What is a recommended practice when handling sensitive information in email?

• A. Share sensitive data broadly to ensure transparency.
• B. Copy the data to a public drive and link it.
• C. Use need-to-know sharing, encrypt if possible, and avoid including sensitive data unless required.
• D. Attach sensitive data in plain text to the email body.

Answer: (C)

Protect sensitive information in email by limiting who can see it, encrypting content when possible, and avoiding including sensitive data unless there’s a clear need. This approach reduces the chances of accidental disclosure if a message is intercepted or accessed by unauthorized people, and it aligns with how data should be protected in transit and at rest. If you can, use secure methods such as encryption or password-protected attachments, and share sensitive details only through channels designed for secure access, or provide access to a protected portal rather than exposing data in the body of the email. When possible, minimize the data you send by redacting or summarizing what’s necessary.

Broad sharing to many recipients increases exposure and should be avoided. Storing data on a public drive and linking to it creates an open-access risk. Attaching or including sensitive data in plain text within the email body is especially unsafe because it can be read, forwarded, or accessed by someone other than the intended recipient.