Sharing a sensitive document safely: a practical checklist

Share less, clean the file, pick a channel you can switch off, check the recipient, then close access. In practice: send only the pages needed, redact a copy and flatten it, use a link with an expiry date, and note what you sent. A sent file cannot be unsent, so every check comes before you press Send.

Legal points come from the EU GDPR. Practical advice comes from the UK regulator (ICO), France's CNIL and the US Federal Trade Commission (FTC). This is not legal advice. Sources checked in September 2026.

What does the checklist look like?

Does the recipient need the whole document?

Often, no. Article 5(1)(c) of the GDPR says personal data must be limited to what is necessary. That is data minimisation, and it applies to a file you send. The ICO's data sharing checklist asks: what is the minimum data you can share to achieve the aim? Jane Example sends a supplier contract to an outside auditor. He needs the amounts and the dates. He does not need the signatory's home address or mobile number.

• Send an extract: the three pages that matter, not all forty.
• Mask the rest: third-party names, ID numbers, bank details, signatures.
• Or swap names for labels such as Employee 1. That is pseudonymisation. The European Commission says such data is still personal data under the GDPR if the person can be re-identified. But it is less exposed.

How do you remove what the recipient should not see?

Redact a copy, with a tool that removes the text instead of covering it. The ICO's July 2025 guidance says not to cover information with black rectangles and leave the text underneath: a recipient can reveal it by pasting the PDF into Notepad. One method it describes is to convert the redacted PDF to a simple image format and back: the pages become pictures, with nothing under the masks. Then test. Copy the text of the final PDF into a text editor and search for a masked name.

Then look for what you cannot see. The ICO lists metadata such as the author's name, comments, tracked changes, invisible text and embedded files. In Word, the Document Inspector removes comments, revision marks, document properties and hidden text. Microsoft highly recommends running it on a copy, because removed data cannot always be restored.

Link with an expiry date, or email attachment?

Prefer a channel you can switch off. An attachment stays in the recipient's mailbox, and in every mailbox it is forwarded to. The ICO compares unencrypted emails to postcards: they can be read at any one of the servers they pass through. The FTC tells US businesses that regular email is not a secure method for sending sensitive data.

• Best: a link for named people, with sign-in and an expiry date. You can cut access, but not recall a downloaded copy.
• Second best: an encrypted attachment. A wrong recipient gets a file they cannot open.
• Avoid: a plain attachment, or a link open to anyone. It works for whoever it is forwarded to.

Check what your plan allows, as of September 2026. Microsoft's OneDrive help says link expiry dates and passwords are only available to Microsoft 365 subscribers, and that Specific people limits access to the people you name. Google's Drive help says expiry dates are only available for eligible work or school accounts.

How do you make sure it reaches the right person?

Email mistakes are a classic. The ICO says it has seen hundreds of breach reports where a sender misused the BCC field. Its data sharing checklist is blunt: you must ensure you are giving the information to the right recipient. Autocomplete does the rest: you type Jan, and the mail program offers the wrong Jane.

1. Type the address, then read it in full, domain included.
2. Turn off address autocomplete, or treat its suggestions as guesses.
3. Set a short send delay. The ICO lists both options.
4. Several recipients? Send separate emails. BCC hides addresses, not content.
5. New or changed address? Confirm it by phone first.
6. High-risk file? Ask a colleague to check the recipient and the attachment.

What do you do after sharing?

Close access when the job is done. Article 5(1)(e) of the GDPR says identifiable data should be kept no longer than is necessary. Let the link expire, or switch it off. Delete the copy on the transfer platform: the CNIL lists failing to plan that deletion, preferably automatic, among the things not to do. Where a contract allows, ask the recipient to delete the file too.

Then write one line in a log. The ICO's checklist says to note what you shared and why, with whom, when and how. Under Article 5(2) of the GDPR, the controller (the organisation that answers for the data) must be able to demonstrate compliance. Article 30 puts the categories of recipients in the record of processing. Under Article 15, a person can ask who the recipients of their data are. The ICO also advises keeping labelled copies of the redacted and unredacted versions.

A tool can take over the slowest step, the redaction. Pick one that removes text instead of covering it, exports a flattened file, and does not upload your original. ONYRI Sanitize is one option: it works inside your browser and always exports a PDF or PNG made of images. Its detection is not exhaustive, so review the preview and keep your original, which the tool cannot restore. Masking reduces exposure. It does not by itself make a document anonymous.

Frequently asked questions

Sources & references