Privacy and Sensitive Data Handling
Teach every employee to recognize personal and confidential information and handle it safely from collection through disposal. Framework-neutral privacy fundamentals — PII, customer data, employee records, financial information, minimum-necessary access, safe sharing, retention, disposal, and what to do after an accidental disclosure.
What you'll learn
- Identify what counts as protected data in day-to-day work — PII, financial information, employee records, student records, citizen case files, health details, and confidential business information.
- Apply the minimum-necessary principle to data access and sharing: only the people who actually need information to do their jobs should see it, and only for as long as the work requires.
- Share data safely in cloud tools (OneDrive, Google Drive, SharePoint, Dropbox, Box) by using named-recipient sharing instead of 'anyone with the link' and by matching the permission level to what the recipient actually needs.
- Avoid the everyday disclosure mistakes that cause most privacy incidents — misdirected email, oversharing in Teams or Slack, unredacted printouts left at the printer, forwarding attachments past their intended audience, and improper disposal of paper and devices.
- Follow correct retention, disposal, and legal-hold rules — route public-records requests, disclosure requests, and legal-hold notices to the designated records or privacy officer rather than answering them yourself.
- Report a suspected privacy mistake immediately through your organization's established channel — even a small one — so the response team can contain the exposure, notify affected people where required, and close the gap in the process.
Requirements
- A workstation, laptop, tablet, or phone with a modern browser.
- Audio or captions enabled so you can follow the narrated video for each module.
- No prior privacy or legal background required — this course is designed for every employee, including customer support, sales, HR, finance, and front-line administrative staff.
Course content
7 chapters · 6 lectures · 35m total
Module 1 — What Data Needs Protection
Before you can protect data, you have to recognize it. The categories that count as protected information in day-to-day SLED and private-sector work — PII, financial details, employee and student records, citizen case files, health information, and confidential business data — and the quiet combinations that turn ordinary facts into sensitive ones.
1 item
Module 1 — What Data Needs Protection
Before you can protect data, you have to recognize it. The categories that count as protected information in day-to-day SLED and private-sector work — PII, financial details, employee and student records, citizen case files, health information, and confidential business data — and the quiet combinations that turn ordinary facts into sensitive ones.
-
What Data Needs Protection Free preview5 minutes 30 seconds
Module 2 — Collect Less and Access Less
The minimum-necessary principle in day-to-day work: only collect the fields you actually need, only pull extracts that contain only the rows you need, only share with people whose jobs require it, and only for as long as the work requires. How to practice this with reports, requests, and ad-hoc data pulls.
1 item
Module 2 — Collect Less and Access Less
The minimum-necessary principle in day-to-day work: only collect the fields you actually need, only pull extracts that contain only the rows you need, only share with people whose jobs require it, and only for as long as the work requires. How to practice this with reports, requests, and ad-hoc data pulls.
-
Collect Less and Access Less6 minutes
Module 3 — Safe Sharing and Storage
The specific sharing habits that keep protected data inside the boundary it belongs in. Named-recipient sharing instead of 'anyone with the link' in OneDrive, Google Drive, SharePoint, Dropbox, and Box. Matching the permission level — view vs comment vs edit — to what the recipient actually needs, with expirations where the platform offers them.
1 item
Module 3 — Safe Sharing and Storage
The specific sharing habits that keep protected data inside the boundary it belongs in. Named-recipient sharing instead of 'anyone with the link' in OneDrive, Google Drive, SharePoint, Dropbox, and Box. Matching the permission level — view vs comment vs edit — to what the recipient actually needs, with expirations where the platform offers them.
-
Safe Sharing and Storage6 minutes
Module 4 — Email, Collaboration, and Printing
The everyday disclosure mistakes that cause most privacy incidents — misdirected email, replies-all to the wrong thread, oversharing in Teams or Slack, forwarding attachments past their intended audience, and printed records left at a shared printer overnight. How to slow the send button down and what to do the moment you see one of these in your sent items.
1 item
Module 4 — Email, Collaboration, and Printing
The everyday disclosure mistakes that cause most privacy incidents — misdirected email, replies-all to the wrong thread, oversharing in Teams or Slack, forwarding attachments past their intended audience, and printed records left at a shared printer overnight. How to slow the send button down and what to do the moment you see one of these in your sent items.
-
Email, Collaboration, and Printing6 minutes
Module 5 — Retention, Disposal, and Lost Devices
Keep things only as long as you should, dispose of them properly when you are done, and know what to do when a legal hold or public-records request lands. Why a departing employee cannot keep their work laptop, why case-file paper has to be shredded, and why a laptop with case files left on a train is a same-hour report.
1 item
Module 5 — Retention, Disposal, and Lost Devices
Keep things only as long as you should, dispose of them properly when you are done, and know what to do when a legal hold or public-records request lands. Why a departing employee cannot keep their work laptop, why case-file paper has to be shredded, and why a laptop with case files left on a train is a same-hour report.
-
Retention, Disposal, and Lost Devices6 minutes
Module 6 — Report a Privacy Mistake
The one habit that turns a small privacy mistake into a routine incident rather than a crisis: fast, blame-free reporting to your organization's privacy contact. What to say, what not to minimize, and why 'I accidentally cc'd the whole org on something with PII' is always worth reporting.
1 item
Module 6 — Report a Privacy Mistake
The one habit that turns a small privacy mistake into a routine incident rather than a crisis: fast, blame-free reporting to your organization's privacy contact. What to say, what not to minimize, and why 'I accidentally cc'd the whole org on something with PII' is always worth reporting.
-
Report a Privacy Mistake5 minutes 30 seconds
Final Assessment
A 12-question scenario-based quiz covering all six modules. You need 80% or higher to pass and earn your completion certificate. You may retake the assessment as many times as needed.
1 item
Final Assessment
A 12-question scenario-based quiz covering all six modules. You need 80% or higher to pass and earn your completion certificate. You may retake the assessment as many times as needed.
-
Final Assessment — Privacy and Sensitive Data Handling