In today’s business world, confidential information is abundant and an important obligation for organizations to keep safe. From patient lists and pricing data to employee information, trade secrets and financial reports, companies must uphold their privacy obligations or they can experience a damaging information leak or fines for non-compliance.

Why is it Important to Protect Confidential Information?

Failure to protect confidential information from being disclosed can cause a multitude of problems for organizations:

Personal and workplace information

  • Loss of Business: When confidential information is mishandled, it can create a sense of distrust with customers and clients, which hurts a company’s bottom line.
  • Criminal Activity: When confidential information is misused to commit criminal activity, such as fraud, it inadvertently tarnishes a company’s reputation.
  • Loss of Competitive Edge: When business plans, intellectual property or trade secrets are unlawfully disclosed, it puts companies at risk of losing their competitive edge.
  • Decreased Morale: When confidential employee information is stolen, shared or disclosed without consent, it deteriorates employer trust, confidence and loyalty.
  • Privacy Law Compliance: The Personal Information Protection & Electronic Document Act (PIPEDA) is the federal law in Canada that establishes rules for how companies can collect, use and disclose information about individuals. When organizations or employers fail to protect confidentiality, they can face hefty legal fines for non-compliance.

Examples of Workplace Information

Confidential workplace information is generally broken down into five categories:

  • Employee Information: This can include an employer disclosing confidential identifying information, such as an employee’s Social Insurance Number, home address, telephone numbers, e-mail addresses, log-in and password information, prior surnames, driver’s license number, sensitive medical or disability information, and more.
  • Management Information: This can include documentation regarding private employer/employee relations issues or disciplinary actions, planned layoffs or redundancies, workplace investigations of employee misconduct, salary and contract negotiations, and other employment-related information.
  • Company Information: This can include proprietary information or trade secrets that give a company an edge over its competition, including details regarding confidential commercial processes, ingredient formulas and secret recipes, third-party supplier lists, business plans and agreements, financial data, budgets and forecasts, product development, intellectual property, passwords and log-ins, marketing strategy, research, and more.
  • Customer Information: This can include protecting confidential information, such as client or customer lists, contact information, financial information, driver’s license numbers, Social Insurance Numbers, and more.
  • Professional Information: This applies to various professions – such as medical, legal and accounting services – with information including client lists and contacts, patient diagnoses and treatments, tax and income information, privileged communications and related advice, and more.

9 Ways for Protecting Confidential Information in the Workplace

Here are nine practical information security measures that all companies should practice to protect business confidentiality and minimize the chance of a serious breach:

  1. Develop an Information Destruction Policy

    An information destruction policy is a formal, company-wide, written policy that directs employees to securely dispose of documents when they are no longer needed. Instead of disposing of information in a trash can or recycling bin, an information destruction policy will review what types of data must be destroyed and how, so that confidential information remains protected and isn’t improperly disclosed.

  2. Sign Non-Disclosure Agreements

    A best practice that all companies should implement is having non-disclosure agreements with employees, contract workers, service providers, suppliers, investors or any third parties that have access to confidential information. A non-disclosure agreement can ensure that individuals do not distribute or disclose secret information or intellectual property. This formal confidentiality agreement can also prevent unnecessary legal circumstances from arising.

  3. Limit Access to Confidential Information

    Providing limited access to confidential data on a need-to-know basis can prevent a serious breach from occurring. When granting access, employers should keep records of what confidential information has been disclosed and to whom. This permission should also be revoked upon project completion, termination of employment or when access is no longer appropriate.

  4. Provide Regular Employee Training

    Employees who are educated to identify risks can also limit potentially damaging situations to a company, its stakeholders and reputation. When an employer invests in ongoing training, information security becomes rooted in a business by its employees who understand the obligation of properly disclosing and protecting confidential information.

  5. Plan Periodic Audits of Waste Systems

    Follow-up employee training with periodic audits of recycling bins and trash cans throughout the workplace to ensure that appropriate disposal protocols are being followed 100% of the time. When document disposal procedures are clear and convenient, there is no reason to find confidential information in employee blue bins.

  6. Establish a Clean Desk Policy

    Leaving confidential documents within view of prying eyes makes them more susceptible to theft. By establishing a clean desk policy, all employees must clear their workspaces at the end of each day and contain all documents, files, notes and removable electronic media, such as USB devices, in locked file cabinets for extra protection.

  7. Safeguard Confidential Information with a Visitor Policy

    Every company should have a proper visitor policy in place to protect its employees and guests, as well as trade secrets, intellectual property and other confidential information. All organizations, for example, should require visitors to check-in and check-out, sign a non-disclosure agreement, wear visitor badges and be accompanied by an employee for the duration of their visit while on company property.

  8. Utilize Off-site Document Storage

    Storing confidential information within the workplace increases a company’s chance of a purposeful or accidental information leak. By storing documents off-site with a third-party records management service, confidential information is securely contained and managed with around-the-clock surveillance and strict safety protocols. Organizations also have the ability to set predefined access control lists to restrict who can request and receive electronic copies of physical documents in storage to prevent unauthorized access of confidential information. When documents reach the end of their lifecycle, a records management service can carry out secure destruction to maintain government record-keeping requirements and ensure company confidentiality.

  9. Hire a Shredding Service to Destroy Confidential Information

    Properly destroying confidential information is critical for any company, but it can be a complex, expensive and time-consuming process when handled in-house by employees. Outsourcing document shredding and media destruction to a professional service provider not only frees up valuable time and resources, but it also keeps organizations compliant with privacy laws and provides protection to all parties to avoid a confidential information leak.

Maintain Workplace Confidentiality with Blue-Pencil

One of the best ways to protect workplace confidentiality is to partner with a reputable document security company, like Blue-Pencil. Starting with a full review of your current process, our company can create an information management strategy for your business along with a destruction policy that’s supported by employee training and regular audits. Our team can also handle all aspects of secure destruction, records management and electronic file retrieval, so you spend more time focusing on your business and less time managing confidential information.

To quickly identify your company’s biggest security gaps, take Blue-Pencil’s Information Security Risk Assessment today or contact us for a free quote.