PDF Privacy: The Complete Guide to Secure Document Sharing

PDFs are the lingua franca of digital documents — contracts, medical records, financial statements, court filings, government forms, academic papers. They're also one of the most common sources of privacy leaks, and the leak is almost never the part you can see.

A single PDF can leak: the author's name and the software they used (via metadata), the document's full edit history, hidden layers and comments, embedded file attachments, and — if scanned — GPS coordinates from the scanner or camera that captured it.

Then there's the sharing layer: emailed unencrypted, uploaded to third-party tools, stored on cloud services without access controls. PDF privacy is a multi-layered problem and most people only think about the top one.

1. Metadata stripping. Remove author, title, creator, producer, and timestamps before sharing. PrivacyScanPDF does this locally in your browser — most PDF editors can do it too, but few make it as obvious.

2. True redaction. Don't just black out sensitive text — remove it from the content stream entirely. Visual-only redaction can be bypassed by selecting or copying the 'hidden' text. This has burned people in court filings.

3. Encryption. Use AES-256 password protection for any PDF containing personal, financial, medical, or legal data. Share the password through a different channel (SMS, phone call) than the document (email, cloud link) — if one channel is compromised, the other still protects you.

1. 1Strip metadata with the Remove Metadata tool.
2. 2Redact sensitive content with the Redact PDF tool (true redaction, not visual cover).
3. 3Encrypt the result with a strong password using the Protect PDF tool.
4. 4Share the encrypted file via your normal channel; share the password via a separate channel.

Under GDPR Article 32, personal data must be protected with 'appropriate technical and organizational measures'. PDFs containing personal data (names, emails, ID numbers, financial info) fall squarely under this rule.

Encrypting such PDFs with AES-256 is generally considered appropriate. Emailing them unencrypted — where they transit multiple servers in plaintext and sit on the recipient's provider's disk in plaintext — is not.

For controllers processing EU residents' data: keep PDFs on EU servers (or under adequate safeguards like SCCs or the EU-US Data Privacy Framework), maintain an access log, and redact before sharing externally unless the recipient has a legitimate basis to receive the unredacted data.

Prefer browser-based tools (like PrivacyScanPDF) over server-based ones for any document containing personal data. The 'no uploads' architecture is the strongest technical privacy guarantee available — stronger than any policy or promise.

For sharing: use end-to-end encrypted channels (Signal, ProtonMail, encrypted cloud storage with link passwords). Plain email is unencrypted at rest on most providers — Gmail, Outlook, Yahoo all read mail for spam/ads/features, and a subpoena can expose the contents.

Set expiration dates on shared links where possible. Revoke access after the recipient has downloaded. Audit who has access periodically.

Start at the source. When you scan or export a PDF, use a generic author name ('Document Author' instead of your real name), disable edit history tracking, and turn off location embedding on your scanner. Most PDF software makes these settings hard to find — look for 'Privacy' or 'Document Properties' in preferences.

Process locally. Any redaction, metadata removal, or encryption should happen on your device or in your browser. If a tool requires uploading, find an alternative. This is the rule that catches the most people — 'free PDF tool' sites are almost universally server-based.

Verify before sharing. Open the final PDF in a metadata inspector (browser DevTools, exiftool, or a PDF properties viewer) to confirm nothing leaks. Then share through an encrypted channel with the password delivered separately.