Handling Sensitive Information: What to Check Before You Share

Sensitive information is part of everyday work. It can appear in emails, documents, spreadsheets, reports, screenshots, chat messages and Gen AI prompts.

Most mistakes are not intentional. They happen in everyday moments: forwarding an email too quickly, uploading the wrong file, leaving a document on a desk or sending information to the wrong person. The cost can be more than a quick correction. Sensitive information can affect privacy, customer trust, business operations and, in some cases, lead to financial or compliance consequences.

That is why it is worth taking a moment to stop and check before you share.

What is sensitive information?

Sensitive information is any information that should be handled with care.

This includes Personally Identifiable Information (PII), which is information that can identify a person either on its own or when combined with other details. Sensitive information may include:

• names, addresses, phone numbers or dates of birth
• account numbers, payment details or financial records
• employee records or HR information
• customer documents or contracts
• internal reports, notes or business plans
• login details, passwords or access information
• screenshots that show private or internal information

Some information may not look sensitive at first. But when combined with other details, it can still identify a person, customer or organisation.

How sensitive information can be exposed

What to check before you share

Before you send, upload, forward or discuss sensitive information, pause and ask:

Do I need this information to do my job? Only access, collect or share what is needed.

Is this going to the right person? Check the recipient, attachment and message before sending.

Could someone else see it? Lock screens, clear desks and avoid leaving documents in public view.

Am I using an approved tool or process? Be careful before uploading documents, using Gen AI tools or sharing files externally.

Does this request feel unusual? Verify unexpected requests through a trusted contact method before responding.

These checks only take a moment, but they can prevent sensitive information from going to the wrong place.

What to do if something feels off

If a request feels unusual, urgent or out of place, do not rush. Check who is asking, what they need and whether the information should be shared.

Scammers may pretend to be customers, suppliers, colleagues or leaders to access sensitive information. They may create pressure, ask for secrecy or make the request sound routine.

When in doubt, verify through a known contact method or follow your organisation’s usual process.

If sensitive information has been sent, shared or accessed by mistake, report it as soon as possible. Quick reporting gives the right team a better chance to limit the impact.

Handling sensitive information safely does not need to be complicated. Before you share, take a moment to check what you are sharing, where it is going and whether it should be shared at all. That small pause can help protect privacy, customer trust and the people behind the data.