ScrubDrop › Guides

Hidden data in Excel: hidden sheets, veryHidden, pivot caches, external links – how to find every one of them

Last updated: 30 September 2026

The section numbers below are from ECMA-376, Part 1 (5th edition), the published specification of the .xlsx format. It describes each .xlsx file as a ZIP archive of XML parts, and knowing which part holds what is the quickest way to understand why "I can't see it" is not the same as "it isn't there".

1. Hidden sheets

Each sheet is listed in the workbook part with a state of visible, hidden or veryHidden (§18.2.19 and §18.18.68). A hidden sheet is one the specification says can be shown again by the user through the interface — right-click any sheet tab and choose Unhide, which is the check the government's "Hidden data" leaflet recommends: if Unhide is available, something is hidden.

In the Hammersmith & Fulham case, the ICO's reprimand describes an FOI reply containing 35 hidden workbooks, 10 of them with personal data in them.

2. Very hidden sheets

ECMA-376 §18.18.68 defines veryHidden as a sheet that is hidden and "cannot be shown in the user interface" — a state "only available programmatically". Microsoft's Hide or unhide worksheets page says the same from the other side: sheets set to xlSheetVeryHidden by VBA are not displayed by the Unhide command. So the one check most people know will tell you nothing about them.

3. Sheets that are simply out of view

Not every unseen sheet is hidden. The ICO's PSNI penalty notice describes a workbook where the personal data sat in an ordinary worksheet whose tab was scrolled out of sight, with only three small dots beside the visible tab to show that more existed. The notice adds that Document Inspector would not have alerted anyone to it.

4. Hidden rows and columns

Rows and columns carry a hidden attribute (§18.3.1.73 for rows, §18.3.1.13 for columns). The cells are still in the sheet's XML with their values. The leaflet's check is visual: row numbers or column letters that do not run consecutively. Document Inspector on Windows has a "Hidden Rows and Columns" inspector; Microsoft's article warns that removing rows or columns that hold data can change the results of formulas.

5. Cells far from the table

Data typed in column XX or row 90,000 is not hidden in any technical sense; it is just a long way away. The ICO's spreadsheet guidance names this ("remote columns or rows") as an ineffective way to hide information and notes that Document Inspector "cannot identify" it.

6. Pivot caches

A pivot table is a view over a cache. ECMA-376 §18.10.1.68 says the pivot cache records part "stores the underlying source data that the PivotTable aggregates", and §18.10.1.67 describes the cache definition that names each source field. A saveData attribute says whether those records are saved with the cache. If they are, deleting the source sheet does not delete the source data: it is still in the file, in the cache. The PSNI notice notes that the underlying data "can be accessed simply by double-clicking the pivot table", and the ICO's guidance warns that a pivot table stays linked to its source "even if you have copied it into a new workbook".

Cambridge University Hospitals' own statement describes patient data in an FOI spreadsheet that was "not immediately visible" but accessible through a pivot table.

7. Links to other workbooks

A formula that refers to another workbook creates an external link part. ECMA-376 §18.14 shows how the link records the path of the other file and a copy of the values read from it, and §18.14.1 describes these as "cached values from external sources such as other workbooks". So a workbook can carry both the file path of a colleague's spreadsheet and some of its numbers. Microsoft lists external links among the things Document Inspector reports in Excel.

8. Defined names

A defined name (§18.2.5) is a label for a cell, range, formula or constant, and it can point at another workbook. Names have a hidden attribute that hides them in the user interface. A name can outlive the sheet it pointed at, or carry the path of another file.

And the usual metadata

Document properties (author, company, last saved by, dates), comments, custom XML and embedded files travel in workbooks as in Word files. Microsoft's Excel inspectors cover these, as well as filters, which the ICO notes can also hide whole rows depending on the criteria chosen.

What Office's own tools cover

On Windows, Document Inspector reports hidden rows and columns, hidden worksheets, external links, cached PivotTable data, hidden names, filters and more, and for many workbooks that is a good first pass. It does not report remote cells or out-of-view sheets. On the Mac, Microsoft's help does not document an inspector (see our Mac guide). If the recipient only needs figures, a CSV export of the one sheet they need sidesteps nearly all of this: the ICO and the Cabinet Office both recommend it.

What ScrubDrop does with a workbook

ScrubDrop is a pre-send audit, run in your browser; the file is not uploaded. It lists every category above that it finds, with counts and short samples, for free: hidden and very hidden sheets, hidden rows and columns, pivot caches, external links, defined names, properties, comments, custom XML, embedded objects and image metadata. It also flags white or tiny text and cells outside the print area — detection only, since only you can tell whether they matter.

Removing works by rebuilding the workbook from what is known to be needed, not by deleting known-bad parts. The result is then read again with separate parsers (including SheetJS) to confirm the removed categories are gone, and a file that fails is not offered. Removing hidden sheets and rows turns formulas into their last calculated values, so the visible numbers stay as they were. The free version removes properties and comments; hidden sheets, pivot caches, links and names are ScrubDrop Pro categories. Macro-enabled workbooks, .xlsb files and encrypted files are refused rather than guessed at.

The re-check is a strong signal, not a promise. Open the cleaned workbook and look at every sheet before you send it.

How to check this yourself

1. Work on a copy. Right-click a sheet tab: if Unhide is active, unhide and read each sheet.
2. Scroll along the sheet tabs to the end in both directions.
3. On each sheet, look for breaks in the row numbers and column letters, and scroll far beyond the table.
4. Find every pivot table. If the recipient needs only the figures, give them the figures.
5. On Windows, run File › Info › Check for Issues › Inspect Document and read every result.
6. For very hidden sheets and caches, rename a copy to .zip, unzip it and open the workbook part (workbook.xml): look for state="veryHidden" on a <sheet>, and for <pivotCaches>, <externalReferences> and <definedNames> elements.

Questions