How not to leak confidential company data — and protect your job

Step by step

1. 1

   Classify the information before sharing it

   Before sending any file or data, identify its confidentiality level: public, internal, confidential or restricted. Confidential and restricted information must never leave company-approved systems without formal authorization.

2. 2

   Use only company-approved channels and tools

   Corporate email, repositories and cloud platforms sanctioned by IT are the only secure means for handling company data. Personal Gmail, personal Google Drive, personal Dropbox and the like are prohibited for corporate files.

3. 3

   Check the recipient before sending any email

   Autocomplete in the 'To' field is one of the leading causes of leaks. Before clicking send, verify the name and email address of each recipient, especially in messages with confidential attachments.

4. 4

   Never enter company data into generative AI tools

   Tools like ChatGPT, Gemini and similar ones can store and use the information you send to train models. Customer data, contracts, strategies and financial information must never be pasted into these tools without approval from the security team.

5. 5

   Avoid USB drives and personal devices

   Unencrypted USB drives and personal devices (phone, personal laptop) are blind spots in corporate security. If you need to move files, use the means approved by the company, always encrypted.

6. 6

   Be careful with printouts and physical documents

   Printed documents left at the printer, on your desk or in the regular trash are a real and frequent form of leak. Collect your printouts immediately, shred confidential documents, and keep a clean desk when you step away.

7. 7

   Do not generate public links to share internal files

   Public sharing links on cloud platforms can be accessed by anyone with the URL — including search engines. Share corporate files only with named permissions granted to authorized people.

8. 8

   If you realize you leaked data, alert IT immediately

   Notifying the security team within the first few hours is the most important action in the event of an accidental leak. The faster you escalate, the greater the chances of containing the damage. Hiding the incident worsens the legal and disciplinary situation.

Why employees cause most corporate data leaks

According to information-security reports, between 60% and 80% of data-leak incidents originate in human actions — not in sophisticated external attacks. In most cases the employee acts without malicious intent: the leak happens due to haste, unfamiliarity with the policies or simply because of digital habits formed outside the corporate environment.

The most common mistakes include: sending an email to the wrong recipient (autocomplete in the 'To' field is treacherous), attaching the wrong file, using personal Gmail or personal Google Drive to store work documents for convenience, sharing files via a public link instead of named permissions, and carrying data on unencrypted USB drives.

The growing use of generative artificial intelligence tools in daily work has created an entirely new leak vector: the employee pastes a contract, a financial spreadsheet or customer data into ChatGPT to get help — and that information may be retained by the provider, used to train models or accessed by third parties. This is a real leak, even if the employee never realizes it.

Information classification: the first step to not leaking data

Before sharing any data or document, every employee needs to know the confidentiality level of that content. Information classification is the foundation of any data-protection program: without it, it is impossible to know what can circulate freely and what requires strict controls.

Most corporate policies adopt four levels: Public (can be disclosed externally without restrictions), Internal (circulates within the company but should not leave it), Confidential (access restricted to specific teams, requires secure channels) and Restricted or Secret (access only for individually authorized people, with access tracking).

In practice, if you don't know the classification of a document you received, the rule is to treat it as Confidential until you verify with the owner. This conservative posture prevents sensitive information from being shared by mistake. Companies that implement clear classification policies significantly reduce accidental-leak incidents.

Day-to-day best practices to protect corporate data

Use only the tools and channels sanctioned by the company's IT. Collaboration platforms, corporate email, file repositories and approved management systems exist precisely to ensure data stays in controlled environments, with traceable access and managed backups.

Adopt a clean-desk policy: when you step away from the computer, lock the screen (Windows: Win+L; Mac: Ctrl+Command+Q). When you leave your desk, store confidential physical documents in locked drawers. Do not leave passwords written on sticky notes attached to the monitor. These simple practices eliminate physical leak risks that are frequently overlooked.

Before sending any email with sensitive content, make it a habit to check the recipient twice — full name and address. If possible, send the file separately from the explanatory email and confirm receipt by the correct recipient before sending more critical data. When in doubt, prefer verification by phone or a secondary channel.

Consequences of leaking company data: LGPD, dismissal and damages

The General Data Protection Law (LGPD — Law No. 13.709/2018) holds companies responsible for security incidents involving personal data. Fines can reach 2% of the company's revenue in Brazil, capped at R$ 50 million per infraction. When the incident originates in an employee's action or negligence, the company may seek recovery internally.

In the labor context, intentionally leaking confidential company data — or acting with gross negligence toward it — can constitute cause for dismissal, based on Article 482 of the CLT (subsections 'b' — incontinence of conduct or misconduct — and 'h' — act of indiscipline or insubordination). Depending on the case, there may also be a civil action for damages caused to the company or to third parties.

Beyond the legal and labor consequences, data leaks cause reputational damage to the company that can jeopardize customers, contracts and partners. In regulated sectors (healthcare, financial, legal), the impact can result in the loss of licenses and certifications. That is why protecting data is not just a legal obligation — it is a matter of professional responsibility.

What to do if you realized you leaked company data

The first and most important rule is: do not try to hide it. Accidental leaks happen to anyone, and the reaction to the incident weighs far more heavily than the mistake itself in the disciplinary and legal assessment. Immediately notifying the IT or information-security team is the action that makes the difference between a contained incident and a crisis.

Document what happened in as much detail as possible: which file or data was shared, with whom, through which channel, at what time and under what circumstances. This information is essential for the security team to assess the real impact, revoke access, notify the affected parties and meet the legal deadlines for reporting to the ANPD (National Data Protection Authority), which are up to 72 hours for incidents involving personal data.

While you wait for IT support, do not try to 'fix it yourself': do not delete evidence, do not simply ask the recipient to delete the file without a record, and do not share information about the incident with unauthorized people. Rash actions can compromise the incident response and aggravate the legal consequences for you and for the company.

Key terms

Information classification

The process of categorizing data and documents according to their degree of confidentiality and sensitivity, defining who can access them, how they can be shared and which security controls must be applied. The most common levels are: Public, Internal, Confidential and Restricted.

DLP (Data Loss Prevention)

A set of technologies and processes that monitor, detect and block the unauthorized flow of sensitive data outside the company's controlled environment — whether by email, upload to personal cloud, copy to removable devices or other channels.

LGPD

The General Data Protection Law (Law No. 13.709/2018), Brazilian legislation that regulates the processing of personal data by companies and individuals. It establishes the rights of data subjects, the obligations of organizations and penalties for security incidents, including fines of up to 2% of national revenue, capped at R$ 50 million per infraction.

Accidental leak

An information-security incident caused by unintentional human error — such as sending an email to the wrong recipient, using unauthorized tools or losing a device with corporate data — as opposed to external attacks or deliberate malicious actions. It is the leading cause of data incidents in organizations of every size.

Frequently asked questions