How to find personal data in a Google Sheet™ before you share it

What every finding means, why it matters, and how to fix it by hand. This add-on helps with data minimisation and sharing hygiene — it is not legal advice, and it does not decide lawful basis. Where the law matters, it links to the ICO’s own pages.

Prefer to watch? The same walkthrough as a video, recorded on the live add-on, with a chapter for each step. Open it on YouTube.

The demo spreadsheet

A small company’s staff sheet with a hidden Payroll tab, a notes column with a health term, white-text NI numbers, an IMPORTRANGE and a staff-name dropdown — all synthetic data. Make a copy, open the add-on, press Check: there is something to find in 10 seconds. Make a copy of the demo spreadsheet.

Press Check and read every High card.
Open Before I share, type who it is going to, and read the badge.
Check the comments (Ctrl+Alt+Shift+A) — no scope the add-on holds can read them.
Unhide every tab (the add-on names them) and decide each one belongs in the share.
If you deleted anything sensitive, share a copy, not this file — version history keeps what you deleted.
Read the Share dialog’s “Notify people” message before you send it.
If access should end, set an expiry when you share (Workspace files).
Re-run Check on the copy before you send it.

Personal data: what’s in it

PD-01 — Email addresses

Columns where most values look like email addresses. Role addresses (info@, support@…) are counted but stay Low — they identify a function, not a person. By hand: mask the local part or remove the column from the shared copy.

PD-02 — Phone numbers

UK mobiles and landlines, +44 and international E.164, read off the display values so leading zeros survive. By hand: mask the middle digits.

PD-03 — Postal addresses

Full UK postcodes (including GIR 0AA and BFPO) and address columns. By hand: keep the outward code (CV11) and drop the rest.

PD-04 — Personal names

Column-level only: the header says names and most values look like names. It never fires on a single cell, and company names (“Acme Widgets Ltd”) are excluded by design. A name detector misses some names — unusual spellings and single names most often. By hand: pseudonymise (Person-0042) or remove.

PD-05 — Dates of birth

Header says DOB and the dates sit in a plausible range. Without the header it never fires — invoice dates are not birthdays. By hand: keep the year.

PD-06 — National Insurance numbers

Format plus HMRC’s prefix rules. Samples are always masked (QQ •• •• •• C). By hand: remove the column from anything you share — NI numbers are never needed outside payroll.

PD-07 — NHS numbers

Ten digits with a valid mod-11 check digit. Bare 10-digit numbers need a header hint — order numbers are everywhere. By hand: remove.

PD-08 — Bank details

Sort code beside an 8-digit account column, or a mod-97-valid IBAN. By hand: remove both columns. Nobody you share a staff list with needs them.

PD-09 — Payment card numbers

Luhn plus a known issuer range — Luhn alone is not enough, and order numbers that pass it stay quiet. Card numbers should never be in a sheet at all (PCI DSS). By hand: delete, then check version history — then stop keeping them in sheets.

PD-10 — Passport and driving licence numbers

DVLA’s 16-character format with its DOB-encoded section; passports only with a header hint plus 9 digits. By hand: remove.

PD-11 — Special-category data

Keyword matches on headers and short values: health, diagnosis, medication, disability, ethnicity, religion, orientation, union, convictions. Worded “may contain” — a keyword matched, and only a person can say for sure. This is the finding to take slowest. By hand: read the column, then remove or aggregate.

PD-12 — Children’s data

A DOB column where anyone is under 18, or pupil/child headers beside names. Children’s data needs extra care. By hand: remove, or aggregate to counts.

PD-13 — Pay data

Salary/pay/wage headers with a numeric column beside a name column. By hand: band it (£30k–£40k) or remove it.

PD-14 — Personal data in notes

Long-text columns scanned with every pattern; the finding names what it saw (“3 notes mention a phone number”). By hand: read each one — free text is where the surprises live.

PD-15 — Passwords and secrets

Headed secret columns and known key shapes (AKIA…, sk_live_…, AIza…). Secrets should never be in a spreadsheet. By hand: move them to a password manager, rotate them, delete the column.

PD-16 — Online identifiers

IP addresses (Low). Worth a look in access logs shared as sheets.

PD-17 — Vehicle registrations

Current UK format, header-hinted (Low).

PD-18 — Custom patterns

Pro. Your own regex plus a label and severity — employee IDs, member numbers, pupil UPNs — tested live against the sheet before saving. Keep patterns tight: a loose pattern is a false-positive machine.

Hiding places: where it is

HD-01 — Hidden tabs

Hiding a tab doesn’t hide it from anyone you share this file with. They can make a copy or download it. By hand: unhide and decide, or delete the tab — then remember version history.

HD-02 — Hidden rows and columns

Hidden or collapsed rows and columns holding flagged cells. One click unhides them. By hand: unhide, decide, re-hide nothing sensitive.

HD-03 — Cell notes

Notes travel with the file and nobody thinks to check them. By hand: right-click → delete the note, or move the content somewhere proper.

HD-04 — Disguised text

White-on-white, tiny fonts, ;;; number formats, 2-pixel columns. Still in the file, still shared. By hand: select all, reset the formatting, look at what appears.

HD-05 — Data far outside the visible area

Data past a wide empty gap (“ZZ1000”). By hand: Ctrl+End jumps to the corner of the used range — look at what is there.

HD-06 — Imported data

IMPORTRANGE and friends show another file’s data to everyone who can see this file. The add-on lists the source ids and never opens them. By hand: convert to values (copy → paste special → values only) or remove the formula.

Lists holding names or emails, and suggestively named ranges. Lists travel with the file. By hand: Data → Data validation → remove, or shorten the list.

HD-08 — Protected ranges are not private

Protection stops editing, not viewing. Everyone you share with can still read the cells. By hand: move sensitive columns to a file with narrower sharing.

HD-09 — Version history keeps what you deleted

Editors can open File → Version history and see earlier versions — including anything you deleted. This is the single most useful thing this page teaches: to share a clean version, make a copy. A copy has no version history. The Pro share-safe copy does exactly this, then redacts inside the copy.

HD-10 — Charts and pivots

Charts and pivot tables reading a hidden tab stay visible when the tab is hidden. By hand: point them at visible data or delete them.

HD-11 — Filters

Filtered-out rows are one click from visible. By hand: turn the filter off and look at what it was hiding. Filter views can’t be read by the add-on, so they are not checked: open Data → Filter views and look through each one by hand.

HD-12 — Comments (check by hand)

Comments can’t be read without full Drive access, which this add-on refuses on principle. Press Ctrl+Alt+Shift+A and read them yourself — it takes ten seconds.

Sharing: who can see it

Editors and viewers outside the owner’s domain. By hand: Share → remove anyone who no longer needs access.

SH-02 — Personal accounts on a business file

Gmail™ and other consumer mailboxes on a business-owned file. Personal accounts leave with the person. By hand: replace with their work address.

SH-03 — Large audience

More people than your threshold (default 10). Every one of them can download or copy the file. The threshold is editable in settings.

“Anyone with the link” means anyone who gets the link. By hand: Share → General access → Restricted.

SH-05 — Published to the web

Published files are readable by anyone with the published link. By hand: File → Share → Publish to web → Stop publishing.

SH-06 — Download and copy

Viewers and commenters can download, print and copy unless you switch it off. By hand: Share → the settings cog → uncheck the download option.

Editors can share onward by default. By hand: Share → the settings cog → uncheck editor sharing.

SH-08 — Access expiry

External access that never expires is how one-off shares become permanent. By hand: Share → each person → Add expiration (Workspace only).

SH-09 — Business data on a personal account

A file on a Gmail™ account holding staff or business data leaves with the account holder. By hand: Transfer ownership (Share → the person → Transfer ownership).

Subject access requests from a spreadsheet

Someone asks for “everything you hold about me” and the answer is a spreadsheet. Find a person (Pro) searches every tab — hidden ones included — notes and dropdown lists for a name, email, phone or NI number, with variants handled (+44/0, Gmail™ dots, spacing, case). Export their data builds the .xlsx to send (or to review with one); Erase clears their cells, guarded, with the version-history warning. The free tier shows the match count, so you know the scale before you pay.

Deadlines and exemptions are legal questions — the ICO’s guidance on subject access requests is the reference, not this page.

For the person your buyer forwards this to

Short answers for supplier questionnaires: spreadsheet content is processed in the user’s browser and transmitted nowhere (privacy notice, security); the add-on holds no subprocessors for file content because it never receives any; scopes are spreadsheets.currentonly + script.container.ui (“this spreadsheet only”); licence billing runs through Paddle as merchant of record. Email support@appgarden.co.uk for anything longer.

Support

Email support@appgarden.co.uk. Send a screenshot of the card, never the file.

Google, Google Sheets™ and Google Workspace™ are trademarks of Google LLC. Personal Data and Sharing Check is not affiliated with or endorsed by Google.