Audit a document for identifiers before you share it

Reviewing a document by reading it catches what is rendered. A PDF contains a good deal that is never rendered, and that is consistently where accidental disclosure comes from.

What lives in a file but not on the page

The privacy risk scanner parses the document structure rather than looking at pictures of pages. The categories it surfaces are the ones that cause real incidents:

• Document metadata. Author, creator application, producer, title, subject, keywords, and creation and modification timestamps. The author field is frequently a real name; the producer field frequently names internal software; the title is often the original template name.
• Text under images. A scanned page pasted over an original text layer keeps that text fully selectable underneath.
• Content outside the crop box. Cropping hides; it does not delete. Text beyond the visible boundary is still in the content stream.
• Annotation content. Comments, review notes, and sticky notes may be hidden in your reader while remaining in the file, and internal review comments are often the most sensitive text in a document.
• Form field values. A field can hold a value that differs from what is displayed, and hidden fields are still fields.
• Embedded attachments. PDFs can carry other files inside them, including the spreadsheet a chart was built from.
• Incremental revision history. A PDF edited by appending retains earlier revisions physically in the bytes, so a previous version of a "corrected" paragraph can still be present.
• Bookmark and destination labels. Outline entries can name sections that were later removed.

Alongside those structural risks, the scan flags visible identifiers on the page: names, email addresses, phone numbers, account numbers, government identifiers, and dates of birth.

Scan the output, not just the input

The habit worth building is running the scan after you have finished editing, not before.

The reason is that most editing operations touch page content and leave everything else alone. Redacting a page does not clear the document title. Deleting pages does not remove document metadata or the bookmarks that pointed at them. Flattening merges the visible layer and leaves the author field exactly as it was. Cropping hides content it never deleted.

So the sequence is: edit, then scan the result, then fix what the scan reports, then release. Scanning only the original tells you what you started with, which is much less useful than knowing what you are about to send.

Acting on findings

Findings are candidates for review, not instructions. The scan cannot know that a phone number is the recipient's own, that an account reference is meant to be there, or that a name belongs on the document.

A workable triage:

1. Metadata — usually strip it wholesale for anything going outside your organisation. There is rarely a reason to publish your template's internal title and your colleague's username.
2. Annotations and review comments — remove them unless they are the point of the document.
3. Hidden text and out-of-crop content — decide whether the concealment was intended. If it was, the content needs removing rather than hiding, with the redaction tool and the verification steps in the redaction guide.
4. Attachments — check what each one is. People are frequently surprised.
5. Visible identifiers — for structured, repeated data such as account or national identifiers, the automatic identifier tool will locate candidates across the document, which is far more reliable than reading 200 pages by eye. Approve each one; do not let detection be the decision.

When this is worth doing

Not every document justifies a scan. A public brochure does not. Build the habit around a specific list instead:

• Anything published on a website or sent to a mailing list.
• Anything provided in response to a legal, regulatory, or freedom-of-information request.
• Anything containing customer, patient, employee, or student data — where the GDPR and HIPAA guide sets out why the standard is demonstrable rather than intended removal.
• Anything derived from an internal template, which is where metadata leaks concentrate.
• Anything you are about to send to a counterparty or a journalist.

The scan takes seconds. Reading it takes a minute. That is a small price against the alternative, which is discovering the problem after the document is irretrievably public. The metadata walkthrough covers what individual fields typically reveal and why they are worth clearing by default.