If a coworker shares a file containing confidential data, what is the appropriate course of action?

If a coworker shares a file containing confidential data, what is the appropriate course of action?

• A. Delete it and ignore
• B. Share only with supervisor
• C. Do not share; follow policy and report as needed
• D. Post to company chat

Answer: (C)

Handling confidential data responsibly means following the organization’s privacy policies and escalation procedures whenever sensitive information is exposed. When you see a coworker share a file with confidential data, the right move is to stop any further sharing, and report the incident through the proper channels outlined in policy—such as informing your supervisor or the designated security/privacy team and filing any required incident report. This ensures the situation is contained, the right people assess the risk, and appropriate remediation steps are taken, all while preserving evidence for accountability and compliance. Deleting or ignoring the incident, or posting the data in a chat, would risk further exposure and violate policy. Limiting disclosure to just a supervisor might bypass formal reporting and monitoring processes that guide proper response, and sharing broadly would violate confidentiality and legal requirements.

Handling confidential data responsibly means following the organization’s privacy policies and escalation procedures whenever sensitive information is exposed. When you see a coworker share a file with confidential data, the right move is to stop any further sharing, and report the incident through the proper channels outlined in policy—such as informing your supervisor or the designated security/privacy team and filing any required incident report. This ensures the situation is contained, the right people assess the risk, and appropriate remediation steps are taken, all while preserving evidence for accountability and compliance.

Deleting or ignoring the incident, or posting the data in a chat, would risk further exposure and violate policy. Limiting disclosure to just a supervisor might bypass formal reporting and monitoring processes that guide proper response, and sharing broadly would violate confidentiality and legal requirements.