Redact a Word document before AI reads it

How to redact in Word, when the document is on its way to ChatGPT, Copilot or Claude, comes down to one rule: delete, do not cover.

Work on a copy, accept or reject every tracked change, delete every comment, replace each name and number in all its forms, read the headers, footnotes, text boxes and fields, and finish with Microsoft’s Document Inspector. A black box, a highlight or white text hides a client from the eye and leaves them in the file.

The file is what matters, because an upload sends all of it. The OAIC’s advice on commercially available AI products says that “as a matter of best practice, the OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools”. How long a given account keeps what you send is another matter, and the ChatGPT retention guide deals with it.

For this guide we built a test file: an invented accountant’s file note about an invented client, Bronwyn Tallis, who runs an invented business, Tallis Joinery. We replaced her full name in the visible text, the way most people start, and then opened the file to see what was left. Her details were still in ten different places.

How to redact in Word: the short version

These are the steps in the order that avoids undoing your own work, with the menus as Microsoft Support (Australia) names them for Word for Microsoft 365.

Step	Where it is in Word
Make the copy you will clean	File > Save As, with a new file name
Settle every tracked change	Review > Tracking > Accept > Accept All Changes
Remove every comment	Review > Delete > Delete All Comments in Document
Replace names and numbers	Home > Editing > Replace (Ctrl+H)
Refresh the fields	Ctrl+A, then F9
Inspect the copy	File > Info > Check for Issues > Inspect Document
Search one last time	View > Navigation Pane

The order is deliberate. Settle the changes first, so that what you then replace is the text that will actually remain. In between, read what sits off the page: headers, footers, footnotes, text boxes and charts. Refresh the fields after the replacing, so a table of contents stops quoting headings you have already changed. Inspect at the end, because the Document Inspector is a safety net and not the job itself.

The rest of this page takes the steps one at a time, with what our test file showed at each one. If you work in a practice that handles client identifiers every day, Nonimo for accountants is written for exactly that desk.

What a Word file carries that the page does not show

A .docx file is a compressed folder of smaller files. The text of the page is one of them. Comments live in another, footnotes in another, each header in its own, and the document’s properties in yet another. Our test file had nine parts once unzipped, and the client turned up in five of them. A PowerPoint file is packed the same way, and in a deck a separate list of comment authors names each reviewer even when the remark says almost nothing.

Every one of those places is ordinary, and nobody set out to hide anything. A colleague deleted a sentence with Track Changes on, someone left a comment for the partner, the header was typed when the file was opened, and the table of contents was generated before the heading was changed. That is how a working document looks after a week in a shared folder.

It is no different with the Word files an Australian office actually sends to a chatbot for help: a letter of advice, a statement of claim in draft, a tenancy ledger, an NDIS support plan, a staff warning letter. Each has been through several hands before anyone thinks of asking an AI tool to shorten it. Law practices meet this with every matter file, and Nonimo for Australian law practices begins with the identifiers a matter file tends to hold.

Two converters, two different answers

We then asked two ordinary tools to pull the text out of the same file, because any software that reads the words of a Word file has to pull them out first. The python-docx library, reading the body paragraphs, returned the stale table of contents, the surname, the business name, the date of birth under the black bar and the hidden tax file number. LibreOffice, saving the file as plain text, returned all of that plus the deleted address.

python-docx, body paragraphs

Full name in the contents line, surname, business and ABN, date of birth, TFN, nickname.

LibreOffice, saved as text

All of those, plus the deleted address, 0 Quenby Lane.

Neither tool printed the comment, the header, the footnote text or the text box, even though all four were sitting in the file. What a particular AI service extracts from an uploaded Word file is for its provider to say, and we have not tested one here. The safe assumption is the whole file. How Microsoft says Copilot reaches the documents in a tenancy is set out in our Copilot guide for confidential work.

A black bar is formatting, not deletion

The date of birth in our test file sat under a black highlight with black text. On screen it looked like a redaction bar. In the file it was the same characters with two formatting marks attached, and both converters printed it in full. White text on a white background works the same way, and Microsoft notes that the Document Inspector’s hidden text check cannot detect text hidden by that method.

Start on a copy, and settle the edits and comments

Save a copy under a new name before you touch anything, and keep the original in the client file. In the copy, accept or reject every tracked change and delete every comment, resolved ones included, then turn Track Changes off so your own deletions are not recorded with the detail inside. Hiding the markup does not remove it, and removing track changes in Word permanently walks through each menu on Windows, Mac and the web.

If your engagement letter tells clients how AI is used on their work, this copy is what that promise is about, and our AI clause for solicitors and tax agents has wording for it.

Find and Replace in Word, and the names it misses

Find and Replace is where most people start, at Home > Editing > Replace or with Ctrl+H. Type the name in Find what, a label in Replace with, and choose Replace or Replace All. Microsoft advises stepping through one match at a time instead of the all at once button, so every swap gets a look, and More > Match case narrows the search when capitals matter.

It does exactly what you ask. That is the trap: it replaces the string you typed and nothing else, and people are rarely written the same way twice in a file note.

The surname alone, the nickname and the business

Replacing Bronwyn Tallis dealt with the heading. These are the other ways the client was written in our test file.

How the client was written	Where it was in the file
Ms Tallis	body text
Bron	body text
Tallis Joinery, with its ABN	body text
Bronwyn’s	footnote
B. Tallis	text box
TALLIS B	header

Each of those needs its own search. The surname on its own catches most of them, as long as Match case is off for the capitals in the header; the first name, the nickname and any initials catch the rest.

Pick a label for each role and keep it for the whole file: [CLIENT] for the person, [BUSINESS] for her firm, [STAFF 1] for the colleague. Consistent labels let the AI tool follow who did what, and they let you put the right names back into its answer. A search for the business name matters as much as a search for the person, because the business is often named after her.

Watch for a search that catches too much as well. A surname that is also an ordinary word, like Bell or Rich, will be replaced in the middle of sentences unless you tick Match case and Find whole words only, and step through with Find Next.

Numbers written more than one way

A tax file number might appear as 000 000 000 in one paragraph and 000000000 in another, and a search for one will not find the other. Word’s wildcards help here. In the Find and Replace dialog, select More, then tick Use wildcards; Microsoft’s table of wildcard characters covers ranges in square brackets and repeat counts in braces.

Number	How it is usually written	Wildcard to try in Find what
TFN	three groups of three digits	[0-9]{3} [0-9]{3} [0-9]{3}
Medicare	four, five and one digits	[2-6][0-9]{3} [0-9]{5} [0-9]
ABN	two, then three groups of three	[0-9]{2} [0-9]{3} [0-9]{3} [0-9]{3}

The patterns are built from Microsoft’s published wildcard syntax; we did not run them inside Word for this guide, so try them on the copy first. Step through with Find Next rather than Replace All, because a pattern that matches a TFN will also match an invoice number laid out the same way. Search for the unspaced form too, and for the last three digits of each number the client has given you.

Health practices meet Medicare numbers in almost every letter, and Ahpra’s expectations for patient data and AI add a professional layer on top.

Tables, lists and the schedule at the back

Tables deserve a slower pass than prose. A payroll summary, a list of beneficiaries, a schedule of tenants or a table of staff with their start dates puts one person on every row, and a search for one client’s name does nothing about the other nineteen. When the same table arrives as a spreadsheet, hidden rows and sheets travel with it, so taking names out of a workbook follows an order of its own.

If the question you are asking the AI tool does not need a column, delete the column from the copy rather than relabelling each cell. A table of wages with the names and TFNs removed can still answer a question about award rates. A table with every name swapped for a label still describes nineteen identifiable employees to anyone who knows the business.

A column of union fees or leave reasons also brings the Act’s sensitive categories into the file, with stricter rules attached. Those columns are usually the first to delete.

Headers, footnotes, text boxes and hidden text

Some of a document’s text lives outside the main body. Microsoft’s list of what the Document Inspector looks at for Word names information in headers and footers, watermarks, text formatted as hidden, and objects formatted as invisible, alongside comments and revisions. Those are the places a hurried redaction skips, because they are not in the paragraph you were reading.

Headers and footers

Our file’s header read TALLIS B, 2025 amended return, DRAFT, and it would have printed on every page. Open the header and edit it by hand. The Document Inspector can remove header and footer information, but it removes the lot, and in a letter that includes your practice’s letterhead. For a document that has to look like the original, a manual edit is usually the better choice.

Court documents carry their own restrictions as well: the NSW Supreme Court practice note on AI sets limits on which material a lawyer can give a generative AI program in the first place.

Footnotes and endnotes

The footnote in our file said the figures came from Bronwyn’s email of 2 September. Footnotes get written in a hurry, often weeks after the body, and the traceable detail ends up down there: whose email, which meeting, which letter. Read every one, and read the endnotes if the document has them.

Text boxes and shapes

The text box in our file was a reminder to call B. Tallis back on 0491 570 156. Neither of the two converters we tried printed it, and yet the words were inside the main document part, where any tool that reads the whole structure will find them. Click into each text box, callout and shape that holds words, and clean it like the body.

Hidden text

Hidden text is a font effect in Word’s Font dialog. Our file had a TFN formatted that way: invisible on screen, and printed by both converters we tried. Microsoft’s Document Inspector finds text formatted as hidden and can remove it, which is one of the better reasons to run it. It does not find text disguised in other ways, so the white text check stays yours.

Charts, SmartArt and pictures, such as a photographed drivers licence, deserve a look of their own. A chart title, a data label or a screenshot pasted into the file can carry a client’s name as easily as a sentence can, and a scan of a signed form is a picture of the form. If you do not need them for the question you are asking, delete them from the copy.

Fields that remember the old name

A field is text that Word generates rather than text you type: a table of contents, page numbering, a date, a pointer to another heading. Microsoft’s page on updating fields says that sometimes you need to manually trigger an update of the information in fields like those used in a table of contents, headers and footers, cross references and bookmarks.

That is how our test file still said Bronwyn Tallis after the heading had been changed to [CLIENT]. The table of contents had been generated earlier, and until it is updated it keeps its old text. Both converters printed the stale line with the full name on it.

To update every field at once, Microsoft’s instruction is Ctrl+A, then F9. If a table of contents asks, choose Update entire table, because updating page numbers only leaves the old headings in place. Microsoft also suggests File > Options > Advanced, then Field shading set to Always, so you can see which parts of the page are fields at all.

The table of contents in a Treasury FOI release

In July 2025 the ABC’s Daniel Ziffer described what happened with a Treasury response to one of his freedom of information requests. The 111 page release was, in his words, basically empty, with the briefs for the Treasurer and the Housing Minister redacted in full.

111

The first version sent on 30 May still contained what was essentially a table of contents for the redacted briefs, and the headings alone gave away Treasury’s thinking on the issues. The report does not say what software produced the release, and we do not suggest it was Word.

The lesson for a Word user is the same, though: a contents list repeats your headings, so a redacted heading has to be redacted twice, or the contents list deleted.

Councils release documents under FOI and use AI tools too, and the privacy law that binds each council depends on the state.

APP 6, the TFN Rule and the OAIC’s advice on AI tools

The reason to take this much care is not the software. It is what the Privacy Act 1988 says about the information in the file, and three Australian rules land on a file note like ours at once.

APP 6 is the first. The OAIC’s guidance on commercial AI products puts it plainly: entities may only use or disclose information for the primary purpose it was collected for, unless they have consent or the secondary use would reasonably be expected. Drafting a letter with a chatbot is rarely the purpose the client had in mind. The full APP 6 test, with the OAIC’s own example, is in our guide to choosing AI tools under the Act.

Number in the file	Rule that governs it	What it means for the Word file
Tax file number	Privacy (Tax File Number) Rule 2015, and sections 8WA and 8WB of the Taxation Administration Act 1953	no use or disclosure outside tax, personal assistance or super law
Medicare number	APP 9, which gives Medicare numbers as an example of a government related identifier	narrower use and disclosure rules than APP 6
ABN	excluded from the APP 9 definition of identifier	still personal information if it points to a person

The TFN row is the strict one. The OAIC’s guidance on the TFN Rule treats anyone “in possession or control of a record that contains TFN information” as a TFN recipient, lawfully or not, and must not record, collect, use or disclose it unless taxation, personal assistance or superannuation law permits it. A TFN formatted as hidden text is still in the record.

The ABN is a special case

APP 9 treats an individual’s ABN differently from a Medicare number: paragraph 9.6 of the APP guidelines excludes it from the definition of identifier altogether. That settles which principle applies, not whether the number is sensitive in your file. For a sole trader the ABN belongs to a person, anyone can look it up on the public ABN Lookup, and a business called Tallis Joinery tells the reader the surname anyway.

Taking names out is not de-identifying

The OAIC’s guide De-identification and the Privacy Act warns that “the removal of name, address or other direct identifiers alone may not result in de-identification for the purposes of the Privacy Act”. Whether information is de-identified depends on context, including who will receive it. Replacing Bronwyn Tallis with [CLIENT] is pseudonymisation, and the difference is set out in de-identified vs pseudonymised.

What a clean Word copy gives you

Names and numbers replaced by labels you can reverse. Pseudonymised, still personal information in your hands.

What de-identified means in the Act

No longer about an identifiable individual, judged in the context where the text lands.

Nothing here is legal advice about a particular document. It describes the Act and the software in general terms, and the person responsible for privacy in your practice is the one to apply it.

Checking the copy: Document Inspector and one more search

When the manual passes are done, run the Document Inspector: File > Info > Check for Issues > Inspect Document. Tick the inspectors you want, select Inspect, then Remove All next to each result you want gone, and Reinspect. Microsoft warns that Undo may not bring removed content back, which is one more reason to be working on the copy. Do it in the .docx itself, because a document saved as Rich Text can keep its revisions and comments.

Inspector	What it finds	What Microsoft says it misses
Comments, Revisions, Versions, and Annotations	comments, tracked change marks, ink	nothing in your ordinary prose
Headers, Footers, and Watermarks	everything in them	it cannot keep the letterhead and drop the name
Hidden Text	text formatted as hidden	white text on a white background
Invisible Content	objects formatted as invisible	objects covered by other objects

The Document Properties and Personal Information inspector deals with the file’s own details, such as who created it and who touched it most recently. That is a subject of its own, and worth a separate pass.

One more search, and one question

Then search the copy one last time from View > Navigation Pane, for the surname, the first name, any nickname, the business name and the last three digits of each number. It takes a minute and it catches the spelling you forgot.

The last check is not a search. Read the copy as someone who knows the client would read it. A town, a date and an unusual claim can identify a person with no name attached, which is the same judgement our NDIS case note guide walks through for progress notes.

If the uncleaned file has already gone

It happens: the wrong version is attached, or the clean copy is saved over. Do not try to fix it by sending a second, cleaner file. Write down what was sent, where, from whose login and when, and pass that note to the person who handles privacy before the day is out. Whether it must be notified to the OAIC and the client is its own test, worked through in when a chatbot upload counts as a breach.

What Nonimo did with the same lines

You drop a document into the window of the Nonimo app and it gives you back the text with the details covered, ready to put into the AI tool, and a covered copy of the document. A Word file comes back as the same Word file, covered in its title and properties too.

Three invented lines, and what Nonimo returned on 28 September 2026, unedited.

BEFORE  TFN 000 000 000   ABN 51 824 753 556
        Ms Tallis called on 3 September about the home office deduction
        for Tallis Joinery. Call her back on 0491 570 156.

AFTER   TFN [TFN_1]   ABN [ABN_1]
        Ms [PERSON_1] called on 3 September about the home office deduction
        for [PERSON_1] Joinery. Call her back on [PHONE_1].

When the reply arrives with the labels in it, the app restores the real details on your screen, and the security page sets out what it keeps where. The Word tool above this guide gives you back the covered text and the same Word file with the details covered; putting the names back into the reply is the app’s part.

A copy with its edits settled and comments cleared is still the best input, and a licence photo has its own tool, which covers it in your browser.

Sources

• OAIC, Guidance on privacy and the use of commercially available AI products (21 October 2024, updated 17 January 2025). The best practice recommendation not to enter personal information into publicly available generative AI tools, and the APP 6 primary purpose test. oaic.gov.au
• OAIC, De-identification and the Privacy Act (21 March 2018). Removal of direct identifiers alone may not result in de-identification; context decides. oaic.gov.au
• OAIC, The Privacy (Tax File Number) Rule 2015 and the protection of tax file number information. Who is a TFN recipient, the limits on use and disclosure, and sections 8WA and 8WB of the Taxation Administration Act 1953. oaic.gov.au
• OAIC, APP guidelines, Chapter 9: APP 9. Paragraph 9.6 excludes an individual’s ABN from the definition of identifier; paragraph 9.8 gives Medicare numbers as an example of a government related identifier. oaic.gov.au
• Microsoft Support, Remove hidden data and personal information by inspecting documents, presentations, or workbooks. The Document Inspector route, what each inspector finds, and what it cannot detect. support.microsoft.com
• Microsoft Support, Accept or reject tracked changes in Word. No Markup only temporarily hides changes; the Accept All Changes route. support.microsoft.com
• Microsoft Support, Track changes in Word. With Track Changes on, deletions are marked with a strikethrough. support.microsoft.com
• Microsoft Support, Using modern comments in Word. The contextual view hides resolved comments; the list view shows them all. support.microsoft.com
• Microsoft Support, Insert, delete, or change a comment. The Delete All Comments in Document command. support.microsoft.com
• Microsoft Support, Find and replace text in Word. Home > Editing > Replace, Match case, the Replace tip and the wildcard table. support.microsoft.com
• Microsoft Support, Update fields. Fields in a table of contents need a manual update; Ctrl+A then F9; field shading. support.microsoft.com
• ABC News, Daniel Ziffer, Fearless and free Treasury isn’t holding back (14 July 2025). The 111 page FOI release whose first version kept a table of contents for the redacted briefs. abc.net.au
• Our test file. An invented file note built as a .docx on 28 September 2026, audited part by part and run through python-docx and LibreOffice. Every name, address and number in it is invented; the ABN returned no record on ABN Lookup.