“Can you send the spreadsheet over?” sounds like a small job. It gets less straightforward when the spreadsheet contains every customer, the folder also holds staff contracts, or the sharing link works for anyone who receives it.
You don’t need a complicated approval process for every document. You do need a routine that makes the intended recipient, the information and the access setting clear before you press send.
Here’s a practical approach for a small team using cloud storage. The Microsoft examples show how the decisions work in OneDrive and SharePoint. Other services have different labels, so check their current instructions before assuming a setting behaves the same way.
Send the information the other person actually needs
Start with the request. If a contractor needs this month’s delivery addresses, they probably don’t need the whole customer database with payment notes and previous orders.
Make a separate working copy containing only the necessary information. Give it a useful name and open that exact copy before sharing it. This avoids the easy mistake of preparing a clean version and then attaching the original.
For personal data, secure delivery is only part of the decision. You also need a lawful basis for sharing it and must consider what people have been told about its use. The ICO’s data sharing advice for small organisations covers these responsibilities. A password on a file doesn’t make an inappropriate disclosure acceptable.
Check what the file contains underneath
A spreadsheet can look tidy while still containing information on hidden tabs, in comments or behind a summary. A document might include tracked changes that reveal an earlier draft.
The ICO’s guidance on hidden personal information explains why checking the visible page is not enough. Use the relevant inspection tools and review the finished file. Simply hiding a row or placing a black box over text is not a reliable way to remove information.
For a particularly sensitive or unusual disclosure, ask a second person to check the file. Give them a specific task, such as checking that only the agreed customer records remain. “Have a quick look” is much less useful.
Choose the recipient before copying the link
For confidential business documents, start with access for named recipients. In Microsoft’s terminology, a Specific people link limits that invitation to the people selected. An Anyone link can be forwarded and used by others. Microsoft also distinguishes links for people who already have access, which don’t grant new permissions. See its OneDrive sharing guidance.
Read the whole address before confirming it. Don’t rely on the first name in an autocomplete suggestion. If a supplier suddenly asks you to use a different address or upload portal, verify the change using contact details you already hold.
Choose viewing access when the recipient only needs to read the file. Give editing access when they actually need to change it. If you share a folder, inspect the folder contents and think about what may be added there later.
Viewing access should not be confused with preventing copies. Microsoft describes additional controls in its external sharing guidance. Download restrictions, expiry options and other controls depend on the service and your settings. Check what is available and test it. None of this changes the need to trust the recipient with the information they can see.
Try a harmless file first
For a new client or supplier, our practical suggestion is to test the sharing route with a document containing no sensitive information. Ask them to confirm that they can open it using the intended account.
This is especially useful when the recipient works across several organisations and has more than one sign-in. Fixing an access problem before the deadline reduces the temptation to switch to an unrestricted link in a hurry.
Don’t test a confidential link by forwarding it to an unrelated personal account. Use an approved test account or work with your administrator. Write a short note beside the process explaining who can help when a recipient gets stuck.
Give temporary access an end date
When a project ends, someone should review the shared material. Record the file or folder, who it was shared with, why they need it and when access should be checked. A diary reminder may be enough for a small number of occasional exchanges.
Microsoft’s sharing and permissions instructions explain that access can come from a link, a direct permission or a parent folder or site. Removing one link may leave another route open. Check the full access list with your administrator if it is unclear.
Revoking access does not retrieve a copy somebody already downloaded. Agree how recipients should keep or delete information where that matters, and choose what you share on that basis from the start.
If the wrong person gets access
Tell your IT or data protection contact promptly. Record which file was involved, when it was shared and who may have opened it. Ask the authorised person to remove inappropriate access and assess the exposure. Keep relevant messages and logs.
If personal data was involved, use your breach response process to assess reporting obligations. Don’t assume deleting a link resolves everything, or wait for the recipient to reply before raising the incident internally.
For your next routine exchange, make the check simple: the right file, the right person and only the access they need. Put that reminder where people share documents, rather than burying it in a policy they rarely open.