Practical review resource

Legal redaction QA checklist

Use this checklist before releasing redacted documents for a DSAR, disclosure exercise, investigation, litigation production or confidential information request.

Published by RedactAgent · Updated 16 July 2026 · General information, not legal advice.

1. Confirm scope and authority

Purpose

Identify the disclosure, production or sharing purpose.
Record the applicable legal basis, instructions and deadline.
Separate legal advice from software-assisted workflow decisions.

Data categories

Define personal, special-category, privileged and confidential information.
Document third-party data and exemption handling.
Confirm whether pseudonymisation is sufficient or irreversible removal is required.

Document population

Check custodians, date ranges, sources and collection completeness.
Preserve parent, attachment and duplicate-family relationships.
Record inaccessible, encrypted or corrupted exceptions.

2. Validate every content layer

Visible content

Inspect text, images, signatures, faces, stamps and handwriting.
Check headers, footers, comments, annotations and tracked changes.
Review spreadsheet cells, formulas, hidden rows, columns and sheets.

Extracted and hidden content

Search text after export for every known target value.
Check metadata, attachments, embedded objects and OCR layers.
Confirm redaction is removal, not only a visual rectangle.

Geometry and context

Confirm each mark covers the complete target at readable zoom.
Inspect neighbouring words, line wraps and table cells.
Verify multi-page and repeated occurrences.

3. Human review and production controls

Reviewer validation

Route low-confidence, privilege and exception items to a qualified reviewer.
Record approvals, rejections, changed marks and reasons.
Use a second reviewer for high-risk or representative samples.

Final output

Open every output independently of the review system.
Search, copy and inspect text layers for redacted values.
Confirm filenames, page counts, orientation and document order.

Audit pack

Retain source hashes, processing versions and review history.
Record withheld documents and production exceptions.
Generate a manifest and verify delivered file hashes.

Use the checklist as evidence, not a guarantee

No checklist or automated system guarantees legally sufficient redaction. Adapt the controls to the matter, jurisdiction, client instructions and risk. The responsible legal or privacy team must approve the final production.