ShareAndGoShareAndGo

Privacy

Protecting IRD numbers and personal details before you share documents.

When a business opens its records to a buyer, an investor or an auditor, it usually thinks about commercial sensitivity: prices, margins, customer names. It thinks less often about the personal information scattered through ordinary business documents. IRD numbers are one of the most common examples, and among the most worth protecting.

This article explains where IRD numbers turn up, why removing them properly is harder than it looks, and a practical process for doing it before documents go into a data room. ShareAndGo does not remove IRD numbers or other personal details for you, so this is work to do before you upload.

Where IRD numbers hide

An IRD number is the unique number Inland Revenue issues to each customer, individual or organisation. According to the information Inland Revenue supplied for the OECD's register of tax identification numbers, it is an eight or nine digit number, written as 99-999-999 or 999-999-999, and is used for all the taxes a customer is registered for and for social policy entitlements such as KiwiSaver and student loans. The same source says Inland Revenue prints IRD numbers on tax returns, letters and notices, and that for employees the number is often shown on payslips.

In a typical business document set, that means IRD numbers appear in places nobody thinks to look:

  • Payroll reports and payslips for every employee.
  • Employee starter forms and KiwiSaver paperwork in personnel files.
  • Letters and notices from Inland Revenue in finance folders.
  • Tax returns and working papers, including those for shareholders and related entities.
  • Contractor invoices and schedules that record a payee's tax details.
  • Scanned bank or loan documents where an IRD number was supplied as identification.

Why it matters

An IRD number is the key to a person's tax affairs. Combined with a name, an address and a date of birth, which often sit on the same document, it is the kind of detail that identity fraud depends on.

New Zealand's privacy principles single out identifiers like this. Principle 13, on unique identifiers, is one of the principles the Privacy Commissioner publishes. More generally, principle 11 limits disclosing personal information beyond what is needed, and principle 5 requires reasonable safeguards against unauthorised access and disclosure. A buyer reviewing payroll costs needs the totals and the structure. It rarely needs every employee's IRD number.

Why a black box is not redaction

The most common redaction mistake is drawing a black rectangle over the number in a PDF and saving it. On screen the number disappears. In the file, the text underneath is usually still there. Anyone can select it, copy it or search for it.

This matters even more in a data room that reads text from documents. ShareAndGo reads the text of every upload, including scans, so search can find words inside documents. If a number has only been covered rather than removed, it remains in the document's text and can be found by searching for it. Proper redaction removes the underlying text, not just its appearance.

Scans have the same problem in reverse

A scanned page is an image, and a black box drawn on a scan does hide the number in the image. But if the scan was run through text recognition before the box was added, the text read from it may still carry the number. Check what text the file holds, not just what the page looks like.

A practical process

  1. Decide what the reviewer actually needs. Often a summary report or a version with personal columns removed is better than redacting the original.
  2. Search your document set for IRD numbers before upload. Search for the patterns of eight or nine digits and the words IRD number and tax number.
  3. Use a proper redaction tool, one that removes text, and apply the redactions so they cannot be undone.
  4. After redacting, open the file, try selecting text where the number was and search for the number. If anything comes up, it is not redacted.
  5. Keep the unredacted originals in your own records, not in the room.
  6. Upload the redacted versions, and use view-only access and watermarks for anything that still carries personal information.

Once documents are in a room, ShareAndGo's search is a useful final check. Search the room for an IRD number pattern you know should not be there. A result tells you a document needs replacing. Replace it with the corrected file, and remember that the room keeps version history: if you upload the correction as a new version, delete the earlier version too, and empty the recycle bin, so the original is not left behind.

Questions people ask

Does ShareAndGo redact IRD numbers?
No. ShareAndGo does not redact IRD numbers or other personal details. Redact documents with a proper redaction tool before uploading them, then use search in the room as a final check.
Is covering a number with a black box enough?
Usually not. The text underneath often remains in the file and can be copied or found by search. Use a tool that removes the underlying text.
What does an IRD number look like?
An eight or nine digit number, written as 99-999-999 or 999-999-999, according to the information Inland Revenue supplied for the OECD's register of tax identification numbers.

Keep reading

Reading scanned documents in due diligence

How text recognition turns scanned pages into documents you can search, sort and question.

Writing a data sharing agreement that does its job

The clauses worth your attention when personal or commercial information is shared with another party.

Preparing for an Inland Revenue audit with a data room

Gather the records, share copies with your adviser and Inland Revenue, and keep a record of what was seen.