ScrubDrop › Guides

Before you send an Office file to a client: what to take out, by role

Last updated: 17 October 2026

This page is the short version by role. The general list, with where each item comes from, is the pre-send checklist for Office files; each item there has its own guide.

The UK regulator puts the starting point plainly. The ICO's page How do we avoid an accidental breach when personal information is 'hidden' in documents? names metadata, such as document properties, and markup, such as "comments, ink annotations and tracked changes", as places where personal information can sit unnoticed. It is written for documents disclosed to the public, but the same places are in a file sent to one client.

At a glance

Finance and accounts

A workbook sent to a client is often a copy of the working file, and the working file keeps what was used to reach the figures.

1. Decide whether the client needs a workbook at all. If they need only some figures, copy just those cells as values into a new workbook, and save that as CSV if CSV is what they need. A CSV saved straight from the working sheet keeps the values in its hidden rows and columns, so open the result and check it.
2. Unhide every sheet, row and column, and look for very hidden sheets, which the Unhide command does not list (finding hidden data in Excel).
3. Check pivot tables: a pivot cache can keep the source records even after the source sheet is gone.
4. Find links to other workbooks and their paths, and the defined names that point at them (full paths in Excel). In Excel, breaking a link turns the formulas that used it into values.
5. Delete comments and notes that hold internal queries.

The ICO's page on personal information hidden in spreadsheets covers the same places in more detail.

HR and recruitment

An HR file sent outside is often about one person but made from material about many, and the template it came from was used for others before.

1. For a letter or contract, check the properties (author, company, custom properties) and the headers and footers of the template it came from.
2. Accept or reject every tracked change and delete every comment: remarks about a candidate or an employee are personal information about them. See accepting or rejecting tracked changes.
3. For a spreadsheet, send only the rows and columns the recipient needs. A hidden column of salaries or dates of birth is still in the file; copy the needed cells as values into a new workbook instead of hiding the rest.
4. Check pictures, such as a scanned form or a photograph, for location and camera details.

Legal

A draft that has been negotiated carries the history of the negotiation unless it is taken out.

1. Decide what the other side should see. Tracked changes can show each change with its author and when it was made; if they are meant to see a clean draft, accept or reject them all, and if they are meant to see a comparison, send it as a separate document.
2. Delete internal comments and the replies to them. A resolved comment is still in the file (removing comments, ink and annotations).
3. Check the properties and the attached template: the template's path can name a server, a department or another matter.
4. Look for embedded files, such as a workbook pasted in as an object, which carry their own content and metadata.
5. If you send a PDF, choose the export options with care: in Word, publishing the document showing markup puts the changes into the PDF (Office metadata when you export to PDF).

Freelance and agency work

Work for one client is often built from work for another, and the earlier job leaves traces.

1. Check the properties and custom properties: title, subject, company and tags can still name the earlier client.
2. In a deck, read the speaker notes and look for hidden slides and objects placed off the slide (speaker notes and hidden slides).
3. Search the file for the earlier client's name, in the body, headers and footers, notes and comments.
4. Check links and paths: a link to a file on your own computer can show your user name and folder names.
5. Check photographs for location and camera details before you insert them, or clean the file afterwards.

For every role, last

1. Make a copy for sending, and do the cleaning on that copy.
2. On Windows, Document Inspector (File › Info › Check for Issues › Inspect Document) covers many of the places above; Microsoft's Document Inspector page lists what it finds and what it finds but can't remove.
3. Read the visible content of the final file, every page, sheet and slide. No tool decides whether what is visible should go to this client.
4. Rename the file if its name says more than the client should see.

What ScrubDrop does

ScrubDrop reads .docx, .xlsx and .pptx files in your browser; the file is not uploaded. It lists every kind of hidden data on this page that it finds, for free: properties, comments, tracked changes, hidden sheets and content, pivot caches, links to other files, defined names, speaker notes, off-slide objects, embedded files and picture metadata. The free version removes properties and comments and accepts tracked changes, one file at a time. ScrubDrop Pro removes the other kinds, lets you accept or reject tracked changes author by author, cleans several files at once, and writes an audit report. The result is read again by software separate from the one that wrote it, and a file that does not pass is not offered. White or tiny text and cells outside the print area are listed for you to check, not removed, and ScrubDrop does not judge what is written on the page.

Questions

Sources: the ICO and Microsoft pages linked on this page were checked on 17 October 2026.