A Word, Excel or PDF file holds more than the page you see: the author's name, comments, tracked changes, hidden rows and sheets, and document properties travel with it. Microsoft and Adobe both provide tools that find and remove this content. This guide lists what each format hides and the steps that clear it.
What hidden data and metadata are
Metadata is data about the document. In Microsoft 365, document properties include author, subject and title, the name of the person who most recently saved the file and the date it was created. Other items sit in the file without being visible: comments, revision marks from tracked changes, earlier versions, headers and footers, watermarks, text formatted as hidden and custom XML data. Adobe lists metadata, comments, hidden layers and other sensitive content as what a PDF may carry.
Microsoft notes that comments and revision marks can show other people the names of those who worked on a document, the comments of reviewers and the changes made. Any of these items can name a person. The GDPR defines personal data as information relating to an identifiable person, identified directly or indirectly, so an author name or a reviewer's comment is personal data even when the page itself shows nothing. Article 5(1)(c) asks that the data shared be limited to what is necessary for the purpose.
Where each format hides it
The table summarises what Microsoft and Adobe document for each format and the tool each provides.
| Format | What can hide in the file | Vendor tool |
|---|---|---|
| Word | Properties, comments, revisions and versions, ink annotations, headers, footers, watermarks, hidden text, custom XML, invisible objects | Document Inspector: File, Info, Check for Issues, Inspect Document |
| Excel | The same document items, and hidden rows, hidden columns, hidden worksheets, external links, embedded files, macros, cached data of pivot tables, filters, hidden names | Document Inspector, with items it finds but cannot remove |
| Metadata, comments, hidden layers and other hidden content | Acrobat Pro: All tools, Redact a PDF, Sanitize document |
How to clear a file step by step
- Save a copy of the file and work on the copy, because removed data may not be restorable.
- In Word or Excel open File, then Info, then Check for Issues, then Inspect Document. Choose the types of hidden content to inspect and select Inspect. The inspector has separate checks for comments and revisions, document properties and personal information, headers and footers, hidden text, custom XML data and invisible content, so leave none of them unticked.
- Read the results. In Excel, Microsoft warns that removing hidden rows, columns or worksheets that hold data can change the results of calculations, so unhide them and review what they contain first.
- Select Remove All next to the types you want gone, then Reinspect to confirm.
- Handle by hand the items the inspector finds but does not remove in Excel: external links, embedded files and objects, macros, cached data of pivot tables, filters and hidden names. Replace an object that holds hidden data with a static picture, as Microsoft suggests.
- For a PDF, open Acrobat Pro and choose All tools, then Redact a PDF, then Sanitize document. Select Remove all, or Selectively remove and tick the items in the Hidden Information panel, and save the file, which makes the removal permanent.
- Open the file you will send and look at its properties. Rename the file if the name itself carries a client or a person.
In 2005 the National Security Agency wrote that converting a Word document to PDF does not remove all metadata, and that the hidden information is often as sensitive as the document itself.
What the inspector does not find
Microsoft documents the limits of its own tool. In Word the inspector cannot detect text hidden by other methods, such as white text on a white background, and it cannot detect objects that are covered by other objects. In Excel it does not detect shapes, charts, controls, pictures and SmartArt located in hidden columns. A workbook saved as a shared workbook blocks the removal of comments, annotations and document properties until you copy it and turn sharing off. For files saved in the OpenDocument formats, Microsoft says the inspector must run every time the file is saved in that format.
These limits explain why the last step of the list exists. After cleaning, read the page as the recipient would, select all text to see whether a white or covered passage appears, and check the properties again.
What goes wrong with metadata
The 2005 NSA report names three common mistakes that lead to most unintentional exposure: covering text with black rectangles, covering parts of an image, and leaving metadata and document properties in the file. It says the hidden information is often as sensitive as the original content and that its presence in sanitised documents has historically led to compromise. It also warns that relying on the metadata-removal tools of the time could give a false sense of security. The document is from 2005 and its tools are old, and its principle still holds: clean the file, then check it.
A second failure is visible redaction without hidden-content cleaning. Adobe's redaction steps end with a dialog where a toggle decides whether the document is also sanitised and the hidden information removed. Skipping the toggle leaves the hidden content for the separate sanitize function to remove, so check that it ran.
Excel adds its own trap. Microsoft says that when you distribute a copy of a workbook with hidden rows, columns or worksheets, other people might unhide them to view the data they contain. A sheet hidden to keep a view tidy is therefore a disclosure risk when the workbook leaves the building.
How Redactic removes metadata from the file it produces
Redactic removes Word metadata such as author, company, comments and tracked changes, PDF properties and image EXIF data from the output file, and it masks the personal data inside the document body in the same pass. You can upload a PDF, a Word file, an Excel or CSV file, a scan or a ZIP of up to 200 files, and open Review and edit to check the result. The AI-safe documents page shows the flow, and the free trial takes your own document. Documents are never stored and never used to train AI models. For the page-level side of redaction, read what a payslip contains and what to mask and the data redaction guide for GDPR and AI.
Frequently asked questions
Does saving a Word file as a PDF remove its metadata?
Not automatically. A National Security Agency report of 2005 states that converting a Word document to PDF does not remove all metadata, and it lists metadata and document properties among the three common causes of unintended exposure. Check the properties of the PDF you produce, and use the Acrobat sanitize function described above.
Can I undo what the Document Inspector removes?
Not always. Microsoft recommends running the Document Inspector on a copy of the document, because removed data may not be restorable and Undo may not bring it back. Save a copy first and send the cleaned copy.
Does the Document Inspector find everything?
No. Microsoft states that it cannot detect text hidden by other methods, such as white text on a white background, or objects covered by other objects, and that in Excel it does not detect shapes, charts, controls and pictures located in hidden columns. It also finds but does not remove items such as external links, embedded objects, macros, cached pivot table data, filters and hidden names.
Does Redactic remove metadata?
Yes, from the file it produces: Word metadata such as author, company, comments and tracked changes, PDF properties and image EXIF data are removed. For other hidden content in your own files, such as the hidden sheets of a workbook, use the Document Inspector steps above. The AI-safe documents page describes the full flow.
Sources
- Microsoft Support, Remove hidden data and personal information by inspecting documents, presentations, or workbooks, accessed 2026-11-09.
- Adobe, Sanitize PDFs and remove hidden content in Acrobat Pro, accessed 2026-11-09.
- Adobe, Redact sensitive content in PDFs in Acrobat Pro, accessed 2026-11-09.
- National Security Agency, Redacting with Confidence, report I333-015R-2005, 13 December 2005, accessed 2026-11-09.
- Regulation (EU) 2016/679 (GDPR), Articles 4(1) and 5(1)(c), accessed 2026-11-09.