As an MCA, you handle sensitive information. Files that contain Market Center financial data, Social Security Numbers, tax IDs, or other types of personal identifiable information (PII) are all sensitive information you work with on a daily basis. Data security is crucial to protecting the Market Center and fostering trust with agents and clients. This guide provides some best practices for sharing files on Google Drive while safeguarding sensitive data.
Best Practices for Google Drive Files
When you share Google Drive files, follow these simple rules:
- Addresses are better than links: Share your files to specific email addresses rather than creating links that can be accessed by anyone with the link or anyone in the organization.
- Permission wisely: Restrict editor access to only those who should be allowed to make changes to the document. If they do no need to be able to make changes, set their permission to viewer or commenter. Utilize the option to “Add Expiration” for individuals who only need access for a limited time.
- Force a copy: When sharing templates you have created, share as a forced copy so they do not accidentally share sensitive information or PII with you mistakenly.
- Review Access Regularly: Choose a day at least quarterly if not monthly to review who has access to Google Drive files that contain sensitive information. Remove email addresses you do not recognize and anyone who no longer needs access to files.
On the next pages you will find more detailed instructions for sharing and creating forced copy links that will help you protect files stored in your Google Drive:
Share Google Drive Files
1. To share a file, right-click on the file to bring up the menu.
2. Click Share from the menu, and click Share again to bring up the sharing panel.
- Avoid using the “Copy link” button from this menu, as it will not allow you view or change permissions on who can view the link.
3. Once the sharing panel is open you can edit the general access for the document. This should be set to Restricted, meaning that only specific people who have been granted access can use the link.
|If you change the access to either "everyone in your organization" or “Anyone with link,” it is essential that you remove any PII such as Social Security Numbers, tax IDs, or financial data from the file first.|
4. Add the recipient email address for each individual you wish to share with in the “Add people and groups” section.
5. Choose the appropriate permission level for each recipient. Here you can also add an expiration time and date when permissions will be removed for the individual.
- View - allows users to see the file or folder but not make any changes.
- Comment - permits users to view the file and leave comments but not make edits.
- Edit - Grants users the ability to view and make changes to the file or folder.
- Owner - Provides full control, including sharing and deleting the file or folder. There can be only one owner and it defaults to the file’s creator. This is not an option when sharing but is a title you will see the owner on the sharing panel.
6. If you choose the “Add Expiration” option from this menu, it will add a expiration date to this individual’s permission. The default is 30 days from the date added, but this can be edited by clicking the pencil button on the expiration line.
7. Once you have added the individuals, you can add a message (optional), and can trigger a notification to the recipients by checking the Notify people box and typing in the provided box. Click Send when ready.
Sharing with a Forced Copy
A forced copy share is a way to share a document while making sure the original stays the same. It ensures that everyone who opens it gets their own copy to work on, without overwriting the original. This is very handy when sharing a template to a larger group of people without giving them sharing permission. However, this is not recommended as the standard way to share documents and as with all document sharing, PII still needs to be protected.
|Remove all Social Security Numbers, tax IDs, financial information or other forms of PII before sharing the template.|
1. Bring up the share panel and edit the general access settings to Anyone with link.
- As mentioned earlier in this guide, before a document is set to this level of access all PII needs be removed.
2. Once the access is updated, click the Copy Link button, which will copy the link to your computer's backend clipboard.
3. You will then need to paste the link somewhere you can edit it such as a Microsoft Word document or your device’s Notepad.
4. You should have a link that looks like this, only with the document type and document ID already filled in:
5. Change the last part of the link from “/edit?usp=sharing” to “/copy” to look like this:
6. You can now share that link with anyone who needs access to the template, and they will be prompted to make their own copy of the document, as seen in the below: