How to redact PII from Word, PDF and Excel files
The way most people “redact” a document doesn’t actually remove anything. A black box or a highlight only covers the text — it stays in the file, still selectable and copyable. This guide shows how to properly remove personal data (and the hidden metadata around it) from Word, PDF and Excel, and how to verify it worked before you share.
Why a black box (or highlight) is not redaction
When you draw a black rectangle over text, or highlight it black, you add a shape on top of the page. The words underneath are untouched — still in the document’s content stream, still selectable, searchable and copyable. The US Courts’ own redaction guidance lists black-out and cover tools among the “methods NOT to use,” warning that “the edits these tools make can still be removed by anyone to reveal the text underneath.” (Source: U.S. Court of Appeals, D.C. Circuit.) The NSA’s classic guidance makes the same point: visual concealment does not delete the content, which stays recoverable. (Source: NSA, “Redacting with Confidence”.)
The famous redaction failures
This keeps happening — to law firms, government agencies and courts. A short gallery:
| Case | What went wrong |
|---|---|
| Paul Manafort filing (2019) | Lawyers filed a federal response with black boxes over sealed text; reporters recovered it by copy-paste within minutes, exposing shared 2016 campaign polling data. |
| DOJ Epstein files (2025) | Blacked-out names were recovered by copy-pasting into Word because the words stayed in the PDF content stream; ~1% of redactions had to be re-fixed after release. |
| Maxwell deposition (2020) | Redacted names were reverse-engineered not by copy-paste but from an alphabetized word index left in the file — proof that verification must go beyond the copy-paste test. |
| Glyph-position study (2022) | University of Illinois researchers de-redacted hundreds of real PDFs across 11 tools: even with the text under the box deleted, sub-pixel glyph positions leaked the original names. |
The pattern is consistent: the visible box held, but the data lived on underneath — or in an index, or in the glyph positions. Covering isn’t removing. Occlira’s real PDF redaction is the direct fix for every failure above — it burns the boxes and deletes the underlying text and metadata, so nothing is left to recover.
The hidden data you can’t see
Even when you do delete the visible text, a file carries data beyond what’s on screen. Microsoft built the Document Inspector precisely to find and remove it. (Source: Microsoft.) What’s lurking differs by format:
Word (DOCX)
Tracked changes and revision history, comments, the author’s name and document properties, headers/footers, hidden text and custom XML. In 2003 a UK government dossier on Iraq was published as a Word file whose hidden revision log named the officials who had edited it — a textbook metadata leak.
Document metadata, layers, attachments, scripts and “hidden data from previous saves.” In Acrobat, redaction and sanitization are two separate steps: redaction removes the marked visible content, while a distinct “Remove Hidden Information / Sanitize” pass strips the rest. (Source: Adobe.)
Excel (XLSX)
Hidden rows, hidden columns that still contain data, hidden worksheets, cell comments — and the pivot cache, a hidden snapshot of a pivot table’s entire source dataset stored inside the workbook. That is exactly how the Police Service of Northern Ireland exposed the surname, rank and role of all 9,483 staff behind a pivot table in a published spreadsheet, drawing a £750,000 ICO fine. (Source: ICO.)
How to redact properly, format by format
- Word (DOCX). First run Microsoft’s Document Inspector (File → Info → Check for Issues) to remove tracked changes, comments, the author name and document properties. Then delete the sensitive text itself — don’t just highlight it black. Save, then inspect again to confirm nothing remains.
- PDF. Use a true redaction tool that deletes the underlying text objects, not one that draws a box over them. Then run a separate “sanitize” / remove-hidden-information pass to strip metadata, layers, attachments and data from previous saves — in Acrobat these are two distinct steps.
- Excel (XLSX). Delete the data — don’t just hide rows, columns or worksheets, which leaves it in the file. Clear or remove any pivot table’s source data (the pivot cache keeps a hidden copy), run Document Inspector, and export to CSV to surface anything still hiding behind charts or pivots.
The manual route works, but the multi-step, format-specific process invites oversights — miss the sanitize pass or the pivot cache and the data ships. That’s the gap a dedicated on-device tool closes.
How to verify a redaction actually worked
Before anything leaves your machine, run this check:
- Copy-paste test: select across the redaction and paste elsewhere — nothing should come out.
- Search test: Ctrl-F for the removed names or numbers — there should be no hits.
- Re-run Microsoft Document Inspector on the exported file — it should report zero findings.
- Check document properties, author, tracked changes and comments are gone.
- For spreadsheets, unhide every row, column and worksheet and export to CSV to confirm nothing hides behind a pivot table.
- Remember the copy-paste test alone is not enough — the Maxwell and glyph-position cases leaked through other structures, so confirm the underlying content is deleted, not covered.
What the rules require
Regulators now say visual redaction isn’t enough. The ICO’s 2025 guidance on disclosing documents lists the hidden data you must strip — metadata, tracked changes and comments, hidden rows/columns/worksheets and pivot data — and recommends the Document Inspector and converting files to CSV to expose it. (Source: ICO.) In US litigation, Rule 5.2 mandates redacting SSNs (last four), dates of birth (year only), minors’ names (initials) and financial-account numbers (last four) — and the clerk doesn’t check, so the filer carries the risk. For health data, the identifiers to remove are the ones in the 18 HIPAA list.
Redact Word, PDF and Excel with Occlira — on your device
Occlira does in one on-device pass what the manual workflows do in several. It detects and removes personal data across DOCX, PDF, XLSX, EML, TXT, MD and CSV on your own computer — nothing uploaded, no account. For PDFs it offers real redaction that burns the boxes and deletes the underlying text and metadata — irreversible when you need it, which is the direct answer to the copy-paste failures above — and it scrubs hidden metadata and tracked changes as it goes.
When you need to restore values later, use the reversible anonymization mode instead: it swaps identifiers for placeholders and keeps the mapping on your device. In GDPR terms that’s pseudonymization, so the result is still personal data — treat it as data minimization, not a way out of the rules (more in what is PII?). For very large spreadsheets, still run the manual pivot-cache and hidden-sheet cleanup above — Occlira handles the PII in the cells, not Excel’s internal structures.
Frequently asked questions
No. A black rectangle (or a black highlight) is just a visual overlay drawn on top of an intact text layer — the words are still in the file and stay selectable, searchable and copyable. The US Courts explicitly list black-out and cover tools among the methods NOT to use. True redaction removes the underlying content.
Because the redaction only hid the text visually while leaving it in the PDF’s content stream. Anyone can select over the box and paste the words elsewhere — exactly how reporters recovered the Manafort and Epstein passages. Proper redaction deletes the text objects, so there is nothing left to copy.
Tracked changes and revision history, comments, the author’s name and other document properties, headers and footers, hidden text and custom XML. Microsoft built the Document Inspector specifically to find and remove these — famously, a 2003 UK dossier’s hidden Word revision log named the officials who had edited it.
It’s a built-in Office tool (File → Info → Check for Issues → Inspect Document) that removes hidden and personal data: comments and revision marks, document properties including the username, headers/footers, hidden text and custom XML — and in Excel, hidden rows, hidden columns that contain data, and hidden worksheets.
Often, yes. A pivot table saves a hidden snapshot of its entire source dataset — the “pivot cache” — inside the workbook, so the rows can be regenerated even after the source sheet is gone. It’s how the PSNI spreadsheet breach exposed the details of all 9,483 staff. Clear the pivot cache and export to CSV to be sure.
Redaction permanently removes the specific text or images you mark. Sanitizing (Remove Hidden Information) is a separate step that strips metadata, comments, attachments, hidden layers, scripts and data from previous saves. You usually need both — redaction alone leaves the hidden data behind.
Run the copy-paste test, search for the removed terms, re-run Document Inspector on the final file, check the author/properties/tracked-changes are gone, and for spreadsheets unhide everything and export to CSV. Don’t rely on the copy-paste test alone — some leaks come through indexes and glyph positions, so confirm the content is deleted, not covered.
Under Federal Rule of Civil Procedure 5.2, filers must redact Social Security and taxpayer-ID numbers (last four only), dates of birth (year only), minors’ names (initials only) and financial-account numbers (last four only). The clerk does not check — the responsibility is on the filer.
It depends on the mode. Real PDF redaction burns the boxes and deletes the underlying text and metadata — that is irreversible by design, which is the point. If you need to restore values later, use the reversible anonymization mode instead, which swaps identifiers for placeholders and keeps the mapping on your device (that is pseudonymization, so the output is still personal data).
Redact your files locally
Remove personal data and hidden metadata from Word, PDF and Excel, on your own computer. Free for 14 days on Windows and macOS.
More: for law firms · for accountants · remove personal data from audio · how your data is handled