A file does not need a password or a confidential label to say something personal. Look at its contents, its context and its audience before deciding which copy to share.
# What an ordinary file can reveal about you
A file does not need a password or a confidential label to say something personal. Look at its contents, its context and its audience before deciding which copy to share.
最后更新 22 October 2026
## Start with the person receiving the file
A file can be appropriate for one recipient and too revealing for another. An expense reviewer might need the date and merchant on a receipt. Someone reading a public question about a price probably does not need your loyalty number or the exact time you visited.
Names are only part of the review. Details can identify someone when combined with information the recipient already has. The UK's Information Commissioner's Office explains this contextual point in its [guide to personal information](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/what-is-personal-information-a-guide/).
The following examples are fictional. Each starts with a reason to share something, then asks what else would travel with it.
## A receipt tells more than the price
Imagine a receipt from North Street Print. It shows a CAD 12.40 purchase, a branch address, a timestamp, a loyalty number and the customer's email address. You want to post it in a community discussion about printing costs.
The item description, quantity and price explain the cost. The email address connects the transaction to a person. The branch and timestamp give readers a possible location and time. The loyalty number adds an identifier that the discussion does not need.
That does not prove a person's habits or even that they collected the order themselves. Separate what the document states from what a reader might infer. A single purchase is not a reliable account of someone's routine.
For the public discussion, prepare a copy containing enough information to understand the price. For reimbursement, retain the transaction details the reviewer requires. Keep the original separately so making a sharing copy does not destroy your record.
## A screenshot includes the surroundings
Imagine a screenshot showing an error while uploading a document. Around the error are your account email, a browser tab for a job application, a notification from a colleague and a filename containing a customer's name.
The support team needs to understand what failed. The filename may help explain the file type, but the customer's name may contribute nothing. The notification is unrelated. A public forum has a broader audience than a private support conversation.
Read the screenshot from edge to edge instead of looking only at the error. Check tab titles, sidebars, account menus, filenames, addresses and notifications. Identify which details explain the problem: perhaps the error message, relevant control and file extension.
Retain that context. Removing everything except an unexplained error number can make the screenshot useless and lead to another request for information.
## An attendance list describes relationships
A fictional workshop spreadsheet contains names, contact addresses, attendance marks and notes about why someone could not come. The organiser needs to follow up with absent participants. A funder asks how many people attended.
Those are different purposes. The organiser may need individual records. The funder's count does not automatically require every participant's address or absence note. A named list connects people with an event, place and date, whether or not that connection seems important to its author.
Removing names alone may leave recognisable combinations. If everyone knows there was only one volunteer from a particular workplace, that description can still point to them. Review a summary rather than assuming that removing a column makes it anonymous. Check information about other people as carefully as information about yourself.
## Look beyond what appears on the page
Visible content is only one part of some file formats. Microsoft documents how Office files can contain author properties, comments, tracked changes and hidden spreadsheet content. A hidden worksheet can still be included in the file someone receives. See Microsoft's [document inspection guidance](https://support.microsoft.com/en-gb/office/collab-files/remove-hidden-data-and-personal-information-by-inspecting-documents-presentations-or-workbooks?nochrome=true).
Photos can contain location metadata when it was recorded. Apple explains that recipients of a photo carrying that information may learn where it was taken in its [location metadata guidance](https://support.apple.com/en-gb/guide/personal-safety/ips0d7a5df82/1.0/web/1.0).
Inspect the actual file with an appropriate viewer or its originating application. These examples do not mean every photograph contains coordinates or every document contains hidden comments. Check what is present. The guides to [what a PDF remembers](https://httcup.github.io/tools/guides/what-a-pdf-remembers/) and [photo metadata](https://httcup.github.io/tools/guides/remove-exif-and-gps-data/) explain those formats in more detail.
## Make a small review plan before editing
1. **Write the purpose.** Complete the sentence: this recipient needs this file to do what? Be specific enough to judge whether a detail helps.
2. **Name the audience.** Distinguish an individual reviewer, a team and a public page. Consider whether the recipient is expected to pass it on.
3. **List what is included.** Review visible content, filenames, document properties and additional content supported by the format.
4. **Consider combinations.** Ask what the recipient could learn by connecting these details with information they already know.
5. **Mark what to keep or remove.** Keep details needed to understand the evidence. Clarify uncertain requirements before removing something essential.
6. **Review the final copy.** Reopen the exact file you intend to send. Confirm it still answers the recipient's question and that the changes reached the output.
## Keep enough information to do the job
The aim is a useful, proportionate sharing copy. The ICO's [data minimisation guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/data-minimisation/) balances limiting information with keeping enough for the stated purpose. Apply that review principle to the file and audience in front of you.
Keep a price with its quantity and currency, an error with the context needed to diagnose it, or an attendance total with the event and date it describes. Once you know what should remain, choose the appropriate editing or metadata tool. For an image, the [redaction guide](https://httcup.github.io/tools/guides/redact-an-image/) explains removal and output checks. Check the final file against your plan before sharing it.
Start with the person receiving the file
A file can be appropriate for one recipient and too revealing for another. An expense reviewer might need the date and merchant on a receipt. Someone reading a public question about a price probably does not need your loyalty number or the exact time you visited.
Names are only part of the review. Details can identify someone when combined with information the recipient already has. The UK's Information Commissioner's Office explains this contextual point in its guide to personal information.
The following examples are fictional. Each starts with a reason to share something, then asks what else would travel with it.
A receipt tells more than the price
Imagine a receipt from North Street Print. It shows a CAD 12.40 purchase, a branch address, a timestamp, a loyalty number and the customer's email address. You want to post it in a community discussion about printing costs.
The item description, quantity and price explain the cost. The email address connects the transaction to a person. The branch and timestamp give readers a possible location and time. The loyalty number adds an identifier that the discussion does not need.
That does not prove a person's habits or even that they collected the order themselves. Separate what the document states from what a reader might infer. A single purchase is not a reliable account of someone's routine.
For the public discussion, prepare a copy containing enough information to understand the price. For reimbursement, retain the transaction details the reviewer requires. Keep the original separately so making a sharing copy does not destroy your record.
A screenshot includes the surroundings
Imagine a screenshot showing an error while uploading a document. Around the error are your account email, a browser tab for a job application, a notification from a colleague and a filename containing a customer's name.
The support team needs to understand what failed. The filename may help explain the file type, but the customer's name may contribute nothing. The notification is unrelated. A public forum has a broader audience than a private support conversation.
Read the screenshot from edge to edge instead of looking only at the error. Check tab titles, sidebars, account menus, filenames, addresses and notifications. Identify which details explain the problem: perhaps the error message, relevant control and file extension.
Retain that context. Removing everything except an unexplained error number can make the screenshot useless and lead to another request for information.
An attendance list describes relationships
A fictional workshop spreadsheet contains names, contact addresses, attendance marks and notes about why someone could not come. The organiser needs to follow up with absent participants. A funder asks how many people attended.
Those are different purposes. The organiser may need individual records. The funder's count does not automatically require every participant's address or absence note. A named list connects people with an event, place and date, whether or not that connection seems important to its author.
Removing names alone may leave recognisable combinations. If everyone knows there was only one volunteer from a particular workplace, that description can still point to them. Review a summary rather than assuming that removing a column makes it anonymous. Check information about other people as carefully as information about yourself.
Look beyond what appears on the page
Visible content is only one part of some file formats. Microsoft documents how Office files can contain author properties, comments, tracked changes and hidden spreadsheet content. A hidden worksheet can still be included in the file someone receives. See Microsoft's document inspection guidance.
Photos can contain location metadata when it was recorded. Apple explains that recipients of a photo carrying that information may learn where it was taken in its location metadata guidance.
Inspect the actual file with an appropriate viewer or its originating application. These examples do not mean every photograph contains coordinates or every document contains hidden comments. Check what is present. The guides to what a PDF remembers and photo metadata explain those formats in more detail.
Make a small review plan before editing
Write the purpose. Complete the sentence: this recipient needs this file to do what? Be specific enough to judge whether a detail helps.
Name the audience. Distinguish an individual reviewer, a team and a public page. Consider whether the recipient is expected to pass it on.
List what is included. Review visible content, filenames, document properties and additional content supported by the format.
Consider combinations. Ask what the recipient could learn by connecting these details with information they already know.
Mark what to keep or remove. Keep details needed to understand the evidence. Clarify uncertain requirements before removing something essential.
Review the final copy. Reopen the exact file you intend to send. Confirm it still answers the recipient's question and that the changes reached the output.
Keep enough information to do the job
The aim is a useful, proportionate sharing copy. The ICO's data minimisation guidance balances limiting information with keeping enough for the stated purpose. Apply that review principle to the file and audience in front of you.
Keep a price with its quantity and currency, an error with the context needed to diagnose it, or an attendance total with the event and date it describes. Once you know what should remain, choose the appropriate editing or metadata tool. For an image, the redaction guide explains removal and output checks. Check the final file against your plan before sharing it.