Understand privacy, secure files, safer accounts and sensible digital habits.
Open a resource to read, save or print it using the options provided.
Data protection and cybersecurity are part of everyday office work, not only the responsibility of IT. Anyone who handles emails, customer records, employee information, files, passwords, cloud storage or workplace devices can accidentally expose information or create a security risk, so the safest approach is to use only the information and access needed for the job and follow the organisation's approved procedures.
PDF · 1 pageUK data-protection law sets rules for how organisations handle information about people. Office workers do not need to memorise legislation to work safely, but they should understand that personal data must be handled lawfully, fairly, securely and only for appropriate purposes, while organisational policies determine the practical procedures staff must follow.
PDF · 1 pagePasswords protect workplace accounts, but a password alone can be stolen through phishing, malware, data breaches or reuse across different services. Strong unique credentials approved password-management tools and multi-factor authentication help reduce the chance that one stolen password will give an attacker access to workplace systems
PDF · 1 pagePhishing and social engineering try to persuade people to reveal information, approve access, send money, open malicious files or bypass normal procedures. Attackers often create urgency, authority or familiarity, so a message that appears to come from a manager, supplier, bank or Microsoft account should still be verified when the request is unusual.
PDF · 1 pageEmail is one of the easiest ways to send information to the wrong person or introduce malicious content into a workplace system. Before sending or opening an email, check the people involved, the purpose, the files and links, and whether the information is appropriate for that communication channel.
PDF · 1 pageA website can look professional and still be fraudulent or malicious, while a familiar-looking link can lead somewhere completely different from the text displayed on screen. Safe browsing means checking how you reached a site, what it is asking you to do and whether a download, sign-in or payment request makes sense before interacting with it
PDF · 1 pageCybersecurity also depends on physical security. An unlocked computer, unattended printout, lost phone or unknown USB device can expose workplace information without anybody breaking into a system remotely, so devices and documents should remain protected wherever work is carried out.
PDF · 1 pageWorking away from the office does not reduce the need to protect workplace information. Home networks, public places, travel, personal devices and shared living spaces can introduce different risks, so remote workers should use approved equipment and services and keep information protected from unauthorised people.
PDF · 1 pageMalware is software designed to damage, disrupt, spy on or gain unauthorised access to devices and information. Ransomware is a type of malicious software that can encrypt or otherwise block access to files and systems, often followed by a demand for payment, so unusual files, software prompts and security warnings should be taken seriously.
PDF · 1 pageA security incident should be reported quickly even when it was accidental and even when you are unsure whether personal data was involved. The organisation needs time to contain the problem, understand what happened and decide whether further action or formal notification is required, so staff should report facts promptly rather than trying to investigate or hide the incident themselves.
PDF · 1 pageBeing able to open a file or system does not automatically mean you should use, copy or share everything inside it. Workplace access should normally follow the need-to-know and least-privilege principles, meaning people receive the information and system access genuinely required for their role without unnecessary wider access.
PDF · 1 pageKeeping information for longer than it is needed can create privacy, security and records-management risks, while deleting information too early can breach legal, contractual or organisational requirements. Workplace records should therefore follow an approved retention schedule and disposal process rather than being kept forever or deleted simply because a folder looks cluttered.
PDF · 1 pageAI tools can help with writing, summarising, analysis, planning and many other office tasks, but workplace information should not automatically be copied into every AI service. Before using ChatGPT, Copilot or another AI tool for work, check whether the organisation has approved the service, which account or workspace should be used and what types of information are permitted.
PDF · 1 pageCyber scams do not arrive only by email. Attackers can use telephone calls, text messages, workplace chat, social media, fake websites and increasingly convincing synthetic audio or video to impersonate trusted people. An unusual request should therefore be verified through an independent trusted route, even when the voice, photograph, telephone number or video appears familiar
PDF · 1 pageCybersecurity is not a one-time setup. Workplace devices, software, accounts and files need ongoing protection through security updates, approved backups, controlled access and attention to security alerts, while recovery arrangements should be tested and managed by the organisation rather than replaced with personal copies
PDF · 1 pageThese scenarios show how data-protection and cybersecurity rules apply during ordinary office work. The safest response is usually to stop the risky action, preserve relevant information, use a trusted verification route and report the issue promptly when an incident or suspicious activity may have occurred.
PDF · 1 pageSafe office working depends on small decisions made throughout the day: checking a recipient, questioning an unexpected sign-in, locking a screen, limiting access and reporting mistakes quickly. This final page brings the main data-protection and cybersecurity checks together into one practical reference.
PDF · 1 page