salary, CTC, commission rates. A payroll sheet shared to prove one number exposes everyone else on it.
• Third-party names. Your other clients, in a document going to this client. Obvious in hindsight, missed constantly.

The mistake that undoes the whole exercise

Drawing a black box over text in a PDF editor often does not delete the text. It draws a rectangle on top of it. The characters are still in the file, selectable, copyable, and recoverable by anyone who opens it in a different reader. Several well-publicised leaks have been exactly this.

Use an appropriate redaction process, then inspect the exported copy for underlying text, hidden content, attachments and metadata. Rasterising a page alone does not establish that the entire document contains no sensitive information.

Why the redaction tool itself must be local

There is an obvious trap here. If you upload an unredacted document to a cloud service in order to redact it, you have already done the thing you were trying to avoid. The most sensitive version of the file, the one with everything still in it, is the version you handed over.

Choose a processing environment appropriate to the document and your organisation’s rules. A local text tool can be useful, while an approved managed workflow may have different controls.

A two-minute habit

Before attaching a file, check what the recipient needs, remove unnecessary information and inspect the exact exported copy. Keep the original separately. See the text redactor for supported inputs.

Questions people actually ask

What counts as personal data under the DPDP Act?

Broadly, any data about an identifiable individual. In practice that includes names tied to other details, government identifiers, contact details, financial account information and employment data such as salary. If it can be traced back to a person, treat it as personal data.

How long do I have to report a data breach in India?

There is no single deadline covering every incident or regime. Applicable provisions, commencement dates and incident facts matter; escalate promptly to the person responsible for legal and incident response advice.

Is drawing a black rectangle over text enough?

No. In most PDF editors that draws a shape on top of the text while leaving the characters in the file, where they can still be selected and copied. Proper redaction removes the underlying text or flattens the page so nothing remains beneath.

Do these rules apply to a one-person business?

Review the processing activity and applicable provisions and exemptions. A business’s headcount alone does not determine its obligations.

What is the maximum penalty for a data breach?

Penalties depend on the applicable provision and breach. Review the Act’s Schedule and obtain advice instead of treating a headline maximum as a standard outcome.

Written by Sourav Mahapatra, who builds BeginThings: free browser tools and BeginRooms, a 3D workspace you can walk through. Take the 30-second tour or start a free 11-day trial, no card needed.