Redact a Word document before AI sees it

To redact a Word document before uploading it to ChatGPT, Claude or Copilot, work on a copy and take the client out of the file, not just off the screen. Accept or reject every tracked change, delete every comment, show hidden text, then replace each spelling of each name and number with a marker. Check the headers, footers, footnotes and text boxes, and run the Document Inspector last.

Black highlighting, white text and shapes laid over words are not redaction: the words are still in the file.

The rest of this guide takes those steps in order, with the Word menus as Microsoft names them in its UK support pages. It is for people in UK firms who hold a client’s Word file and want an AI tool to summarise it or draft a reply: solicitors, accountants, HR advisers and their teams. For what the tools do with what you send, see how long ChatGPT holds on to your chats and Copilot and confidential client information.

How to redact a Word document, in the order that works

Done in the wrong sequence, one step quietly wastes another. Replacing a name before you accept tracked changes, for example, leaves the old name sitting in a deletion that the replace never touched. Here are the seven; the sections that follow deal with them one by one.

1. Save a copy. Close the original and do everything that follows in the copy. Microsoft and the ICO both give this advice, because some of what you remove cannot be put back.
2. Accept or reject tracked changes. All of them, from the Review tab. Until you do, deleted text is still in the file.
3. Delete the comments. Review tab, the arrow by Delete, then Delete All Comments in Document.
4. Show hidden text. File, Options, Display, and tick Hidden text, so that what is hidden is in front of you.
5. Replace, do not colour. Use Find and Replace for every spelling of each name and each number, and type a marker in its place.
6. Look outside the body. Headers, footers, footnotes, text boxes, tables and anything pasted in from Excel.
7. Inspect, then read. Run the Document Inspector on the copy, then read the whole document once more before it goes anywhere.

If the file is going to an AI tool your firm has not approved, the question is bigger than redaction: start that conversation with a written policy on which AI tools staff may use.

Why black highlighting and white text are not redaction

Most failed redaction in Word comes from tricks that only change the look of the page. The ICO’s guidance on redacting information is plain about it: remove the information from a copy and, if you like, put a redaction marker where it was. Its companion page on hidden information names the tricks that fail, including changing the colour of the text or the background and covering information with objects.

The reason they fail is the same in every case. A Word file stores the words and, separately, instructions on how to show them. Black highlighting changes the instruction, not the word. So does white font on a white page. A black rectangle drawn over a name is a second object sitting on top of the first, and the name underneath is untouched.

What people do	What the page shows	What the file still holds
Black highlighting	A black bar	The words, under the highlight
White font on white	Blank space	The words, in white
A black shape over the text	A black box	The words, under the shape
Font set to hidden	Nothing, unless hidden text is shown	The words, marked as hidden
No Markup view	A clean page	Every tracked change

Sources: ICO, How do we avoid an accidental breach when personal information is ‘hidden’ in documents?; Microsoft Support, Accept or reject tracked changes in Word.

The same goes for the file itself when you upload it. You are not sending a picture of the page; you are sending the .docx, with everything inside it, including the words under the bar. Our guide to whether Claude trains on your data sets out what one provider keeps once the file arrives, which depends on the account you use.

Tracked changes and comments, before anything else

Settle the markup before you replace a single name. On the copy, accept or reject every tracked change and delete every comment, resolved threads included. A name crossed out under track changes stays in the file, and the No Markup view only hides it. Our guide to removing track changes and comments in Word gives the menus for Windows, Mac and the web, and the checks that follow.

Comments are no kinder in a PowerPoint deck, where a resolved thread stays in the file, and each one carries its author’s name as well as its text.

Find and Replace, and every other way the name is written

Find and Replace does the heavy lifting in the main text, and it is also where most redaction goes wrong, because it finds exactly what you type and nothing else. Microsoft’s Find and replace text in Word page gives the route: Home, Editing, Replace. Type what you want to find in Find what, type the marker in Replace with, and choose Replace All, or use Find Next and Replace to confirm each one.

Microsoft’s own tip is to prefer Replace over Replace All so that you see each hit. For redaction that is good advice for a different reason: seeing each hit is how you notice the spellings you had not thought of. In our invented attendance note, the full name “Harriet Quennell” appeared once in the whole file. The client was identifiable in 11 runs of text.

11

The other ten were a surname with a title, initials, an email address, a first name, a former name and a previous address, several of them outside the body. The section on our test file below lists them by place.

Search for the parts, not the whole

The practical rule is to search for the surname on its own, then the first name on its own, then initials, then anything built from them, such as an email address or a file reference. When you search for initials, tick Match case and Find whole words only under More, or a search for HQ will also stop at the letters inside other words, such as headquarters.

Possessives and plurals are covered by searching for the surname alone: a search for Quennell finds “Quennell’s” as well. A name typed with a line break or a double space in the middle will not match a search for the ordinary form, so the final read through is still part of the job.

Use markers that keep the sense

Replace each person with a different marker, such as [CLIENT], [SISTER] and [MANAGER], rather than one [REDACTED] for everyone. An AI tool asked to summarise an attendance note needs to know that the person who was moved to night shifts and the person who moved her are two different people. A page full of identical black bars, or identical placeholders, loses exactly the thing you wanted the tool to work on.

Keep the list of which marker stands for whom in a separate note inside the firm, not in the copy you upload. When the answer comes back, you can put the names back in yourself. For a client in a regulated sector, our pages for solicitors and accountants cover what else your professional rules ask.

Hidden text, headers, footers and footnotes

Text can be formatted as hidden in Word, which is a font effect: the words stay in the document but are not shown on the page unless you ask for them. In our test file, the client’s previous address was hidden text at the end of a paragraph. It did not belong to anything a reader would see on the page, and it was still in the file.

Microsoft’s page on Word Options (Display) describes the setting that brings it back: under File, Options, Display, select Hidden text, and Word shows a dotted line under anything formatted as hidden. The same page notes that the Show/Hide button in the Paragraph group of the Home tab turns the formatting marks on and off quickly. Switch hidden text on before you start replacing, so that you can see and remove what is there.

Headers and footers

Headers and footers are where firms put the case name and the file reference, and both tend to name the client. In our test file the header read “Quennell v Brackley Foods Ltd” and the footer held a reference built from the client’s initials. Open each header and footer, read it, and edit it as you would the body. Check them on every page of the document, not only the first.

The ICO’s hidden documents guidance also warns that markup such as comments and tracked changes may show modifications a recipient was never meant to see. Headers are not markup, but they are just as easy to forget, because nobody reads them after the first draft. For a statement heading to court, every draft deserves that check, as we explain for statements and skeletons prepared with AI.

Footnotes and endnotes

A footnote is often where a detail goes to be out of the way: “screenshots sent from h.quennell@example.com on 4 September”. In our test file that single footnote carried the client’s email address, which is as good as a name. Footnotes sit at the bottom of the page and endnotes at the end of the document, and both are worth reading line by line.

The attendance note is the kind of document that also turns up in NHS and care settings, where a footnote may hold a clinic reference instead.

Text boxes, tables and embedded charts

A text box is a small floating container, often used for a note to self or a reminder, and it sits apart from the flow of the page. In our test note it said “Call Harriet back on 07700 900781 before Friday”, which is a name and a mobile number in one line. Click into every text box you can see and read it, and look for boxes that sit at the edge of the page or partly off it.

Tables are ordinary text inside cells, and they tend to hold the densest identifiers: a schedule of payments with dates, a list of witnesses with addresses, a chronology with names in every row. Read them row by row after your replacements, because a table is also where a surname is most likely to be typed differently from one row to the next.

Charts and objects pasted in from Excel

Embedded objects are the part of a Word file that Find and Replace does not reach in any useful way, because the data behind them is a separate document. The ICO’s hidden documents page warns that recipients may be able to reveal the information behind an embedded file or object simply by double clicking it, and suggests considering whether you can keep only a picture of the chart, for example with the Paste Special option in Microsoft products.

For a redaction before an AI tool, the simpler answer is often to delete the embedded chart from the copy and describe in a sentence what it showed. An AI tool summarising the note rarely needs the underlying spreadsheet, and a spreadsheet behind a chart is exactly where a client list, with birthdays and bank details, tends to sit. If the task really needs the workbook, clear its hidden rows, sheets and pivot caches before it goes.

The ICO’s guidance on AI and data protection starts from the same idea: send the tool only what the job requires, as the data minimisation principle in Article 5(1)(c) of the UK GDPR. Our guide to checking an AI tool under the UK GDPR covers the checks on the tool itself.

What our test attendance note was carrying

To check this guide against a real file rather than against memory, we wrote a short attendance note for an invented client and saved it as a .docx. It has a client line, a narrative paragraph, a tracked change, a comment, a footnote, a text box, a line of hidden text, a header and a footer. Then we unzipped it and read every part of the file, listing each piece of text and where it sat.

Of the 11 runs of text that identified the client, only one held the full name as you would type it into Find what. The table shows where the rest sat.

Where in the file	What it held
Body	Name, Ms Quennell, the initials HQ, email
Text box	First name and mobile number
Tracked deletion	Former name
Hidden text	Previous address
Header and footer	Surname in the case name, initials in the file reference
Footnote	Email address
Comment	First name, and her sister’s full name

Source: our test .docx, built by script with invented data and read part by part; the script and its output are kept with this guide’s working files.

The test shows what the file carries: those 11 pieces of text were inside the .docx, whatever the page showed. It does not tell you what any particular AI tool does with each part once uploaded, and we do not claim it does. The safe reading follows the ICO’s disclosure guidance: if the information is in the file, treat it as disclosed when the file leaves.

The root of the question, whether sending client data to an AI tool is a breach at all, is answered in whether client data in ChatGPT counts as a breach.

Searching for NI numbers, NHS numbers and phone numbers with wildcards

Names are the obvious target, but a UK client file is full of numbers that identify a person just as well. Find and Replace can look for their shape rather than their value if you tick Use wildcards, which Microsoft describes on the same find and replace page. Square brackets give a range of characters, such as [0-9] for any digit, and a number in curly brackets says how many times the character before it repeats.

A National Insurance number is two letters, six numbers and a final letter, which HMRC’s National Insurance Manual says is always A, B, C or D. An NHS number is ten digits, which the NHS website prints as a block of three, another of three, then four. Those two descriptions translate into search patterns built only from the wildcard characters in Microsoft’s table.

To find	Type in Find what, with Use wildcards ticked
NI number, spaced	[A-Z]{2} [0-9]{2} [0-9]{2} [0-9]{2} [A-D]
NI number, run together	[A-Z]{2}[0-9]{6}[A-D]
NHS number, spaced	[0-9]{3} [0-9]{3} [0-9]{4}
UK mobile, spaced	07[0-9]{3} [0-9]{6}
Date written as 31/04/1984	[0-9]{2}/[0-9]{2}/[0-9]{4}

Built from the wildcard table in Microsoft Support, Find and replace text; formats from HMRC NIM39110 and the NHS website.

Use Find Next, not Replace All, for these

The NHS pattern will also find things that are not NHS numbers, such as an invoice or a bank reference written the same way. That is fine for a search, and a reason to step through each hit with Find Next and replace only the ones that are identifiers. Each pattern also finds only the layout it describes: an NHS number typed with no spaces needs its own pattern.

Numbers written in words, a postcode on its own, a vehicle registration, a payroll number or a court case number will not be found by any of these, and some of them identify a person on their own. The list of what else to take out of a UK document, with the identifiers that matter most here, is the subject of a separate guide.

If the file holds health information, our guide to special category data in AI explains why removing the name does not make the health detail any less sensitive.

What the ICO has seen go wrong with hidden content

We have not found an ICO penalty over a Word file sent to an AI tool, as at September 2026. What the ICO has published are cases where something hidden in a file, or the wrong version of a file, went out. Neither of the two below was a Word document. The lesson carries over directly, because in both the problem was a file that held more than the people sending it could see.

£750,000fine on the Police Service of Northern Ireland

9,483officers and staff in a hidden worksheet

502claimants in an unredacted Post Office deed

In August 2023 the PSNI answered a freedom of information request with a spreadsheet. The visible worksheets had been deleted, but an original worksheet remained on a hidden tab, with the surname, initials, rank and role of all 9,483 officers and staff. The ICO’s penalty notice set the fine at £750,000, and its announcement said that simple procedures could have prevented it.

The wrong version of the file

The second case is simpler and closer to what happens in a busy office. In April 2024 Post Office Limited published on its website an unredacted version of a settlement deed from the Horizon group litigation, instead of the redacted version it meant to publish. The ICO’s reprimand records that the personal data of 502 claimants was exposed.

The equivalent before an AI upload is the file called “note FINAL redacted v2” sitting next to “note FINAL v2”. Name the redacted copy so that it cannot be mistaken, keep it in a folder of its own, and upload from that folder only. It sounds too obvious to write down, and yet the ICO’s announcement called the Post Office breach entirely preventable.

Councils handle the same risk at a larger scale, and our page on how council staff can use AI covers it.

The Document Inspector, and one more read

The Document Inspector is the check Microsoft itself suggests at the end of its tracked changes page. On the copy, go to File, Info, Check for Issues, and select Inspect Document. Tick the kinds of content you want checked, select Inspect, and use Remove All on each result you do not want in the copy. Microsoft’s page on inspecting documents tells you to run it on a copy, because it is not always possible to restore what it removes.

The Document Inspector
Finds	Comments and revision marks from tracked changes
Finds	Headers, footers and watermarks
Finds	Text formatted as hidden, and objects formatted as invisible
Misses	Text hidden by other methods, such as white on white
Misses	Objects covered by other objects
Misses	A client’s name typed in the body

Source: Microsoft Support, Remove hidden data and personal information by inspecting documents, presentations, or workbooks. The last row is ours: the Inspector looks for kinds of content, not for names.

Be careful with what Remove All does. Remove All next to headers and footers removes them entirely, which is fine for a copy going to an AI tool but not for a document going back to a client. It will offer to strip the file’s properties too, author included; that layer belongs to a different job from cleaning the text, and our guide to Word and PDF metadata deals with it.

Read it once more, as a stranger would

After the Inspector, read the copy from top to bottom as if you had never seen the matter. Look for anything that would let you work out who the client is: an employer’s name with a small town, a job title that only one person holds, a date that ties to a news story. The ICO’s anonymisation glossary calls these indirect identifiers, sometimes known as quasi identifiers, and no search catches them.

Our explainer on what anonymised data really means goes through why a combination of details can matter more than any single field. If a detail like that stays in the copy, the copy still identifies the client, which is also the lesson of pseudonymisation under the UK GDPR.

What comes back when Nonimo reads a .docx

You drop the Word file into the Nonimo app and you get a pair: a covered version of the text for the chat box, and a covered copy of the file itself to download. A .docx comes back as the same Word file, covered in its title and properties as well as its text. The app pseudonymises: each person or number becomes a marker, and the names are put back when the answer returns.

The tool on this page accepts a .docx as well and gives you back the same Word file with the details covered. It has its own privacy notice.

The text half, as the Nonimo app returned it for our invented attendance note, value by value:

In the note                        What came back
Harriet Quennell                   [PERSON_1]
Brackley Foods Ltd                 [COMPANY_1]
31/04/1984                         [BIRTH_DATE_1]
485 777 3456                       [REFERENCE_1]
7 Larkspur Close, Ashby ZZ9 3ZZ    [ADDRESS_1]
07700 900781                       [PHONE_1]
h.quennell@example.com             [EMAIL_1]
Ms Quennell                        Ms [PERSON_2]

Before you drop the file in, accept the tracked changes and delete the comments, so their dates and history are gone before the file goes anywhere. Our security page says what the app stores and what it sends.

Sources

• How do we avoid an accidental breach when redacting information?, ICO, part of Disclosing documents to the public securely, published 31 July 2025: remove information from a copy and use a redaction marker; do not leave text under black rectangles.
• How do we avoid an accidental breach when personal information is ‘hidden’ in documents?, ICO: changing text colour and covering information with objects are ineffective; embedded objects can be opened by double clicking; Paste Special to keep a picture only.
• Accept or reject tracked changes in Word, Microsoft Support: No Markup only hides changes temporarily; Accept All Changes and Reject All Changes; run the Document Inspector as a final check.
• Insert, delete, or change a comment, Microsoft Support: Delete All Comments in Document from the arrow by Delete on the Review tab.
• Find and replace text, Microsoft Support: Home, Editing, Replace; Match case; Use wildcards and the table of wildcard characters; prefer Replace to Replace All.
• Word Options (Display), Microsoft Support: the Hidden text option shows a dotted line under hidden text; Show/Hide on the Home tab.
• Remove hidden data and personal information by inspecting documents, presentations, or workbooks, Microsoft Support: File, Info, Check for Issues, Inspect Document; use a copy; what it finds and what it cannot detect.
• National Insurance Manual, NIM39110, HMRC: format of a National Insurance number, final letter A, B, C or D; the specimen QQ 12 34 56 A.
• Find your NHS number, NHS website: the NHS number is ten digits, written 485 777 3456 in the example.
• Penalty notice: Police Service of Northern Ireland, ICO, October 2024, with the announcement: £750,000; 9,483 officers and staff in a hidden worksheet; incident of 8 August 2023.
• Post Office Limited reprimand, ICO, December 2025, with the announcement: unredacted settlement deed uploaded instead of the redacted version; 502 claimants; described as entirely preventable.
• Pseudonymisation, ICO: pseudonymised data remains personal data for whoever holds the additional information.
• Glossary, Anonymisation guidance, ICO: indirect identifiers are any piece or combination of information used to identify a person, also known as quasi identifiers.
• Guidance on AI and data protection, ICO, and UK GDPR Article 5, legislation.gov.uk: data minimisation, Article 5(1)(c).