Contact details in your phone. Financial records in email. Notes in documents, messages and AI chats.
Your business may hold more sensitive information, in more places, than you realise.
For many businesses, that information often spreads through ordinary work. A document arrives by email. It's downloaded, forwarded and saved. Notes are added and copies are created. Before long, the same information exists in multiple locations.
Look beyond the obvious records
Your accounting system or database is only part of the picture. Depending on your business, sensitive information might also include:
- Names, addresses, phone numbers and appointment details.
- Invoices, bank details and payment records.
- Identity documents, signatures and photographs.
- Health information, personal circumstances or confidential advice.
- Emails, meeting notes and records of conversations.
Some information may seem routine on its own. Combined with other details, it can reveal much more about a person.
Follow the information through your day
Think about one typical interaction. Where does the information arrive, where do you work on it, and where does it go next?
A document received by email might also appear in your downloads folder, cloud storage and sent items. A photo sent through a messaging app might be saved to your phone and copied into a project folder.
Check the places you use every day:
- Email inboxes, sent items and attachments.
- Desktops, downloads folders and cloud drives.
- Phone contacts, messages, photos and screenshots.
- Accounting, booking and client-management applications.
- Paper notes, printed documents and USB drives.
- Personal accounts or devices used for business.
- AI prompts, uploaded files and connected applications.
The Australian Signals Directorate recommends identifying where business information is stored, including employee devices, cloud services and removable media. Read Ten things to know about data security →
Consider who can access each location
Knowing where information is stored helps you ask more useful security questions.
Is it in a business account or a personal account? Is a folder shared outside the business? Can a contractor access more than they need? What happens if an account or device is compromised?
The goal is to understand how information moves through your business and identify where addition protection measures may be needed.
Start with one client process
Create a simple list with three columns:
| Type of Information | Where It Lives | Who Can Access It |
|---|---|---|
| Contact details | Phone, email and booking applications | People with access to each account or device |
| Documents | Email, downloads and cloud folders | People with access to those accounts or folders |
| Meeting notes | Notebooks, documents and meeting applications | People with access to each location |
Use categories rather than copying actual details into another document. Record who currently has access, including anyone whose access you may need to review.
Start with one process such as taking an enquiry or preparing an invoice and build from there.
Protect the places your client information lives
Knowing where information is stored helps you decide how to protect it. Your computer, email and cloud services each need attention.
Start with the devices you use for work. Keep them updated, protect access and use drive encryption to help protect stored information if a computer is lost or stolen.
For information in the cloud, secure your accounts with multi-factor authentication and check who can access shared files and folders. Give people access to only the information they need, and review permissions when circumstances change.
When sending confidential information, consider email encryption or a secure sharing method with appropriate recipient controls. Encryption on your computer protects stored information; it does not automatically protect a document after you send it.
Make security an ongoing practice
These protections are most effective when they are properly configured, maintained and monitored. For many business owners, finding time to do that consistently can be challenging.
Managed security helps reduce the burden of protecting your business by providing ongoing attention to devices, accounts, email and cloud services. With specialist support available to investigate alerts and respond to emerging threats, potential issues can be addressed quickly, without requiring you to manage every aspect of cyber security yourself.
Our 60 Seconds to Safety videos provide simple, practical ways you can improve cyber security, while our helpful resources offer additional guidance on protecting your business. Explore 60 Seconds to Safety →
Visit our helpful resources page for practical guides and videos.
Take the next step towards better protection
Book an appointment to discuss your current approach to cyber security, identify potential gaps and explore how our managed IT and cyber security solutions protect your business. Book an appointment →
