Why do password protected and permission restricted PDFs refuse to accept a Bates stamp before production?

Two different locks that fail in two different ways

A PDF can carry two kinds of password, and they behave nothing alike. An open password, sometimes called a user password, encrypts the contents of the file. Without it, no software can read the page objects at all, so a stamping tool has nothing to write onto. You will see this one immediately because the file will not even open for review. The other kind is an owner or permissions password. The file opens freely and looks perfectly normal, but flags inside it declare that editing, content extraction, printing, or annotation is not allowed.

The second kind is what surprises teams. A paralegal opens the file, reads it, prints it, and assumes it is fine, then a batch of two thousand pages returns an error on eleven documents at eleven at night. Software that respects the permissions flag will refuse to modify the page, and that refusal is correct behavior rather than a bug. Tools that ignore the flag exist, and reaching for one is a poor instinct in a legal workflow, because a restriction that somebody deliberately set is a fact about the document that you may need to explain later. Related: What exactly is Bates numbering and why do law firms rely on it for documents?

Keep reading: What exactly is Bates numbering and why do law firms rely on it for documents?, How do you keep Bates numbering consistent across multiple separate document productions?, When should you apply confidential or privileged watermarks to a batch of documents?. See how PdfStampr helps you bulk pdf stamping and bates numbering.

Where the locked files in your matter came from

The sources repeat across matters. Bank and brokerage statements downloaded by a client are often encrypted automatically by the issuer, frequently keyed to something like a date of birth or the last digits of an account number. Payroll and benefits exports arrive locked as a matter of policy. Court copies and e-filing receipts sometimes carry permission restrictions. Board packets, appraisals, medical records, and vendor reports are commonly issued with editing disabled so the recipient cannot alter the professional's work product. None of these people were thinking about your production deadline.

Before you try anything technical, answer the authority question. If the file came from your own client, ask the client for the password, and ask the person who actually downloaded it rather than the person who forwarded it. If it arrived in discovery from another party, do not remove the protection yourself. Ask the producing party for an unrestricted copy, in writing, and keep that request in the file. If it is a signed or certified document from a third party, treat the restriction as intentional and get permission before touching it. Guessing at passwords is not troubleshooting, and it is not a step that belongs in a documented workflow. Related: How do you keep Bates numbering consistent across multiple separate document productions?

Getting the batch moving without creating a gap

The practical fix is to find these files before the run rather than during it. Scan the set for encryption and permission flags as a first pass, list the offenders, and move them into a hold folder. Then let the rest of the batch stamp normally. The one thing you must not allow is a silent skip. A file that fails to stamp while the numbering marches on becomes a hole in the Bates range that nobody notices until opposing counsel asks what happened to a block of numbers, and by then the production letter has already gone out.

When you get the password, resolve each held file deliberately. Preserve the encrypted original exactly as received in your untouched source location, then create a decrypted working copy and stamp that. Note in your log which files were decrypted, by whom, and on what authority. Digitally signed PDFs deserve extra care, because applying any stamp will invalidate the signature. Keep the signed original intact, stamp the copy, and be ready to explain that the signed version exists and has not been altered. Reinsert the resolved files into the sequence in their proper place, or if the range has already been allocated, use the reserved numbers you left for exactly this situation.

Making it a smaller problem next time

Move the encryption check to intake. When documents are collected, whether from a client hard drive, a portal download, or an email pull, run the protection scan then and chase passwords while there is still slack in the schedule. Collecting a password on the day a client hands over a folder takes about a minute. Collecting the same password three weeks later, from a client who is traveling and cannot remember which of their accounts it belonged to, can cost a day. Keep a short matter level note of which sources habitually arrive protected, because they will do it again on the next batch from the same custodian. Related: When should you apply confidential or privileged watermarks to a batch of documents?

Then be honest with your team and your client about what the constraint really is. No stamping tool can open a file it does not have the key for, and none should quietly strip a restriction that someone had a reason to apply. Framing it that way turns an eleventh hour technical failure into an ordinary intake task with a name and an owner. Small firms that build the check into collection almost never hit the midnight version of this problem, and the ones that skip it hit it on roughly every large production. Related: How can a small legal team batch-stamp thousands of pages without losing a whole day?