ScrubDrop › Guides

Office file metadata and the GDPR's data minimisation principle

Last updated: 17 October 2026

What the principle says

Article 5(1)(c) of the General Data Protection Regulation says personal data shall be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation')". The UK GDPR keeps the same words.

The ICO's page Principle (c): Data minimisation notes that "The UK GDPR does not define these terms", and explains them: adequate is "sufficient to properly fulfil your stated purpose", relevant "has a rational link to that purpose", and limited to what is necessary means "you do not hold more than you need for that purpose."

The European Data Protection Board's Guidelines 4/2019 on Article 25 Data Protection by Design and by Default (version 2.0, adopted on 20 October 2020, section 3.5) list elements a controller may build in. Three of them relate closely to files sent outside an organisation:

• Data avoidance: "Avoid processing personal data altogether when this is possible for the relevant purpose."
• Aggregation: "Use aggregated data when possible."
• Data flow: "The data flow should be made efficient enough to not create more copies than necessary."

Where personal data sits in an Office file

The GDPR, in Article 4(1), defines personal data as "any information relating to an identified or identifiable natural person", and lists a name among the identifiers. In an Office file, information of that kind can sit outside the visible content:

• Document properties: the author, last saved by, manager and company, and custom properties someone added.
• Comments and tracked changes: which can carry the author's name and a time, and what the reviewer wrote about the content, or about a person.
• Paths: the folder a file was saved in, the attached template, and links to other files, which often contain a user name (see full paths in Excel).
• Hidden content: hidden sheets, rows and columns, pivot caches with the source records, speaker notes and hidden slides. These can hold personal data about people other than the author.
• Pictures: camera and location details in a photograph.

The ICO's page How do we avoid an accidental breach when personal information is 'hidden' in documents? describes the same places. It says "Metadata is information embedded within a document", that it "may be embedded automatically into a document when you create, edit and save it", and that "documents may contain metadata that is not appropriate to disclose". It names markup too: "comments, ink annotations and tracked changes".

Not every item is personal data, and not every item has to go. The same ICO page says "Depending on the circumstances, it may be helpful and appropriate to disclose metadata publicly." The principle is about what is necessary for the purpose, which depends on the purpose and the circumstances.

How minimisation applies to a file you send

The ICO's page How do the data protection principles help us avoid accidental breaches? links the two directly: you reduce the risk of disclosing personal information by accident by making sure you do not use too much information for your purpose, for example by extracting only the information you need from a larger dataset. For a file, that means three questions:

1. Does the recipient need the file, or only its content? If they need figures, a CSV or a table in the message can carry a selected set of figures without the workbook's other structures. Changing the format alone does not aggregate the data or remove personal information from it.
2. Of the content they need, what is personal data they do not need? Rows and columns about other people, reviewers' remarks, the history of edits.
3. What does the file carry that nobody chose to send? Properties, comments, tracked changes, paths, hidden sheets, notes and picture details. Take out what the recipient does not need.

The steps, in practice

Once your organisation has decided what the recipient should receive, these checks help prepare that copy. They do not settle what the GDPR requires in a particular case.

1. Make a copy for sending. Clean the copy, not the working file, and do not leave extra copies in shared folders afterwards.
2. Remove the personal data the recipient does not need from the content itself: delete the rows, columns and sheets, rather than hiding them.
3. Remove the hidden data: on Windows, Microsoft's Document Inspector covers many kinds; our pre-send checklist lists the rest, and the same list by role says which matter most for which work.
4. Read the final file, every page, sheet and slide. A name in a visible cell is still a name.
5. If your procedure keeps a log, record which file was checked and what was found. Article 5(2) makes the controller "responsible for, and be able to demonstrate compliance with" the principles; a check log does not by itself show that, and how your organisation records its checks is its own decision.

What ScrubDrop does

ScrubDrop reads .docx, .xlsx and .pptx files in your browser; the file is not uploaded, so the personal data in it is not sent to us. It lists every kind of hidden data above that it finds, for free. The free version removes properties and comments and accepts tracked changes, one file at a time; ScrubDrop Pro removes the other kinds, cleans several files at once, and writes an audit report that records, for each file, a hash of the original and of the result, what was found and what was removed. The result is read again by software separate from the one that wrote it, and a file that does not pass is not offered.

ScrubDrop finds hidden data by kind. It does not decide what is necessary for your purpose, it does not judge whether visible content is personal data, and it does not read text inside pictures. Using it is one step in your procedure, not a substitute for it.

Questions

Sources: the GDPR text on EUR-Lex, and the ICO, EDPB and Microsoft pages linked on this page, were checked on 17 October 2026.