How to Stop Leaking Private Data in Your Attachments

When you email a file—whether it is a Word document, a PDF, or a photo—you are sending more than just the content you can see.

You are also sending metadata.

Metadata is the "digital fingerprint" hidden in the background of a file. It records who created it, when it was edited, what software was used, and sometimes exactly where the file was created.

Historically, ignoring metadata has led to massive security failures.

In 2005, the BTK serial killer Dennis Rader was caught because he sent a floppy disk to the police. The Microsoft Word metadata on that disk listed the author as "Dennis" and the organization as his local church.

Similarly, in 2012, Vice magazine accidentally revealed the location of John McAfee, who was on the run from authorities. They posted a photo of him without scrubbing the file first. The image’s EXIF data contained the exact GPS coordinates of his location in Guatemala, leading to his arrest.

While you likely aren't running from the law, accidental data leaks can damage your negotiations or client trust. If you send a proposal to a prospect without cleaning the file, the metadata can reveal previous versions of the document, internal "Track Changes" comments you thought were hidden, or the exact date and time the file was actually created. Fortunately, removing this data is simple, but you must use the right method for each file type.

For Microsoft Office (Word, Excel, PowerPoint): Go to File > Info. Click Check for Issues and select Inspect Document. If the tool finds "Document Properties and Personal Information," click Remove All.

For PDFs: Use the "Sanitize" or "Redact" tool inside your PDF editor (like Adobe Acrobat or Foxit). This is the only way to remove deep-level data like revision history or hidden text.

For Photos: On Windows, right-click the image file and select Properties. Go to the Details tab and click Remove Properties and Personal Information to wipe location data. Make this a standard step before sending contracts or legal documents outside your organization.

Make this a standard step before sending contracts or legal documents outside your organization.