A pre-send file cleaning rule for small teams: a template to adapt

Last updated: 19 October 2026

Short answer: a small team does not need a long policy to stop hidden data leaving with its files. It needs one page that says which files the rule covers, what is removed before they go, who takes a second look and when, what the exceptions are, and what gets written down. The template below has those parts; replace the bracketed words, cut what does not fit your work, and put it where people send files from. It is a starting point, not legal advice.

Why write it down

The UK regulator's guidance on personal information 'hidden' in documents says organisations must "have appropriate data protection policies and procedures to help staff disclose documents securely and respond to accidental breaches effectively". The same page says they should "check documents appropriately before disclosing them", and, of tools such as Document Inspector, that "you should still check documents yourself, even if you have used a software tool to help you". That guidance is written for UK organisations and is under review; whatever applies to you, a rule people can find and follow is what turns those points into a habit.

The template

[Team name]: cleaning files before they leave

Owner: [name or role]. Last reviewed: [date].

1. What this covers

Every Word, Excel and PowerPoint file that we send outside [the team / the organisation]: to clients, suppliers and the public, and uploads to websites and online services. It does not cover files shared only inside [the team].

2. Before a file leaves

Work on a copy. Keep the original.
Accept or reject every tracked change, and read the result.
Delete every comment and note, including resolved ones.
Remove the document properties: author, last modified by, company, manager and custom properties.
Excel: show hidden and very hidden sheets, hidden rows and columns, and rows hidden by filters, then delete what the recipient should not receive, checking the formulas that depend on it. Break or remove links to other workbooks, and remove pivot tables the recipient does not need. If the recipient only needs figures, copy just those cells as values into a new workbook, or send a CSV file.
PowerPoint: remove speaker notes, hidden slides and anything outside the slide area, unless the recipient needs them.
Pictures: remove camera and location details before inserting photos.
Give the file a name that says only what the recipient should see.
If the recipient only needs to read the file, send a PDF made from the cleaned file, with document properties and markup left out of the export, and check the PDF's properties.
Open the final file and read it as the recipient will.

3. Never

Colour text to match the background, cover it with a shape, or format it as hidden, to keep it from the recipient. Delete it.
Send the working file when a cleaned copy or an extract will do.

4. A second look

A second person checks the final file before it goes when it holds personal information about anyone other than the recipient, or when it goes to the public. For routine files, the sender's own check is enough.

5. Exceptions

The recipient needs our tracked changes or comments (a draft being negotiated, a review): send them deliberately, remove everything else in section 2, and say in the message that the file carries them.
A legal or regulatory process needs the original file with its metadata: do not clean it. Follow that process and ask [role] before sending.
Anything else: [owner] decides, and the decision is recorded.

6. What we record

For files that had a second look, and for every exception: the date, the file, the recipient, who checked it and how. A tool's report can be attached.

7. Review

[Owner] reviews this rule every [twelve months] and after any file goes out with something it should not have carried.

Putting it to use

Make it easy to find. Put it beside the shared folder or the email templates people send from, not in a policy library.
Show it once. Take a file with a comment, a tracked change and a hidden sheet, and clean it together. The ICO's page above also says staff should get "appropriate data protection training about disclosing documents securely".
Adjust the lines to your work. A team that sends spreadsheets to the public may want a second look on every one; the Cabinet Office's freedom of information guidance, for example, expects spreadsheet disclosures to be reviewed by two people (see hidden Excel data in FOI replies). A team that sends contracts may care most about tracked changes.

The steps in section 2 are explained one by one in the pre-send checklist, and by kind of work in the checklist by role.

Where a tool helps

Much of section 2 is mechanical: looking through parts of the file that the screen does not show. ScrubDrop helps with that in the browser; the file is not uploaded. For free, it lists the supported kinds of hidden data it finds and removes properties, comments and tracked changes from one file at a time. ScrubDrop Pro removes the structural kinds as well, takes several files at once, and writes an audit report that section 6 can point to. A tool does not decide whether what is visible should go to this recipient, so step 10 and the second look stay with people.

Questions

Is this template legal advice?

No. It is a starting point for a team's own working rule. What your organisation must do depends on the law that applies to it and its own obligations; adapt the text with whoever advises you on those.

Does every file need a second person to check it?

The template asks for one where a file holds personal information about other people or goes to the public, and leaves routine files to the sender. Choose the line that fits your work, and write it down.

What if the client needs our tracked changes?

That is an exception the template provides for. Send the changes deliberately, remove the rest (properties, other comments, hidden content), say in the message that the file carries tracked changes, and record it.

Sources: the ICO page linked on this page was checked on 19 October 2026. You may copy and adapt the template text for your own team.

Try the rule on one file, in your browser. Free: one file at a time; the supported kinds of hidden data it finds are listed, and properties, comments and tracked changes are removed. Check a file.