How to Store and Share Files Securely in a Professional Services Business
It is a Tuesday morning and someone in your team needs to send a client's signed agreement to a third party. They do what feels natural - they attach it to an email and hit send. No password, no encryption, just a PDF containing sensitive personal information travelling across the internet in plain text. This happens dozens of times a day in professional services businesses across Canterbury, and most people have no idea it carries any risk at all.
The problem is that files in transit are surprisingly exposed. Standard email is not encrypted end-to-end, which means sensitive documents can potentially be read or intercepted between sender and recipient. Beyond email, files sitting on shared drives without proper access controls can be reached by anyone in the business - including people who have no reason to see them. Under the NZ Privacy Act 2020, your practice has an obligation to take reasonable steps to protect personal information. An unsecured file transfer or a shared folder with no access restrictions can put you on the wrong side of that obligation quickly, especially if a breach is reported to the Office of the Privacy Commissioner. If you are still working out where your privacy obligations actually sit, it is worth getting across the basics before reviewing how your files are handled.
When file storage and sharing is set up properly, it mostly disappears into the background of your day. Your team sends documents through a secure sharing link rather than an email attachment. Access to client files is controlled - someone in accounts can see what they need to see, and nothing more. If a laptop is lost or stolen, the files on it are encrypted and unreadable to whoever finds it. Sensitive documents sent externally are protected by a password communicated through a separate channel, such as a text message. None of this is complicated to use once it is configured correctly - it just needs to be set up that way from the start.
The practical steps worth prioritising are: making sure your file sharing platform requires strong authentication before anyone can access it, ensuring that sensitive documents sent externally are password-protected or shared via a secure link rather than a plain attachment, and reviewing who in your business actually has access to which folders. That last one surprises a lot of business owners - access tends to expand over time and rarely gets reviewed. A good IT support arrangement includes keeping an eye on this rather than waiting for a problem to surface. For more on how managed IT support for professional services businesses handles this kind of ongoing hygiene, it is worth understanding what is typically included in a support arrangement before you need it. It is also worth thinking about what your backup arrangements look like alongside access controls, since both sit under the same privacy obligations. And if you want a broader picture of the risks, understanding where your business data actually ends up is a useful starting point.
If you are not sure whether your current setup is actually secure or just familiar, ITstuffed offers a 15-minute IT Fit Check to give you a clear picture. Book one here.