Why document templates so often lead to data breaches and what you can do about it
You’re probably familiar with this: you quickly need a holiday request form, open the template on the company drive, fill in your name and dates and click “Save”. Out of sheer habit. And now the template everyone uses contains your personal holiday request.
With a holiday request, that may not be a big deal. It’s a different matter if you suddenly find your colleague’s performance review in the template for staff appraisals. Or if the Excel template for travel expenses suddenly shows someone else’s bank details and home address. And we actually see cases like this with our clients quite often.
Why is this a data breach?
Document templates are usually stored in folders that many or even all employees can access. So whoever opens the template next will see the data someone else has (accidentally) saved there. This may well be information they shouldn’t actually know – in other words, a data breach. Not every breach has to be reported to the supervisory authority, but it always has to be assessed and documented. On top of that, cases like this are often only reported internally after days or weeks – and nobody knows whether, or who, may have looked at the data before.
The solution: .dotx instead of .docx
When working with Office files, it’s easy: Word has its own file format for templates, the Word template with the extension .dotx. Regular Word documents end in .docx.
If you open a .dotx file, Word creates a new document based on the template (the title bar will show something like “Document1”). When you save, Word asks where and under what name the document should be stored. The template itself stays as it is.
- If it is, so to speak, “your own template” – for example a holiday request form and you are part of the HR team – you’ll find instructions below on how to convert it to a .dotx file.
- If the template falls within another department’s area of responsibility, it’s best to let them know – and feel free to forward this newsletter to them.
How to convert a template:
- Open the document template and check whether it already contains any personal data. If it does, remove this data.
- Go to “File” > “Save As” and select “Word Template (*.dotx)” as the file type. Word will automatically save the template file to the “Custom Office Templates” folder.
- Then navigate back to the previous folder on your company drive and delete the old .docx template so that nobody keeps using it.
By the way, this works the same way for Excel (.xltx) and PowerPoint (.potx).
Summary:
Save your document templates as .dotx files in your template folder. That already goes a long way – and neither unpleasant things like formal warnings nor nice things like holiday requests will end up in the wrong hands.
By the way: If you come across data in your templates that doesn’t belong there, please remember that this could constitute a data breach. The usual rules for handling data breaches in your company then apply.