To redact a transcript means to remove or mask every direct and indirect identifier in the written record, including speaker labels and file metadata. Then you check the exported file to confirm nothing can be recovered.
Someone asks for the transcript of a recorded interview, so you set out to prepare the pages for release. You find that you must redact a transcript that names a neighbour on page 3 and a child's school on page 11. Find and replace will catch the exact strings you type in. It will miss spelling variants, nicknames and indirect identifiers.
Text feels safer than audio because nobody can hear a voice. That feeling is misleading. A transcript can be searched and forwarded in seconds. A single name left in one line can be copied into an email chain with no limit on who receives it.
Why does a transcript leak more than people expect?
Names sit in more places than the body text. They turn up in speaker labels, file names, headers, timestamps and document properties. Automatic transcription also spells names inconsistently. The same person can appear as Siobhan, Shivon and S. Walsh in one file, and a search for one spelling misses the others.
There is also the question of what a reader can work out. A transcript that never names a woman can still point straight at her.
How do you redact a transcript before disclosure?
Work in this order. Scope comes first because it decides what counts as an identifier. Mark identifiers before you change labels, since labels repeat the same names. Metadata goes last, because earlier steps can add tracked changes and comments.
What should you fix first?
Decide who receives the transcript and under which law. The same interview needs different redactions for a requester who is the speaker, for a journalist making a FOI request and for a court bundle. Write down the reason for each redaction as you go. You will need it if the decision is challenged.
What counts as a direct identifier?
Direct identifiers point at one person without help. They include names, addresses, phone numbers, email addresses, dates of birth, national ID numbers, account numbers and vehicle plates read aloud. Read the whole transcript. Do not rely on search alone.
Build a variant list as you read. Add nicknames, initials, misspellings, and phrases like 'my brother' or 'the landlord' where the context makes the person obvious. Search for every variant, then read the text again.
What is an indirect identifier?
An indirect identifier is a detail that identifies a person only in combination with others. 'The only pharmacist at the Elm Road branch, back in March' names nobody and still names someone. Job titles, rare conditions, small places and dates tied to a known incident all work this way.
The test is whether a person who knows those involved could work out who is meant. No software answers that for you. The threshold also moves with the audience. A release to the public under FOI calls for a stricter reading than a copy sent to one individual.
How should you handle speaker labels and third-party names?
Speaker labels are the easiest place to fail. If you remove 'Maria Okafor' from the body and leave 'Maria Okafor:' at the start of each turn, nothing has been redacted. Replace labels with consistent role tags such as Witness 1 and Interviewer, so the reader can still follow who said what.
Decide on each third party individually before you mask anything. In a subject access request, the requester's own words stay in. Article 15(4) of the GDPR says the right to a copy must not adversely affect the rights of others. It also covers their freedoms. The ICO guidance for organizations covers how UK bodies weigh that. A third party's name can sometimes go out because the requester already knows it or the person has consented. Sometimes it cannot.
Which metadata and earlier drafts should you check?
Partial redaction fails here. The visible page looks clean and the file still holds the answer. Look in these places:
Document properties, such as author, title and comments.
Tracked changes and margin comments.
Text sitting under black boxes in a PDF that was never flattened.
Earlier drafts, including the raw automatic transcript, on shared drives and in email.
The audio file name, if the recording is named after a person.
Export the redacted version as a new file, with the text removed rather than covered. Keep the unredacted original under restricted access. Whatever tool you use, confirm that it removes the underlying text. A document redaction tool that only draws boxes does not.
Do you need transcript redaction, audio redaction or both?
It depends on what you hand over.
| Point of comparison | Redacting the transcript | Redacting the source audio |
|---|---|---|
| What you remove | Names, labels, metadata, quoted passages | Spoken words, background voices |
| Needed when | You release only the written record | You release the recording itself |
| Voice still identifies someone | Not in the text | Yes, in any passage left in |
| Main risk | Spelling variants and leftover metadata | Missed passages and overlapping speech |
If you release only the transcript, you redact the text and the audio stays internal. If you release the recording, it needs its own pass, because a voice can identify someone even when every name is gone. Release both and the two must match. A name bleeped in the recording but printed in the transcript tells the requester exactly who was removed, and the redaction has failed.
One way to keep them matched is to redact the audio first with audio redaction software then produce the transcript from the redacted file. The trade-off is that the transcript carries every gap in the redacted audio. Automatic transcription struggles where speakers talk over each other or the recording has background noise, so check every name against the audio by hand. If you need a reviewed, cleaned transcript, redact the text yourself and compare it against the audio line by line.
What changes for FOI, DSAR and court disclosure?
How do FOI and FOIA requests work?
In the US, agencies respond under FOIA, and Exemptions 6 and 7(C) are the ones that protect personal privacy. The official FOIA portal sets out the request process. Agencies have 20 working days to make a determination, and unusual circumstances allow an extension. FOIA also requires the exemption to be marked on the released page at the point of each deletion, so log the reason as you redact. In the UK, section 40 of the Freedom of Information Act 2000 covers personal data, and the response window is also 20 working days.
What about subject access requests?
Under Article 12(3) of the GDPR you have one month to respond, extendable by two further months for complex or numerous requests. An interview transcript about the requester is their personal data. They receive their own words and what was said about them, minus other people's details where release would be unreasonable. A subject access request workflow should include the transcript steps above, not just video and documents.
What about court disclosure?
Courts set their own rules, and a judge can order redactions you did not plan for. In US federal civil cases, Rule 5.2 limits what a filing may show. That means the last four digits of Social Security and financial account numbers, the year of birth, and minors' initials. Other courts and other case types differ. Ask the court or the other side what it expects before you file.
How do you verify the redaction before release?
Verification is a separate job from redaction. Give it to a different person if you can.
Search the final file for every identifier and variant on your list.
Copy all text from the exported file into a plain text editor. Anything still there is recoverable.
Check document properties, comments and hidden layers.
Open the file on a different device or viewer.
Read the whole document once as the recipient would, with no list in hand.
A second reader on a 60 page transcript needs about two to three hours. That assumes a careful pace of 20 to 30 pages an hour. Build that time into the deadline from day one.
Then record what you did, and read our note on when to create a redaction log. If the release may be challenged, a chain of custody and audit trail shows who handled the file and when.
Where does software help, and where does it not?
Automatic detection runs through a 60 page text transcript in under five minutes on a standard office laptop. A careful reader needs two to three hours. Scan time grows with file size, and audio must be transcribed first, which adds time. It does not tire on page 60, which a person reading line by line does. It is most reliable on direct identifiers with a fixed pattern, such as 11-digit UK phone numbers and 8-digit account numbers. The same pattern matches wherever it appears. Names are harder, especially misspelled ones in automatic transcripts, so check every detected name against the audio and correct any misses by hand. Secure Redact detects personal data in audio and documents, and you review each detection before release. Detection is a first pass.
It will not decide that 'the only pharmacist at the Elm Road branch' identifies someone. Human review stays in the process.
Take the last transcript your team disclosed and run it through the verification list above. If a name, a label or a property field survives, you have found the gap before a requester does.
Frequently asked questions
-
Only if you release the recording. If you release only the transcript, you redact the text and the audio stays internal. If you release the recording, it needs its own redaction pass, because a voice can identify someone even when every name has been removed. If you release both, the two must match. A name bleeped in the recording but printed in the transcript tells the requester exactly who was removed, so the redaction has failed.
-
Remove direct identifiers such as names, addresses, phone numbers and account numbers, including every spelling variant. Then check indirect identifiers, like a rare job title or a small location, that let someone work out who is meant. Finally, replace speaker labels with role tags and clear metadata, comments and earlier drafts.
-
It depends on the law. Under Article 12(3) of the GDPR you have one month for a subject access request, extendable by two further months for complex cases. US FOIA and the UK Freedom of Information Act both set 20 working days, and US agencies can extend in unusual circumstances.
-
No. Find and replace misses spelling variants, nicknames and indirect identifiers, and it leaves metadata and earlier drafts untouched. Use it as a first pass, then read the full text and check the exported file.