A tax return is the densest personal document most people possess. It states what you earned, from where, what you own, who depends on you, who you are married to, where you have lived, and the identification numbers that unlock all of it.
Somebody asked whether you can afford a flat.
First: is the return even the right document?
Before redacting anything, check whether you can send something better.
Most tax authorities issue an official summary intended for exactly this purpose — variously a tax transcript, a statement of account, an income certificate, or an assessment notice. It is issued by the authority, it verifies more convincingly than a self-supplied filing, and it contains what a third party needs without the schedules.
This is the same move as asking your bank for a proof-of-balance letter rather than redacting a statement, and it is the better answer for the same reason: a document that never contained the sensitive material beats one where you removed it.
When you must not redact
Be careful in the other direction. Two categories where redaction is wrong:
Regulated lending. A mortgage lender assessing affordability generally requires complete returns. An incomplete submission is rejected at best, and omitting material information from a credit application can be treated as concealment rather than privacy.
Your own advisers. Your accountant, tax adviser or solicitor needs the whole thing — that is what you are engaging them for. The right protection there is the channel, not the content.
Redaction is for the landlord, the letting agent, the visa file, the benefit claim, and the counterparty who asked for evidence of income and got a filing instead.
What to keep
- Your name and the tax year
- The income total the request is actually about
- Tax paid, where the requester needs it
- The form identity — form number, filing date, any authority reference that makes it verifiable
What to remove
Your national identification number. Taxpayer identification, social security, or national insurance number. It appears on nearly every page and in the header of continuation sheets, which is where it gets missed.
Your spouse’s details, on a joint return. This is the one people overlook completely. A joint filing contains another adult’s income, identification number, employer and deductions. They are not party to your rental application and their data is not yours to disclose.
Dependants. Children’s names, dates of birth and identification numbers appear in credit and allowance sections. A child’s identifier is a long-lived fraud asset precisely because nobody checks it for two decades.
Address history. Returns often list previous addresses, which is both a security-question answer and a map of your movements.
Bank details given for refunds or payments.
Unrelated schedules. Investment income, rental property, foreign accounts, business profits, charitable giving, medical deductions. Each schedule discloses a different thing about you — charitable giving can indicate religion or politics, medical deductions indicate health — and none of it answers the question you were asked.
Employer identification numbers and your preparer’s details, which identify a firm and a client relationship.
Watermark it
Overlay the purpose and recipient across the page: “Provided to Harbour Lettings, 14 August 2026, for tenancy assessment only.” It costs nothing, does not obstruct the check, and makes the document far less useful if it is later reused. Stamp PDF places it across the page rather than in a corner where it can be cropped off.
The mistakes that undo it
A black box in a PDF viewer is not a deletion — the text stays in the file and is recoverable by selecting and copying, as covered in redaction vs whiteout. Here the recovered text is your taxpayer identification number.
Removing a schedule visually but leaving it in the file. If you are dropping whole schedules, remove the pages, do not simply cover them. And check the page numbering afterwards — “page 7 of 14” with six pages missing looks like an incomplete filing.
Leaving totals that reconstruct what you removed. If a summary line adds up figures you have hidden, the arithmetic gives them back. This is the same trap as a running balance on a bank statement.
Metadata. Tax software writes the taxpayer name, and sometimes the identification number, into the document properties.
Check before you send
- Select all, copy, paste into a plain text editor. Search for your identification number, your spouse’s name, and each child’s name.
- Check every page header and footer — identification numbers repeat there.
- Check the arithmetic on any summary line you left visible.
- Read the document properties.
Doing it
Redact PDF removes the selected content from the file and rewrites the document rather than covering it, clears metadata, attachments and comments in the same pass, and re-reads the export with a second engine to confirm nothing remains extractable.
It runs in your browser. A tax return is the single document that most completely describes a household’s financial life, and uploading it to a free web service in order to hide parts of it is the wrong shape of solution.
Sources and further reading
- Regulation (EU) 2016/679 (GDPR), Article 5 — data minimisation, and the basis for not disclosing a spouse’s or child’s data.
- Regulation (EU) 2016/679 (GDPR), Article 9 — health and religious belief as special category data, both inferable from deduction schedules.
- NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information — why taxpayer identification numbers rank among the highest-risk identifiers.
- Bland, M., Iyer, A. and Levchenko, K., Story Beyond the Eye: Glyph Positions Break PDF Text Redaction, PoPETs 2023(3):43–61.
- ISO 32000-2:2017, the PDF 2.0 specification — page removal versus content covering, and the document information dictionary.