Hidden data in your documents: metadata, comments and tracked changes

Besides the words you see, a document can carry its author's name, old comments, tracked changes, hidden text, attached files and, for photos, the GPS position where they were taken. Built-in tools remove most of it: the Document Inspector in Word, Sanitize document in Acrobat Pro and the location switch on your phone. Then export a flattened copy and read it yourself.

Take Jane Example, an HR manager. She sends a contract that looks clean. The recipient opens it in Word and sees a comment in the margin: check her salary with legal. The file's properties name the colleague who wrote the first draft. None of this was on the printed page.

What hidden data can a document carry?

The UK data protection authority, the ICO, describes metadata as data about data: document properties such as author and title, and EXIF data in photos, which can include GPS coordinates and device details. Its guidance of 31 July 2025 warns that you may disclose metadata by accident. And metadata is only one layer.

• Document properties: author, title, the last person who saved, dates.
• Comments: margin notes that may mention people or decisions.
• Tracked changes: added or deleted text, kept as revision marks.
• Hidden text: formatted as hidden, or typed in white on a white page.
• Embedded objects: a chart or spreadsheet inserted with its data.
• PDF extras: attached files, hidden layers, scripts, stored form data.
• Photo data: EXIF details such as the device and the GPS position.

How do you remove hidden data from a Word document?

Handle tracked changes and comments first, then let the Document Inspector sweep the rest. These steps follow Microsoft's help for Word for Windows, as of September 2026.

1. Work on a copy. Microsoft warns that removed data cannot always be restored, even with Undo.
2. On the Review tab, choose Accept All Changes or Reject All Changes.
3. On the same tab, open the Delete menu and choose Delete all Comments in Document.
4. Go to File, Info, Check for Issues, Inspect Document, then select Inspect.
5. Select Remove All next to each unwanted result, then inspect again.
6. Find white text with Find and Replace, searching by font colour, as the ICO suggests.

The Inspector checks comments and revisions, document properties, headers and footers, hidden text, custom XML data and invisible content. Microsoft names its blind spots: it cannot detect white text on a white background, or objects covered by other objects. So the ICO adds a simple rule: check the document yourself, even after using a tool.

What can a PDF hide, and how do you clean it?

A PDF has its own metadata. Adobe lists the author's name, the title, the creation date, keywords and sometimes the software used. A PDF can also hold attached files, hidden layers, comments, scripts and stored form data. A black box on the page removes none of this: Adobe warns that comments, hidden layers and revision history can leak even when the page is blacked out.

In Acrobat Pro, open All tools, Redact a PDF, then Sanitize document. Adobe says this is available only in Acrobat Pro, Premium or Studio. Its metadata guide shows a lighter route: edit or delete the fields in Document Properties, then save. Deleting metadata cannot be undone.

How do photos and scans reveal where they were taken?

A phone photo of a paper document has metadata too. Apple explains that when Location Services is on for the Camera app, the coordinates are embedded into each photo, and the people you share it with may be able to read them. If Sam Example photographs a sick note at his kitchen table, the picture can point to his home.

On an iPhone, tap Share, then Options, and turn off Location before sending. For a photo already taken, Apple's steps are Adjust Location, then No Location. Then look at the picture itself: an address on an envelope in the background is visible data, and no metadata tool removes it.

Where does each hidden element live, and how do you remove it?

Does a flattened image-PDF remove all hidden data?

A flattened image-PDF is made of pictures of your pages. What was not drawn does not come along: the text layer, attachments, hidden layers, form data, comments not on screen. A plain Save as PDF from Word is different: the ICO says it can remove some metadata and hidden information, but is not a fully secure redaction method on its own. Its suggestion is a round trip: convert the PDF to a simple image format such as BMP, then back to PDF.

Flattening has limits. A picture keeps everything that was visible: comment balloons shown in the margin at export, headers, footers, signatures. The new file also gets properties of its own, such as a date and the software that made it. ONYRI Sanitize always exports this kind of flattened PDF or PNG, but it keeps your file name as the base of the new one. Rename it.

The biggest limit is judgement. Flattening does not decide what identifies someone. A job title, a small town and a date can point to one person without any name. Read the flattened copy page by page before it leaves.

What should you check before you send a document?

1. Work on a copy; keep the original unchanged.
2. Accept or reject all changes, then delete all comments.
3. Run the Document Inspector in Word, or Sanitize document in Acrobat Pro.
4. Remove the location from photos and phone scans.
5. Export a flattened PDF, open it and read every page.
6. Rename the file and check the email subject.

The tools catch what is hidden inside the file. You catch what is visible but should not be there.

Frequently asked questions

Sources & references