Privacy finding
A published document carries personal data, tracked changes or hidden content
Privacy Warning Severity: High
Part of the audit Personal data in documents. Finding id: privacy.personalDataInDocuments.
What it costs you
A downloaded document keeps what the page does not show: earlier wording, deleted names, comments, hidden sheets and who wrote it. Once it is downloaded you cannot take it back.
What to do
Clean the file and publish it again: accept or reject all changes, delete comments, remove hidden content and metadata, then export a fresh copy.
What it checks
- Personal data found in documents
- Author and edit history in file details
- Tracked changes and comments left in
- Hidden sheets or slides
How to fix it
Remove the value and replace the file
- Open the file and find the value ([masked value]).
- If it is real personal data, take the file offline first.
- Remove the value in the original, export a new file and publish that one.
- Check with your data protection officer whether the publication has to be recorded or reported.
How to check: Download the published file and search it for the value. Then run this rule again.
Clean the document before it goes online
- Open the original in the program that made it.
- Accept or reject every tracked change and delete all comments.
- Delete hidden sheets, slides and text, or decide they may be public and unhide them.
- Remove author and revision metadata with the program's own document inspection or metadata removal function.
- Export a new file and replace the old one at the same URL.
How to check: Download the published file, open it and look for changes, comments and hidden parts. Then run this rule again.
A real case
A spreadsheet the Police Service of Northern Ireland published in answer to a freedom of information request had a hidden tab listing all 9,483 officers and staff. The UK data protection regulator fined it 750,000 pounds in October 2024.