Why Secure Handling Matters
A spreadsheet containing sensitive information can be exposed through more than one route. Someone may open a shared folder they do not need, an attachment may be forwarded, a laptop may be lost, or an old copy may remain available after the analysis is finished. A file can therefore be at risk while it is stored, actively used, shared, or retired.
Secure handling means using appropriate safeguards throughout those stages so that data are available to authorized people for legitimate work, but are not unnecessarily exposed, altered, or lost. The safeguards should fit the sensitivity of the data and the setting in which the work is conducted. De-identification can reduce some risks, but it does not by itself make a file safe to store or share; combinations of details can still create re-identification risk.
No single setting makes a spreadsheet secure in every situation. A password, a restricted folder, or encryption can each help, but the overall workflow matters: a carefully protected original can still be exposed by an unprotected export or an overly broad sharing link. The goal is to use layers of safeguards rather than rely on one feature.
Control Access and Choose a Safe Working Location
Start by identifying which people need access to the spreadsheet for the work at hand. Give access only to those authorized people, using accounts that identify them individually. Shared accounts make it difficult to tell who opened or changed a file, and they make access harder to withdraw for one person without affecting others.
Use the least-privilege principle: provide each person only the access needed for their task. Someone who must inspect values may need view access but not permission to edit or reshare. A person responsible for updating the data may need edit access. An administrator may need to manage permissions, but that role should not be assigned casually. Review access when roles change and remove access when it is no longer justified.
This principle reduces exposure by narrowing the number of accounts and actions that could lead to disclosure or accidental changes. If a file is accessible to twenty people when only four need it, there are sixteen additional accounts through which a mistaken share, compromised account, or unintended edit could occur. Restricting access does not eliminate risk: one authorized person can still make an error, and accounts can be compromised. It does reduce the number of potential paths into the file.
Keep sensitive spreadsheets in a storage location approved for the work, such as an institution-managed system with access controls. Avoid personal email, consumer file-sharing accounts, unapproved removable drives, and public or shared computers. Protect the device used to access the file: use a strong account password, multi-factor authentication where available, automatic screen locking, and current security updates. Encryption of a device or approved storage service can help protect data if equipment or storage media is lost, but it does not prevent someone with valid access from viewing the file.
Worked Example: Setting Access for a Study Spreadsheet
A hypothetical research team has a spreadsheet of participant visit dates and measurements. The coordinator updates visit records, two analysts calculate summaries, and a project supervisor checks progress. The team is preparing to work in an institution-managed spreadsheet service.
Step 1: Assign access by task. The coordinator receives edit access because records must be updated. The analysts receive access appropriate to their analysis tasks; if they do not need to change the source records, view access is preferable. The supervisor receives view access if progress review does not require editing.
Step 2: Use individual accounts. Each team member signs in with their own authorized account. The team does not use one shared login, because that would obscure who accessed or changed the file.
Step 3: Check the location and device. The coordinator stores the file in the approved restricted workspace, not a personal cloud folder. Team members access it from protected devices and do not download it to a public computer.
Result. The file is available for the stated tasks, while unnecessary edit and sharing permissions are avoided. This does not guarantee that no exposure can occur; the team still needs to check access and use safe sharing and retirement practices.
Spreadsheet Features Are Not Access Controls
A spreadsheet may allow users to hide a sheet, hide columns, filter rows, lock cells, or protect a worksheet from editing. These features can be useful for organizing work or preventing accidental changes, but they should not be treated as confidentiality controls. A hidden sheet may be unhidden; a filter may merely conceal rows from the current view; and worksheet protection is generally designed to restrict editing, not to keep an authorized file recipient from inspecting its contents.
Similarly, a workbook password may provide some protection, depending on the file format and software, but it is not a substitute for approved storage and access management. A password does not control who receives a copy, and a weak or widely shared password may offer little practical protection. Do not rely on a password-protected workbook as the only safeguard for sensitive data. Follow the requirements of the organization responsible for the data and use its approved tools.
Copies are a particular concern in spreadsheet work. Downloading a workbook, exporting a CSV file, copying a tab into a new workbook, or pasting selected cells into an email creates another instance that may not inherit the original permissions. Before making or using a copy, know where it will be stored, who can reach it, and how it will be retired. Do not assume that deleting or restricting the original also controls its exports.
Worked Example: A Hidden Worksheet Is Not a Safe Share
A hypothetical analyst prepares a workbook for a collaborator. One worksheet contains a summary table; another contains participant-level rows. The analyst hides the participant worksheet and sends the workbook, believing the collaborator can only see the summary.
What is wrong? Hiding a worksheet changes how the workbook is displayed, but it does not reliably prevent a recipient from revealing or inspecting the sheet. The collaborator receives the participant-level data as part of the file.
Safer approach. The analyst should not use a hidden sheet as a confidentiality barrier. If the collaborator is authorized to receive only the summary, prepare a separate file that contains only the intended material, then store or share it through an approved restricted method. Check the finished file before sending it, including its worksheets and any other included content.
Why the check matters. Spreadsheet copies can retain data that are not visible in the initial view. The safe choice is to control the contents and access of the file that will actually be shared, not merely its display settings.
Share Deliberately, Not by Default
Before sharing a spreadsheet, confirm the recipient, the purpose, and the permission needed. Use the storage system’s controlled sharing function when available, assigning access to named accounts rather than creating an unrestricted link. Check whether the link allows viewing, editing, downloading, or resharing. Choose the narrowest permissions that still allow the intended work.
Avoid sending sensitive files as ordinary email attachments unless the responsible organization has explicitly approved that method and the required protections are in place. Attachments can be forwarded, saved in mailboxes, downloaded to devices, or retained after access to the original is removed. A controlled file-sharing link can make it easier to withdraw access, although it cannot undo copies already downloaded or screenshots already made.
Before a share, inspect the actual file being shared. Confirm that the intended sheet or information is included and that unintended worksheets, comments, notes, or other content are not. Be cautious when exporting or copying data: a new file may carry no access restrictions from the source. Send the file or link only through the approved channel, and verify the recipients and permissions rather than relying on an old sharing setting.
Worked Example: Replacing an Open Link
A hypothetical analyst receives a request from one authorized collaborator to review a spreadsheet. The analyst creates a link with the setting “anyone with the link can view” and sends it to the collaborator.
Identify the problem. The link is not limited to the named collaborator. Anyone who obtains it may be able to open the file, and the analyst may not know who has received it.
Correct the share. The analyst changes the link setting to access for the collaborator’s named account, confirms that view permission is sufficient, and checks that resharing is not enabled unnecessarily. The analyst sends the link through the approved communication channel and verifies that the collaborator can access it.
Check for existing exposure. Because the open link has already been created, the analyst also disables or replaces it and reviews the sharing settings for other unintended recipients. Changing the link limits future access through that route, but it cannot establish that nobody previously opened or copied the file.
Retire Copies and Handle Deletion Carefully
When a working copy is no longer needed, remove it from the places where it was created, subject to the applicable retention rules. This may include a downloads folder, a temporary analysis folder, an email attachment, a removable drive, or a second cloud location. Also remove access for people whose authorized work has ended. Do not delete records that must be retained under an applicable research, institutional, or legal requirement; when uncertain, ask the responsible supervisor or data steward.
Deletion can mean different things in different systems. Removing a file from a folder may move it to a recycle bin or trash, and a managed service may retain previous versions or backups. Those retained copies may be governed by system policies that an individual analyst cannot change. Do not promise that a file has been permanently erased simply because it no longer appears in the active folder. Follow the organization’s approved deletion process and seek support when the required outcome is unclear.
Keep a clear distinction between removing a file from everyday access and securely disposing of every retained copy. If a file was shared or downloaded, deleting the original may not remove those other copies. Ask recipients to follow the approved handling and deletion process for their copies, and do not claim that this ensures deletion unless the relevant system or process can verify it.
A Practical Handling Sequence
A repeatable sequence helps prevent routine shortcuts from becoming accidental exposures. Use the following checks whenever a sensitive spreadsheet enters a new stage of work.
Check that access is permitted for the work and identify the people who need the file.
Store and open the spreadsheet in an approved, access-controlled environment using a protected account and device.
Assign named users only the viewing, editing, or management permissions needed for their tasks.
Inspect the file contents, confirm recipients and permissions, and use an approved controlled-sharing method.
Remove access that is no longer required, handle copies according to retention rules, and use the approved deletion process.
Common Mistakes
- “The sheet is hidden, so the data are protected.” Hidden content is a display choice, not a reliable confidentiality barrier. Restrict access to the file and share a separate, appropriate file when needed.
- “The workbook has a password, so I can send it anywhere.” A password does not control where copies are stored or who receives them. Use approved storage and sharing controls, and follow organizational requirements.
- “Only one person needs the link, so an open link is fine.” Open links can be forwarded or discovered by others. Share with named, authorized accounts and check the permissions.
- “I deleted the original, so every copy is gone.” Downloads, attachments, version history, and backups may remain. Follow the approved retention and deletion process, and be precise about what has actually been removed.
Check Your Understanding
Answer in terms of the safeguards described above.
- A collaborator needs to review a spreadsheet but not change it. What permission should you consider, and why?
- Why is hiding a worksheet an inadequate way to prevent a recipient from seeing its data?
- What should you check before creating a link to a sensitive spreadsheet?
- A spreadsheet is deleted from its active folder. Give two reasons why this may not mean that every copy is gone.
- Why can exporting a spreadsheet create a new security risk even when the original file is access-controlled?