PDF Know-How
PDF stopped being a decision a long time ago. It is built into every operating system, opens in every browser and needs no special software at either end. The useful questions now are what it is still the right format for, and what the law expects of it.
What PDF actually is
Portable Document Format was created by Adobe in the early 1990s to solve a problem that has largely gone away: getting a document to look the same on a different machine, with different fonts and a different printer. A PDF carries its own fonts, layout and images inside the file, so it renders the same everywhere.
It is no longer Adobe's property. PDF became an open ISO standard in 2008, as ISO 32000-1, and the current version — PDF 2.0, published as ISO 32000-2 in 2017 and revised in 2020 — was developed entirely through ISO. The specification is available free of charge from the PDF Association.
That matters practically as well as legally: no single vendor controls the format, and files created today will still open in decades.
Making one
Nothing needs to be bought or installed. Windows includes Microsoft Print to PDF, macOS offers Save as PDF from any print dialogue, and iOS and Android both export to PDF. Word, Google Docs, LibreOffice, Excel and every serious design application export directly.
One distinction is worth understanding, because it determines whether the file is any good. Exporting from the original application produces a PDF containing real text, working hyperlinks and structural information. Printing to PDF often loses some of that. Scanning a printed page produces a picture of text, which cannot be searched, copied or read aloud by screen-reading software until optical character recognition has been run over it.
The family of standards
Several ISO standards sit on top of the core format, each restricting it for a purpose:
- PDF/A (ISO 19005) is for long-term archiving. It requires all fonts to be embedded and prohibits anything that depends on the outside world, so that the file remains readable indefinitely. Many public bodies require submissions in PDF/A.
- PDF/UA (ISO 14289) covers accessibility, defining how a file must be tagged so that assistive technology can interpret it.
- PDF/X is the print production standard, concerned with colour and resolution.
Accessibility is now a legal question
For anyone running a website that serves customers in the European Union, this is the part that has changed most.
The European Accessibility Act, Directive (EU) 2019/882, became enforceable on 28 June 2025 for new products and services, with existing material given until 28 June 2030. It applies to consumer-facing documents — invoices, statements, contracts, tickets, forms, manuals and product information — across sectors including e-commerce, banking, transport and telecoms, and it reaches non-EU companies selling to EU customers. The technical yardstick is EN 301 549, which incorporates WCAG 2.1 level AA. Enforcement and penalties are set nationally by each member state. In the United Kingdom, the Equality Act 2010 imposes a parallel duty to make reasonable adjustments.
In practice an accessible PDF needs a tag tree marking headings, paragraphs, lists and tables; alternative text for every meaningful image; a logical reading order; labelled form fields; working bookmarks and links; and adequate colour contrast. A scanned document with no text layer meets none of this.
Most of the work is far easier done upstream. A well-structured Word or InDesign file, using real heading styles rather than large bold text, exports to a mostly compliant PDF. Remediating a badly built one afterwards is slow and expensive.
Security, and its limits
The original claim that PDFs can be locked down deserves qualifying, because two quite different things are usually confused.
An open password genuinely encrypts the file: without it, the contents cannot be read. Permission settings — no printing, no copying, no editing — are a different matter. They are instructions that compliant readers choose to honour, and they are removed by widely available tools in seconds. They deter casual copying and nothing more.
The more serious trap is redaction. Deleting text in an editor, or drawing black rectangles over it, does not remove the underlying content from the file; it can be recovered by anyone who selects and copies it. Organisations have leaked confidential material this way repeatedly. Proper redaction tools delete the data rather than cover it.
When not to use PDF
PDF fixes a page at a set size, which is exactly what makes it useful for printing and exactly what makes it awkward on a phone. Text does not reflow; readers pinch and scroll.
For information intended to be read on the web, an ordinary HTML page is usually the better choice: it adapts to any screen, is simpler to correct, tends to perform better in search results, and is generally easier to make accessible. Where a document is offered as a PDF download alongside a web page, the PDF still has to meet the same accessibility standard — providing an accessible page and an inaccessible file is not a solution.
PDF earns its place where the layout is the point: contracts and forms, material meant to be printed exactly, records that must be preserved unchanged, and anything requiring an embedded digital signature.
