5 Steps to Pain-free Document Redaction
4 April, 2022Rare is the person who wakes up saying, “Yippee! We’re going to do some redacting today!” But redacting – the process of deleting or concealing confidential and sensitive information in a document before sharing it with third parties – is vital to the success of many ventures.
Candidates for redaction start with Personal Identification Information (PII): Social Security numbers; banking and financial account numbers (sometimes identified using just the last four digits); names of minors (use initials only); Dates of birth (year only); home addresses (city and state only).
In business, redaction is necessary to restrict exposure of sensitive financial information, the identities of individuals, or strategic initiatives to the public or the competition. While you will retain the original unredacted version and can choose to share it with potential customers, the court, or other third parties, you are now able to release a redacted version to a wider audience.
Common business redaction scenarios:
- Litigation: Attorneys have an obligation to protect the privacy of parties involved in litigation or other legal proceedings. Legally redacted copy must be identical to the original paper copy with the exception of removed or overwritten redacted information. Failure to do so may result in the court sanctioning penalties or fines.
- Mergers & acquisitions: M&A due diligence uses information from confidential internal documents to create a bid. Redaction ensures that disclosure is shared selectively with third parties. Redaction allows the due diligence team to select how much information is shared with a potential bidder. For example, a buyer may want to remove any mention of a target company, or a seller might want to remove specific names or personal information associated with their company. Dealmakers know that a breach of information can lead to lawsuits and delay or derail a deal.
- Investor briefs: As with M&A bids, redacting specific information accumulated to create valuations ensures confidentiality until the bids are approved.
While the redaction process is never fun, it need not be overly painful. Here are five tips to reduce the stress and improve the quality security of a redaction project.
1) Use a Virtual Data Room
To ensure that confidential information is protected, start with a secure working environment. For due diligence, contract preparation, case prep, and other tasks involving sensitive documents, use a virtual data room (VDR). A VDR is an ultra-secure online environment for archiving and sharing files and documents. The VDR administrator controls document access and can specify who and for how long a participant can access documents. The VDR software tracks all activity, so the administrator will know exactly what everyone is doing.
Leading VDR platforms like ShareVault also enable fast search and cross-referencing among documents. The administrator can designate document status, such as “draft”, “in progress”, “in review”, and “Final”. Unlike generic cloud-drives like Dropbox, Google Drive, and Box, or document sharing via email, leading VDR platforms like ShareVault provide password-protected safeguards against sharing information with the wrong parties.
2) Establish who has the authority to redact and verify information.
The team administrator creates a permission structure that controls permission to redact documents at each stage of development, from Draft, to Review, to Final. The administrator creates a similar protocol to control the verification and finalization process, which often requires legal review. To speed the verification process, have on hand a copy of any legal statute or regulation that addresses confidential information.
To ensure a quality verification process, consider using a trusted third party to review your document – a “fresh set of eyes” is always a good idea. If there are legal ramifications to your redaction, consider hiring a redaction expert – yes, there are such individuals.
3) Prepare your documents.
The redacting process is organic and dependent on the records you manage, the regulations your organization needs to follow, and any guidelines your customers are providing you. Based on your guidelines, create a list of sensitive information in need of review for redaction.
The next step depends on the type of document that is subject to review:
- If the document is on paper, scan the document using Optical Character Recognition (OCR) software, which locates and highlights that information.
- If the document is electronic and was created in Word, Google Docs, Excel, or other popular software, use the software’s “search” function to identify redaction candidates.
- If the document is a PDF, use Adobe Acrobat’s search function to locate sensitive information.
4) Redacting paper documents.
- Print out the paper document using the one-sided printing option.
- Use a blade or scissors to manually remove the text that needs to be redacted, and then make a clean photocopy.
- Alternatively, use a redaction pen, Sharpie, or opaque tape to cover the redacted sections, and then create a clean photocopy.
A warning: when using a pen or tape to redact, there is a risk that hidden text or metadata remains on the document and may appear when put through a highly sensitive scanner.
Redacting paper documents is a chore – it’s time-consuming, labor-intensive, and wastes a lot of paper. However, it may be necessary, particularly with older documents.
5) Redacting electronic documents.
Redacting electronic documents is easier than paper documents. Specific methods for scrubbing metadata vary according to the file format.
- For a document created in Microsoft Word or Excel or Google Docs, the fastest way to obscure text is to select the word(s) to be redacted and use the “Highlight” command to choose black. The word(s) will then be obscured by a black panel. For Word or Excel docs, you can also select the text and choose “Hidden” in the font menu.
- For a PDF, use Adobe Acrobat 8.0 or higher and click on Select Tools > Protection > Remove Hidden Information.ShareVault provides a more detailed description of how to do redaction in a PDF.
Warning: Text obscured by Highlighting can be reversed. For a Word, Excel, or Google Docs document, a third party can simply highlight the text and reverse the Highlighting command. In a PDF, Highlighted text can be reversed if a third party copies the text and uses an editing program like Notepad.
Another security risk is metadata, which can be embedded in a document. A third party can open a copy of a redacted document in its software of origin and trace its metadata to reveal an earlier version of the document, thereby eluding the redaction process.
To ensure security, the best protocol is to make a paper copy of the redacted document, then save it as a PDF. Since the printout does not provide access to the original document’s software, a third party cannot reverse Highlighting or access metadata.
Back it up!
Document security is just as critical once the deal is done. Maintain a copy of all your files, including drafts, revisions, submission(s), downloads, and reads. This process protects confidential information, and it provides a history of document versions and participants, which will be necessary should there be a legal review.
If you are using a platform like ShareVault, the administrator can track every version of the document using the audit command. The data can then be safely archived with your virtual data room provider, or transferred to your company’s archives, or burned to CD.
Got questions? Ask an expert!
ShareVault is the leading secure online document sharing environment for companies in legal services, finance, healthcare, life sciences, real estate, energy & resources, and education. Our experience support team is ready to answer your questions about our VDR platform, built-in document co-authoring, and specific issues like document redaction. Let us help!