Tools

File self-check

Work down the list on a copy of the file, in the software you already have. A single hit means the disclosure carried personal data you meant to remove.

Work on a copy. Several of the checks below involve turning on markup or unhiding parts of a file, and none of them should be done on the artifact you released or on the original you are keeping.

The ticks live in this page while it is open and nowhere else. Nothing is saved, nothing is sent, and reloading the page clears them. Print the list if you need to keep it.

The checks

Checked 0 of 7

1Select across the mark and paste it somewhere plainDrag-select the area the box covers, copy, and paste into a plain text editor. Anything that appears was never removed from the file.
2Search the document for a name you redactedUse the reader's own find. A search hit that lands on a blacked-out area is the same finding as the paste above, and it is faster over a long document.
3Read the document propertiesAuthor, title, subject and any custom properties survive an edit to the visible body. Open the properties panel and read what is actually in them.
4Look for earlier revisions of the pageA PDF that has been edited and saved holds the state it was in before the edit. If the file grew rather than shrank when you redacted it, that is what grew.
5Open everything the file carries with itAttachments, embedded charts and linked spreadsheets carry their own source data. Extract them and check each one the same way as the parent.
6For DOCX and XLSX, check revisions, comments and hidden sheetsTurn on all markup and read the tracked changes and the comment threads. In a workbook, unhide every sheet, row and column before you decide it is clean.
7For an email, read the part you were not looking atA message carries plain text and HTML. Open the source and read both. Redacting the rendered version leaves the other one intact.

If any check produced a hit

If any step produced a hit, treat the disclosure as having released personal data belonging to someone other than the requester, and follow your own breach assessment process. The file you sent is the file they hold.

These are the checks from the guide Does redacting a PDF remove the text?, imported from it rather than restated, so the two lists cannot differ.