How to Handle Sensitive Information at Work

To handle sensitive information at work, do four things every time: know which information needs extra care, keep it only in the places your employer approves, check who will receive it before you send, and remove it when the job is done. Most leaks are not attacks. They are an ordinary person, on an ordinary busy day, putting the right file in the wrong place or sending it to the wrong name.

This guide is for people who start a job and are handed access to customer lists, payroll sheets, contracts or medical forms without much explanation. You do not need a technical background. You need a few habits and the patience to use them when you are in a hurry, because that is when they matter.

One note first. Every employer has its own rules, and the law differs by country and by industry. Where this guide says "your policy", it means the information handling rules your employer gives you. If you cannot find them, ask your manager or the person who looks after IT or compliance. When we mention a rule-setting body, it is only so you know what to search for in your own country.

Which information needs extra care

Not everything in your inbox is secret. A lunch menu is not. A list of customers with phone numbers is. The first skill is telling the two apart quickly.

Ask three questions about any piece of information:

Does it identify a person? Names with addresses, ID numbers, bank details, health details, salary, performance notes.
Would it hurt someone if a stranger read it? A customer, a colleague, the company.
Did someone trust us with it? Customer data, supplier prices, a draft contract, a client's own files.

If the answer to any of these is yes, treat it as sensitive. Many companies use labels such as public, internal, confidential and restricted. If yours does, use the label. If it does not, use your own judgement and ask when you are unsure. Asking costs a minute. A leak costs much more.

Here is a worked example. Say you work in the office of a small dental clinic. A patient emails to move an appointment. The email has a name, a phone number and a note about a tooth problem. That note is health information, which most countries protect more strongly than a phone number. You should keep that email in the clinic's patient system, not forward it to a personal address and not paste it into a chat with a friend. The appointment time alone is less sensitive. The tooth note is what makes the whole email sensitive.

A good habit: when you open a file, take two seconds to ask what is the worst thing in it. Treat the whole file by that worst thing.

Storing files where they belong

Your employer gave you approved places to keep work files: a shared drive, a document system, a customer database. Use those. Do not use these:

Your personal email, even "just to work from home tonight".
A personal cloud folder.
A USB stick that has no company owner.
The desktop of a shared computer.
A messaging app group that includes people outside the team.

Why does it matter? The approved places have backups, access lists and logs. If an employee leaves, the company can remove their access. If a laptop is stolen, the company knows what was on the shared drive and what was not. A file in your personal cloud folder is outside all of this. The company cannot protect it, and cannot even find it when a customer asks, "where did you keep my data?"

Two more storage habits help. First, keep one copy, not five. Every extra copy is another place to protect and another place to forget. Link to the file instead of attaching it. Second, name folders by purpose and give access to the people who need it. If the whole company can open the folder called "Payroll", the folder is wrongly set up. Tell the owner.

When you are not sure where something belongs, do not make a new place. Ask. A new "temporary" folder usually lives for years.

Sending to the wrong person

Sending to the wrong person is the most common leak in offices, and almost everyone does it once. Email programs help the mistake along by filling in the address after you type two letters. Two people called Lindiwe in the same company, and the file goes to the wrong one.

Build a short check before you press send:

Read the "To" line aloud, name by name, before you attach the file.
Look at the part after the @ sign. Is it your company, or a customer, or a look-alike?
Check the attachment name and open it once if you are not sure it is the right one.
If a message has many names, ask whether each person needs it.

For sensitive files, send the link instead of the file, and add the recipient only when you have checked the address. If a mistake happens anyway, speed matters more than shame. Our guide on what to do after sending an email to the wrong person gives the steps: tell someone in the first minutes, ask the recipient to delete it and confirm, and write down what was in it. Reporting early protects you. Most employers care far more about a fast report than about the original slip.

Be careful with "Reply all" and with copied names. A message copied to the whole department can carry a salary or a complaint to forty people in one second.

Sharing files that expire

Sometimes you must share a file with someone outside the company: an accountant, a client, a supplier. Attaching it to an email leaves a copy in several mailboxes forever. A share link is better, if you set it up with care.

When you create a share link, check four settings:

Who can open it. "Anyone with the link" is the weakest choice. "Only named people" is better.
What they can do. View only is usually enough. Do not give edit rights without a reason.
When it ends. Set an expiry date that matches the job, for example one week.
Whether a password or sign-in is needed.

After the job, remove the link. Many people forget this step. A link that was meant for one week is still open two years later, and nobody remembers it exists.

Example: you send a signed contract to a client. You pick "only named people", view only, expiry in ten days. Next week you check that the client downloaded it and you close the link. The client has the copy. The company does not leave a door open.

Redacting properly

Sometimes you must share a document but hide part of it. You may black out an ID number before sending a form to a supplier, or remove names before showing a case to a trainee. This is called redaction, and the common way of doing it is wrong.

If you draw a black rectangle over text in a PDF or a document, the text is usually still under the box. Anyone can select it, copy it and paste it. Real redaction removes the text. Use the redaction tool in your PDF program, apply it, and save a new file. Then check your work: try to select the area, search for the hidden words, and open the document properties. Files also hide information in places you do not see, such as comments, tracked changes, author names and earlier versions.

Our guide on how to redact a PDF so it cannot be undone goes through the method step by step. The short rule is this: after redacting, search the file for a word you removed. If the search finds it, you have not finished.

Screens, desks, paper and printers

Not every leak is digital. Think about what a visitor, a cleaner or a person in the next seat on a train can see.

Lock your screen when you stand up, even for one minute. On most computers there is a keyboard shortcut for this, and it takes one second.
Keep a clear desk at the end of the day. Papers with customer details go in a locked drawer or a shred bin.
Do not read sensitive documents on a train or in a cafe where the screen faces other people.
Collect your print jobs straight away. A page left in the shared printer is a page anyone can read. If your printer supports "release at the printer" with a card or code, use it.
Do not put sensitive papers in the ordinary bin. Use the shredder or secure bin your office provides.

A short example. A receptionist prints a visitor list with names and company details, and forgets the page in the tray. Another visitor picks it up while waiting. No hacker was involved. Nothing in this story needs technology to fix; it needs the habit of walking to the printer when you press print.

Keeping and deleting records

Keeping information forever is also a risk. The longer a file lives, the more chances it has to leak, and the more it costs to protect. Your employer's records policy says how long different kinds of documents must be kept. Some must be kept for a period set by law or by tax rules in your country. Others should be removed when the purpose ends.

Practical rules:

Follow the retention schedule if your employer has one. If you do not know it, ask.
Do not delete things that are under a legal hold or an investigation, even if they look old.
Do not keep personal "just in case" copies of customer data.
When the time comes, delete properly. Moving a file to the recycle bin is not deletion. Paper goes to the shredder. Old devices go back to IT, not to a drawer or a second-hand shop.

If you hold a copy of a file that should have been removed long ago, tell the owner of that process. Finding it is better than having someone else find it.

AI chatbots and connected apps

Many workers use chatbots to summarise a text, fix a spreadsheet formula or draft a reply. These tools can be useful. They also create a place where company information can go. Anything you paste into a public chatbot leaves your company's control. Depending on the tool and its settings, it may be stored or reviewed by the provider.

Simple rules that work for most workplaces:

Use only the tools your employer approves, with a work account. Do not use a personal account for work data.
Do not paste customer data, employee data, passwords, contracts or unpublished results into a public tool.
If you need help with a real document, replace the real details with placeholders first. Write "Customer A" and "Amount X" instead of the true names and numbers.
Read the answer critically. A tool can state wrong things with confidence.

Our guide on whether you can paste customer data into an AI chatbot at work explains how to use placeholders and what to do if you already pasted something you should not have.

Connected apps work in a similar way. A calendar tool, a note app or a mail add-in may ask for permission to read your files or your inbox. Each permission is a door. Allow only what the tool needs, and remove access for tools you no longer use. If an assistant tool can read your whole mailbox, it can read the confidential mail in it too.

Your own footprint online

Information you share about yourself also matters at work. Attackers read social media to find the names of colleagues, the name of your manager, your holiday dates and the tools your company uses. They then write a message that sounds believable.

Take ten minutes to look at what your public profiles show. Remove the photo that shows your staff pass. Think before posting a picture of your desk, your screen or your office layout. Switch off location sharing for apps that do not need it. Our guide on how to stop apps sharing your location shows where to look on a phone.

If someone targets you online, for example with repeated abusive messages, keep the evidence and report it rather than answering. Our guide on how to deal with online harassment and keep evidence covers how to capture messages in a way a platform or the police can use. If it involves a colleague, tell your manager or HR as well.

Common mistakes

These are the mistakes we see most often, and each has a simple fix.

Treating a label as the whole answer. A file marked "internal" can still contain a customer's health note. Look inside.
Using personal tools for speed. The shortcut saves ten minutes and creates a risk the company cannot see.
Trusting the autofill. Always read the recipient line.
Sharing and forgetting. Open links and old permissions stay open until someone closes them.
Hiding with a black box. A drawn rectangle is not redaction.
Keeping everything. Old copies become the file that leaks.
Staying quiet after a slip. The slip is small. The silence makes it big.

Quick reference

Before you store: is this the approved place? Before you send: did I read every name? Before you share: who, what, until when? Before you redact: did I search for the hidden text? Before you leave the desk: is the screen locked and the paper put away? Before you paste into a tool: is this tool approved, and are the real details removed? Before you keep: do I still need this?

Questions people ask

Is it a problem if I send a work file to my personal email so I can finish at home?

In most workplaces, yes. Your personal mailbox is outside the company's controls, and the file may stay there long after you leave. Ask whether your employer offers a secure remote option, such as a company laptop or a remote desktop, and use that.

What should I do if I think I put the wrong file in a shared folder?

Remove it or restrict the folder if you can, then tell the folder owner or your manager straight away and say what the file contained. Do not wait to see whether anyone noticed. A quick report lets the company decide whether anyone needs to be informed.

Who sets the rules for personal data where I work?

It depends on the country and the industry. Many countries have a data protection authority, and some industries, such as health or finance, have their own regulators. Your employer's privacy or compliance contact can tell you which rules apply to your job. Follow your employer's written policy first.

Can I use an AI tool if I remove the names from the text?

Removing names helps, but small details can still identify a person or a company. Use only approved tools, replace real details with placeholders, and follow your employer's policy. If the policy is silent, ask before you use it.

How do I know how long to keep a document?

Your employer should have a retention schedule that lists document types and how long to keep each. It is often set by tax, employment or industry rules where you work. If you cannot find it, ask your manager or the records or compliance team.

Learn this in five minutes

The track "Classify, Store and Share Information" in the DefSafe app turns this guide into short lessons. You practise spotting sensitive information, choosing the right storage, checking recipients, setting share links to expire and redacting files properly. Each lesson takes about five minutes on your phone.