A spreadsheet can look clean and still hold hidden sheets, hidden rows, filters, summary tables with their source data behind them, and the author's name. This guide lists where to look, what does not work, and a way to make a release copy you can check.
Someone has asked your office for a spreadsheet, or you plan to publish one. The table on your screen holds counts by area, and nothing in it names anyone. You send it. The recipient clicks on a tab you did not know was there, and the names of the people behind the counts are on it.
The UK data protection regulator publishes guidance on this problem. This guide covers the same ground in a shorter form, for the person who makes the release copy. It lists the places where personal details stay in a workbook, says what does not work to hide them, and describes a way to build a copy you can check. The official guidance used here is British. The checks apply to any spreadsheet that leaves your organization, and the rules on what you may release differ from country to country.
Key terms
- Release copy
- the version of a file that you send or publish. You make it from the original, and the original stays as it was.
- Hidden row, column or worksheet
- a part of a workbook that stays in the file but does not show on screen until someone unhides it.
- Summary table (pivot table)
- a table in Excel that adds up a larger table, for example the number of complaints in each ward.
- Stored copy (cache)
- a copy of data that a feature keeps inside the file so that it can keep working. A summary table can keep a stored copy of the rows it adds up.
- Document properties (metadata)
- details that Excel stores about the file itself, such as the author's name and the time of the last save.
- Simpler format
- a plain file type such as CSV, which holds only the values of the cells in one sheet.
- Freedom of information request
- a request that a public body release information it holds. Laws such as the UK's Freedom of Information Act 2000 give people this right.
Why can a spreadsheet hold more than you can see?
A workbook is a package, and the sheet on your screen is only one part of it. Hiding something changes what you see, not what the file holds, and everything in the package travels with the file when you send it. The guide to hidden data in Excel files explains what a workbook can hold and how to look inside one. This guide is about one task: making the copy you release.
Which parts of a workbook can still hold personal details?
| Part of the workbook | What it can hold | How to check |
|---|---|---|
| Hidden rows, columns and worksheets | Any data, including whole lists of people | Unhide everything, and look at every sheet tab |
| Cells far from the table | Data placed far down or far to the right of what you see | Go to the last used cell of each sheet (in Excel for Windows, press Ctrl+End), and scroll through the sheet |
| Active filters | Rows that the filter keeps out of view; some advanced filters (slicers and timelines) also keep a stored copy | Clear every filter, and look again |
| Summary tables and charts built from them | A link to the source data, which can stay after you copy the table to a new workbook, delete the sheet that held the source, or remove columns and rows from the summary. Also a stored copy of the data | Find every summary table and chart, and replace each one with plain values |
| Links to other workbooks | A stored copy of the linked data, and the names of the files and sheets | Run the Document Inspector (described below), and remove the links or replace them with values |
| Imported data (data models) | The imported tables become part of the file, and a recipient can view them without the original source | Run the Document Inspector, and remove the data model |
| Comments | Reviewers' names and remarks | Read every comment, or run the Document Inspector |
| Document properties | The author's name, the name of the last person to save the file, the file's location and printer details | Run the Document Inspector, or open the file's information page |
| Headers and footers | Names, titles and notes | Run the Document Inspector |
| Free-text columns | Names, phone numbers and stories written into sentences | Read the longest entries |
What do people try that does not work?
The regulator lists three techniques that people use to protect personal details in a spreadsheet, and says none of them is effective.
- Hiding rows, columns or worksheets. The data stays in the file, and a recipient can unhide it.
- Moving the data far away. Putting it in remote rows or columns means that it is out of sight. It is still in the file. The Document Inspector in Excel does not find data that has been moved this way.
- A password that only stops editing. It does not stop anyone from opening the file. Only a strong file-level password prevents access.
Deleting the sheet that holds the source data does not work for a summary table, and nor does removing columns or rows from the summary. The table stays linked to its source.
How do you make a release copy that you can check?
The copy with the fewest parts is the easiest to check. Always work on a copy, and keep the original untouched. There are two routes.
Route 1: save each sheet as a CSV file. A CSV file is plain text. It holds the values of the cells in one sheet and nothing else, so hidden sheets, summary tables, stored copies, links, comments and document properties cannot be inside it. GOV.UK suggests this as a way to be certain: saving a sheet as CSV exports all the information in that sheet, including hidden rows and columns. You can then import the CSV into a new spreadsheet to confirm that no hidden data is left.
Three points to remember with this route:
- A CSV holds one sheet. Save each sheet you mean to release, one by one.
- Saving as CSV shows you what was hidden. It does not remove it. Read the result, and delete any personal details that you find.
- Macros do not come across to CSV. If the recipient needs the macros, this route does not suit.
The regulator also suggests checking the size of the file. A file that is much larger than the data you meant to send may hold something you did not intend.
Route 2: run the Document Inspector on a copy of the workbook. Use this route when the recipient needs a workbook. In Excel, save a copy with a new name. In the copy, choose File, then Info, then Check for Issues, then Inspect Document. Microsoft says to use the inspector on a copy, because removed data may not come back, even with Undo.
The inspector finds and removes comments, document properties and personal information, headers and footers, hidden rows and columns that contain data, hidden worksheets, custom XML data and invisible objects. It finds the following items but does not remove them, so you must deal with each one yourself. They are links to other workbooks, embedded files and objects, macros, stored copies behind summary tables, slicers and similar features, active filters, saved scenarios, Excel surveys and hidden names.
Four limits to know:
- It does not detect objects that are covered by other objects.
- It does not detect data that someone has moved into remote rows or columns.
- Hidden rows or columns that belong to a summary table are unhidden and not removed.
- Removing hidden rows, columns or sheets that contain data can change the results of formulas. If you do not know what they hold, unhide them and read them first.
A workbook that was saved as a shared workbook cannot have its comments, annotations, document properties and personal information removed until you copy it and turn off sharing.
What does this look like with an invented example?
A council officer receives a freedom of information request for the number of noise complaints in each ward in 2026. The officer has a workbook called "Noise complaints by ward, 2026". On screen it shows six rows: a ward name and a number of complaints.
| Where | What the recipient finds |
|---|---|
| A hidden sheet called "Source" | 412 rows with the complainant's name, address, telephone number and a description in their own words |
| The summary table on the first sheet | A link to the Source sheet, and a stored copy of its rows, even after the sheet is deleted |
| A hidden column on a second sheet | A "Complainant" column |
| A comment on one cell | "Repeat caller at 14 Mill Lane" |
| Document properties | The officer's name and department |
The officer makes a release copy by route 1. Each wanted sheet is saved as a CSV. The officer opens it and sees six rows: six wards and six counts. The file is a few hundred characters in size, which fits what was meant to be sent. Nothing else is in it, so nothing else can reach the recipient. The workbook is invented.
What do these checks not cover?
- Details in the visible cells. Saving as CSV removes the hidden parts of a workbook. It does not remove a name that is in a cell you can see.
- Free text. A comments column can hold names and numbers inside sentences. Read the longest entries.
- Small counts. A ward with one complaint may point to one household. The guide why removing names is not enough shows how to count how many people share each combination of values.
- What the tools miss. The inspector does not find everything. A second person who reads the release copy before it goes out is a good check, and GOV.UK recommends one.
- Whether you may release the file at all. That is a decision for the person in your organization who answers for information requests and data protection.
How can DataAttendant help?
DataAttendant is a tool that runs in your web browser, on your own computer. You open a CSV or Excel file, and it looks for personal details by the values in a column and by its heading. It proposes a treatment for each column it marks, and you decide every treatment. It shows a preview and a list of what remains before you download the protected copy.
In an Excel file, it reads every worksheet, including hidden ones, and marks the hidden ones. The values it changes are changed in hidden sheets, rows and columns too, and those stay hidden in the copy. Unless you choose to keep the document properties, the protected copy carries no author, last editor or save times. It then also takes the author's name out of headers, footers and the names of comment authors. It shows the comments of each sheet as a column you can change, and warns you when a comment looks like it holds a name. Other text in headers and footers stays as it is, and the review asks you to check that it names no one.
Some parts of a workbook cannot be examined value by value, such as the stored copy behind a summary table, a data model and links to other workbooks. DataAttendant lists them on the step before you download, and says what each one can hold. A data model and the other parts it cannot read are left out of the copy unless you choose to keep them. Links to other workbooks are removed unless you keep them. A summary table stops the copy until you choose to keep it, and DataAttendant then refuses the copy if the stored copy behind it still holds a value it replaced in the cells. If you choose to keep a part it cannot read, such as a data model, the part goes into the copy unchanged and may still hold the original details. The screen says so before you download. To release such a workbook, replace its summary tables with plain values and remove its data model in Excel first, as this guide describes.
DataAttendant does not replace the steps in this guide, and it does not decide whether a file may be released. A sensible use comes at the end of the process: after you have made the values-only copy, open it in DataAttendant. It looks for names, email addresses, phone numbers and similar values in the cells that remain, including inside the sentences of a free-text column. There it can change only the parts it finds and leave the rest of the text, and you can accept, reject or change that choice. Parts it is unsure of wait for your decision before you can download. It can miss parts it does not recognize, such as an address written into a sentence, so still read the longest entries. Your file is processed in your browser and is not sent to DataAttendant. How DataAttendant works shows the steps, and which files DataAttendant can open gives the limits.
Sources
- Information Commissioner's Office, "How do we avoid an accidental breach when personal information is hidden in spreadsheets?", part of "Disclosing documents to the public securely: hidden personal information and how to avoid an accidental breach". The guidance is dated 31 July 2025. The ICO states that it is under review following the Data (Use and Access) Act. Read on 1 November 2026.
- Information Commissioner's Office, "Checklist: How do we avoid an accidental breach when personal information is hidden in spreadsheets". Read on 1 November 2026.
- GOV.UK, "Creating and sharing spreadsheets", Government Digital Service and Central Digital and Data Office. Last updated 5 October 2023. Read on 1 November 2026, and again on 2 November 2026.
- Microsoft Support, "Remove hidden data and personal information by inspecting documents, presentations, or workbooks". Read on 1 November 2026.
- Microsoft Support, "Keyboard shortcuts in Excel": in Excel for Windows, Ctrl+End moves to the last cell on a worksheet, the lowest used row of the rightmost used column. Read on 2 November 2026.
- The example workbook is invented.
Where next?
- Hidden data in Excel files: what a workbook holds that you cannot see
- Why removing names is not enough: how ordinary details can point to one person
- What is PII? What counts as personally identifiable information in a spreadsheet
- Which files DataAttendant can open, and what happens to each kind
- How DataAttendant works, step by step
- Preparing case and citizen data for analysis in a public body: what to remove before a file leaves your system
- All articles
- What DataAttendant does
- Terms of service