How to Strip Personal Data From a PDF Before Sharing It
- privacy
- metadata
- security
When a bank loses loan applications and account-opening forms as PDFs, the lesson for everyone else is simple: every PDF you send or store carries more than its visible page. Before sharing one, remove hidden metadata, permanently redact what is not needed, and password-protect copies that must travel.
What happened with the State Bank of India PDFs?
On 21 October 2026 the State Bank of India told the stock exchanges it had identified 3,897 customer records containing personal information inside a set of about 375,000 records circulating on the dark web, according to The Hacker News. The bank called its count preliminary and has not confirmed that the data is authentic.
The person claiming responsibility said the data included 2,722 PDF documents such as loan applications and account-opening forms. The bank has not said whether those PDFs were part of its review, and it has not named a cause. Treat every figure as unverified.
The listed categories were names, mobile numbers, dates of birth, email and home addresses, branch and customer ID numbers, and loan-lead metadata. The bank did not list account numbers, balances or passwords.
You cannot prevent a breach at a company that holds your documents. You can control what is inside the PDFs you create and send yourself.
What is hidden inside a PDF besides the visible page?
A PDF stores document properties alongside its pages: the author, the title, the software that created it, and the creation and modification dates. Many files also carry an XMP block, a second copy of that information that some tools leave behind when you edit the visible fields.
A PDF exported from a word processor often carries the account name of whoever saved it. A scan from an office copier can carry the device's software name. Neither shows on screen, but both travel with the file. The PDF specification itself defines this: a document information dictionary with fields such as Title, Author, Creator, Producer and dates, plus an optional XMP metadata stream.
How do I remove hidden metadata from a PDF?
The Clean Metadata tool on ilovspdfs removes the author, title, creator software, timestamps and the XMP block. It runs in your browser, so the file is not uploaded.
- Open the Clean Metadata page and add the PDF.
- Run the tool and download the cleaned copy.
- Keep the original in a safe place, and send only the cleaned copy.
- Open the cleaned file's properties to confirm the fields are empty.
Metadata cleaning changes only metadata. A name typed in the text, a visible detail in a scan, or EXIF data inside an embedded image is not removed by it.
Does a black box or deleting metadata remove sensitive text?
No. Cleaning metadata does nothing about the page content, and a shape drawn over text hides it only visually. If a form contains an ID number or an address the recipient does not need, remove it for real with Redact PDF, which is also free and also runs in your browser.
| Problem | What fixes it | Tool |
|---|---|---|
| Author or software name in properties | Strip metadata | Clean Metadata (free, in browser) |
| Sensitive text on the page | Permanent redaction | Redact PDF (free, in browser) |
| File must be sent over email or shared link | Password protection | Protect PDF (Pro, server) |
Do the steps in that order: redact first, clean metadata last, so a later edit does not write fresh properties into the file.
How do I protect a PDF I have to send?
When a document with personal details must reach someone, add a password so that a forwarded or intercepted copy is not readable by default. Protect PDF is a Pro tool: the file is sent over HTTPS, processed in memory and not stored, and uploads are capped at 4 MB. Share the password through a different channel than the file, for example by phone.
A password protects a file in transit. It is not a reason to keep documents you no longer need. If a form has served its purpose, delete your copies.
What else should I do with PDFs that hold personal data?
- Send the fewest pages needed. Use a page-removal or extraction step so the recipient gets only what they asked for.
- Keep copies out of shared folders with broad access.
- Delete old application forms and scans once the process is finished.
- If your own data may be in a breach, watch for messages that quote real details, and contact the organisation through a number you look up yourself.
Key facts
- On 21 October 2026 the State Bank of India reported 3,897 customer records with personal information within a set of about 375,000 on the dark web.
- The claimant said the data included 2,722 PDF documents; the bank has not confirmed this.
- The bank was alerted on 16 October 2026 by CERT-In and the Defense Cyber Agency.
- Clean Metadata and Redact PDF are free and process files in your browser without uploading them.
- Protect PDF is a Pro tool with a 4 MB upload cap; files are processed in memory and not stored.
- Metadata cleaning does not touch page content or images inside the PDF.
Frequently asked questions
Can someone find my name in a PDF I never signed?
Yes, if the author field was filled by the program that created the file. Cleaning the metadata empties that field, but any name typed on the page stays.
Is removing metadata the same as redaction?
No. Metadata is the hidden document properties; redaction removes visible content from the page. A sensitive file often needs both.
Does cleaning metadata change how the PDF looks?
No. Text, images and pages stay the same. Only the document properties and the XMP block are cleared.
Should I upload sensitive PDFs to an online tool?
Prefer tools that process the file in your browser, as the free tools on ilovspdfs do. For server-side tools such as password protection, check that the service states it uses HTTPS and stores nothing.
Has the State Bank of India confirmed the PDFs were leaked?
Not as of its 21 October notice. The bank has not said whether the claimed PDFs were part of its review, and it has not confirmed the data is authentic.