ScrubDrop › Guides

Hidden data in CVs, interview scorecards and offer letters: a check for HR and recruiting

Last updated: 19 October 2026

The pre-send checklist by role has a short HR section; this page goes file by file, and adds the files you receive. The ICO's page on personal information 'hidden' in documents names the places: metadata, such as document properties, and markup, such as "comments, ink annotations and tracked changes". The examples below are typical cases, not reports of real ones.

At a glance

CVs and cover letters

Before you forward one, to a hiring manager, a client or another agency:

1. Delete your own comments, or move them to a separate note. A comment such as "salary expectation too high" travels with the file.
2. If you removed the candidate's contact details, check how. With tracked changes on, the deleted phone number and address stay in the file as a deletion until the change is accepted. Accept every change, and see accepting or rejecting tracked changes.
3. Check the properties: a CV reformatted on an agency's template can carry the agency's staff name as author or last saved by, and the template's title or company (the author's name in Word).
4. Check photographs in the CV for location and camera details.

After you receive one: the properties, comments and tracked changes can hold information the candidate did not mean to share. They can name a previous employer's template, a careers adviser who edited it, or the dates it was written. Whether to keep the original is your organisation's decision; if the file is passed on or kept, a copy without the properties and comments, with the tracked changes resolved, carries less. Accepting or rejecting a change decides which text stays, so read the result. The guide to Office metadata and data minimisation sets out the principle.

Interview scorecards and assessment workbooks

A panel often keeps every candidate in one workbook, and the file sent to one candidate, or to a hiring manager for one role, is a copy of it.

1. Do not hide or filter the other candidates out: hidden rows, filtered rows and hidden sheets are still in the file. The ICO's page on personal information hidden in spreadsheets covers these places.
2. Look for very hidden sheets, which the Unhide command does not list (finding hidden data in Excel).
3. Check pivot tables: a pivot cache can keep every candidate's record after the source sheet is gone.
4. Delete panel members' comments and notes, or decide deliberately which ones the candidate should see.
5. For one candidate's feedback, copy their cells as values into a new workbook or document, and send that instead of a trimmed copy of the shared one.

Offer letters and contracts

Offers are usually made from the previous one, from a template, or by mail merge, and each route can leave something behind.

1. Check the properties: the title, subject or custom properties of a letter saved over the previous one can still name the previous candidate or role.
2. Accept or reject every tracked change before the letter goes out. An offer revised during negotiation can keep the earlier salary as deleted text, with the name of whoever changed it.
3. A template or an HR system can store values in document variables or custom XML parts, out of sight (custom XML and embedded objects in Word).
4. With mail merge, do not send the main document: its settings keep the path of the data source, often a spreadsheet of every offer. Save the letter for this candidate as a document of its own, and check that copy for mail merge settings and links before it goes out.
5. Look for embedded objects, such as a salary table pasted in as a workbook, which carry the whole workbook.

When the signed copy comes back, look at it with markup shown before you accept it: changes the candidate made with tracking on are visible there, but text changed with tracking off is not marked, so compare it with what you sent (in Word, Review › Compare).

References

A reference written in Word can keep earlier drafts in tracked changes and colleagues' comments on them. Before it goes out, accept or reject every change and delete the comments. A reference received from someone else can carry the same, about them and their colleagues.

Before you send: the steps

1. Make a copy for sending, and do the cleaning on that copy.
2. On Windows, run Document Inspector (File › Info › Check for Issues › Inspect Document). Microsoft's Document Inspector page lists what it finds, and in Excel what it finds but can't remove.
3. Accept or reject every tracked change and delete the comments.
4. For a spreadsheet, send only the cells the recipient needs, copied as values into a new workbook.
5. Read the final file: every page, sheet and comment the recipient will see. Rename it if the file name says more than they should know.

After you receive: the steps

1. Open the file with markup shown, and read the comments and tracked changes.
2. Compare a returned contract or offer with the version you sent.
3. Decide what you keep. If a copy goes to a hiring manager or into a record, consider a copy without the properties and comments, with the tracked changes resolved, and read it.

What ScrubDrop does

ScrubDrop reads .docx, .xlsx and .pptx files in your browser; the file is not uploaded, which matters when the file is about a candidate. It lists the properties, comments, tracked changes, hidden sheets, rows and columns, pivot caches, document variables, custom XML, embedded objects, links to other files and picture metadata it finds, for free. The free version removes properties and comments and accepts tracked changes, one file at a time. ScrubDrop Pro removes the other kinds, lets you accept or reject tracked changes author by author, cleans several files at once, such as a batch of CVs, and writes an audit report. White or tiny text and cells outside the print area are listed for you to check, not removed. The result is read again by software separate from the one that wrote it, and a file that does not pass is not offered. ScrubDrop does not judge what is written on the page or whether the recipient should see it.

Questions

Sources: the ICO and Microsoft pages linked on this page were checked on 19 October 2026.