Filling official forms privately: keep your ID numbers off other people's servers

When a site asks you to upload a PDF, the file leaves your device and is written to a server's disk or object storage. It is processed there, usually queued, often copied to a temporary bucket, and a link to the result is handed back to your browser. Along the way the request is logged: source IP, timestamp, file name, size, sometimes a hash. Those logs are frequently kept longer than the file itself, and they are what gets subpoenaed, leaked or sold.

"Files are deleted after one hour" is a promise, not a mechanism. You cannot verify it, the CDN in front of the service may have cached the result, the backup snapshot taken at 03:00 may still hold it, and a subprocessor in another jurisdiction may be doing the actual conversion. None of this requires anyone to be dishonest — it is simply what server-side processing looks like. The only way to be certain a file was not stored is for it never to be sent.

Under the GDPR, a national identification number, an address and financial details are personal data, and health information is a special category with stricter rules. Uploading a form full of them to an unknown processor is a decision about someone's data — yours, and often your children's or your employer's. It deserves the same care as choosing where to store the paper original.

There are three ways to fill a PDF form that never involve an upload. A desktop reader — Adobe Acrobat Reader, Preview on macOS, Okular, or the built-in viewer in Firefox and Chrome — can fill and save most AcroForms. A local script with a library such as pdf-lib or a command-line tool can do it repeatably. Or a browser tool that does the work in the page itself, which is what FormFlatten is: the PDF is read by JavaScript running in your tab and the result is assembled in memory on your device.

The claim is easy to check, and you should check it rather than take anyone's word. Open your browser's developer tools, switch to the Network tab, and fill and download the form: a local tool makes no request carrying your file. A blunter test works too — load the page, turn off Wi-Fi, and keep working. FormFlatten keeps functioning offline because everything it needs, including the pdf.js worker and the embedded font, is served as static files up front.

A filled form can carry more than the answers you see. Hidden and zero-size fields hold values that no reader displays but any parser can read. Read-only fields may contain a reference number that identifies the copy you were sent. And if the form was previously filled by someone else and saved incrementally, older revisions of the object may still exist in the file — PDF's incremental update mechanism appends changes rather than rewriting the document.

Metadata is the other half. A PDF's document information dictionary and its XMP packet routinely contain the author name from the account that created the file, the software used, and creation and modification timestamps. If you filled the form in a desktop reader, your own name may now be in there. Flattening removes fields but not metadata; a rasterised export removes both the field remnants and any leftover text, at the cost of file size and selectable text.

Before you send anything, open the finished file once more and look at it as the recipient will: scroll every page, check that read-only fields say what you expect, and confirm nothing you cleared has reappeared. It takes half a minute and catches the mistakes that matter.

Keep two files, not one. The flattened PDF is what you send; the filled but still editable PDF is what you keep, because next year's version of the same form will ask for the same twenty answers. Exporting the values as JSON is even lighter: a few kilobytes of field names and answers that can refill the form in one click, and that you can store in a password manager or an encrypted folder instead of leaving a copy of your ID number in a downloads directory.

Name files so you can tell them apart six months later — form-name-2026-09-filled.pdf and form-name-2026-09-flattened.pdf beats two files called document(3).pdf. And when the submission is done, delete the copies you no longer need, including the ones in your email Sent folder if the organisation has its own portal.

If the form must be printed, print the flattened version. An interactive form printed from a reader that ignores appearance streams comes out as an empty template, and you will not notice until the counter clerk points at it. Check the print preview, not the on-screen form. If a signature is required on paper, print, sign and scan — but then you are back to sending an image, so prefer the flattened digital copy when the recipient accepts one.

Some forms genuinely cannot be handled outside Acrobat — dynamic XFA is the usual culprit — and a few require a qualified electronic signature that only a national eID service can produce. Those are the moments to use the official channel rather than a workaround. For everything else, the honest default is simple: fill it on your own machine, flatten it, check it, send it, and never let the file take a detour through somebody else's server.