A pre-send checklist for Office files: the ICO's sign-off requirement, automated
Last updated: 30 September 2026
Short answer: across its recent enforcement documents the ICO keeps asking for the same two things before a file is disclosed: a check of the file for hidden data, and a second person who signs it off. Strictly, the second is a recommendation rather than a legal rule — the ICO says so — but the Cabinet Office sets it as the expectation for central government spreadsheets. A tool can do most of the first step and give the second person a record to sign. It cannot do the reading.
Where the "sign-off" comes from
Four documents, in date order:
- ICO advisory note, September 2023. After the PSNI incident, the ICO's advisory note to public authorities called for a moratorium on disclosing original source spreadsheets to online platforms in response to FOI requests, and for converting spreadsheets to formats such as CSV.
- Cabinet Office, December 2023. The FOI guidance on communication by spreadsheet expects spreadsheets to be tested by people with the technical capability to find hidden material, senior colleagues to be made aware, and every disclosure by spreadsheet to be "reviewed by two separate individuals before a response is sent".
- ICO penalty notice to the PSNI, October 2024. The notice found that the PSNI's checklists asked no question about hidden data. As examples of measures that might have been appropriate, it described the decision maker checking every response and attachment for hidden data, recorded in the audit log, and a team leader carrying out a second check where information is disclosed as a spreadsheet. The ICO's announcement put the fine at £750,000.
- ICO reprimand to Hammersmith & Fulham, May 2025. The reprimand recommends that the council consider making it a mandatory requirement for material prepared for disclosure to be "reviewed by a peer or manager before release", and consider using the ICO's disclosure checklist when preparing information from Excel. It states that its recommendations are not legally binding.
The ICO's current guidance, Disclosing documents to the public securely, frames the underlying duty in its checklists: you should "check documents appropriately before disclosing them, considering the circumstances, including the risk of harm". Its spreadsheet checklist lists, among the things you could do, using software tools to identify hidden data.
None of this is legal advice, and your own organisation's procedure is what binds you. But the direction is clear: check, then have someone else confirm the check.
The checklist
Before you start
- Choose the format. If the recipient needs figures, not a workbook, send CSV or a table in the letter. The ICO, the Cabinet Office and the PSNI's own post-incident guidance all point this way.
- Work on a copy made for sending, not the working file. In the PSNI case described on our FOI leaks page, the file sent was the file the analysis was done in.
Any Office file
- Document properties: author, company, last saved by, custom properties.
- Comments.
- Embedded files and objects. The ICO suggests keeping only a picture where the object itself is not needed.
- Custom XML data.
- Images: EXIF and similar metadata, which the ICO lists among what Document Inspector can find.
- Text formatted to be invisible, such as white on white. The ICO lists this as an ineffective technique to avoid.
Excel
- Hidden sheets, and very hidden sheets, which the Unhide command does not list.
- Sheets that are simply scrolled out of view along the tab bar.
- Hidden rows and columns, filters, and cells far from the visible table.
- Pivot tables and their caches.
- External links and defined names.
- File size: larger than the data would explain?
Details and sources for each are in our Excel guide.
Word
- Tracked changes: decide whether to accept or reject, and by whom — see accept or reject?
- Hidden text, headers and footers.
- Editing-session identifiers (rsid) where the document's ancestry matters — see our rsid guide.
PowerPoint
- Speaker notes on every slide.
- Off-slide objects and hidden slides or shapes.
Sign-off
- A second person repeats or reviews the check and records that they did, against a specific file.
- Someone reads the visible content of the final file — every page, sheet and slide.
What a tool can take over
Steps 3 to 19 are a search through the file's parts. That is mechanical, and it is where people miss things, because most of what they look for does not appear on screen. It is the part worth automating.
ScrubDrop does it in the browser; the file is not uploaded. It lists everything it finds in those categories for free. It flags white or tiny text and cells outside the print area but does not remove them, because only a person can tell whether they matter. When you ask it to remove categories, it rebuilds the file from what is known to be needed, then re-reads the result with separate parsers (fflate, xmldom, SheetJS and docx-redline-js) and will not offer a file that fails. The free version removes properties, comments and tracked changes from one file at a time; ScrubDrop Pro adds the structural categories, several files at once, rejecting tracked changes or choosing per author, and an audit report.
For step 20, the audit report is the useful part. It records, for each file, the SHA-256 of the original and of the file written, what was found, what was removed, what the re-check looked at and found nothing of, and anything it could not check. A reviewer can sign against that report and confirm, by the hash, that the file being sent is the file that was checked.
What a tool cannot take over
- Step 21. ScrubDrop does not decide whether visible text is sensitive, and it does not read text inside images. A name in a visible cell is still a name.
- The format decision. If a CSV would do, a clean workbook is still more than the recipient needed.
- Files it refuses. Macro-enabled, binary (.xlsb, .doc), signed and encrypted files are refused rather than guessed at, and need a manual route. Text hidden through styles and fields split across paragraphs stop only the removal of that kind; the rest can still be cleaned.
- Certainty. The re-check is a strong signal, not a promise. The ICO's framing is "appropriate" checks proportionate to the risk; a tool is one layer of that, not a replacement for the reviewer.
Office's own Document Inspector on Windows covers many of steps 3 to 19 and is a reasonable first pass; if you use it, write down what it reported, for the reviewer. On the Mac, Microsoft says Word has no document inspector.
How to check this yourself
- Save a copy of the file for sending.
- On Windows, run File › Info › Check for Issues › Inspect Document (Microsoft's instructions) and note what it reports.
- Work through the Excel, Word or PowerPoint items above by hand, including the ones the inspector does not cover.
- Hand the file and your notes to a second person, who repeats the check and reads the visible content.
- Record who checked which file and when, in whatever log your procedure uses.
Questions
Is a second-person sign-off a legal requirement?
Strictly, it is a recommendation rather than a legal rule. The Hammersmith & Fulham reprimand states that its recommendations are not legally binding, but the Cabinet Office guidance expects every disclosure by spreadsheet to be "reviewed by two separate individuals before a response is sent".
Should I send a CSV instead of a workbook?
If the recipient needs figures, not a workbook, send CSV or a table in the letter. The article says the ICO, the Cabinet Office and the PSNI's own post-incident guidance all point this way.
What can a tool check, and what can't it?
A tool can search the file's parts, which the article calls the mechanical part, and ScrubDrop lists what it finds in the browser without uploading the file. Free: one file at a time; every kind of hidden data is listed, and properties, comments and tracked changes are removed. It does not decide whether visible text is sensitive and does not read text inside images, so a second person still reads the visible content of the final file.
Run the mechanical part of the check in your browser. Free: one file at a time; every kind of hidden data is listed, and properties, comments and tracked changes are removed. Check a file.