What it means
Confidentiality concerns who is allowed to learn information. The required boundary depends on the information and its purpose: public opening hours and private employee records need different handling. Practitioners identify intended recipients, restrict access, and consider where copies may travel during normal work.
Encryption is one useful protection, but it is not the whole answer. A file may be encrypted on disk and still be shared with the wrong account after decryption. Permissions, recipient checks, safe sharing processes, and retention decisions all matter. Confidentiality also differs from privacy, which includes broader questions about appropriate collection and use of personal information.
AN ILLUSTRATIVE SCENARIO
A manufacturer payroll file
A manufacturer sends a payroll report to its finance team. The report is stored in a protected system, but someone creates a broadly accessible sharing link for convenience. The file's encrypted storage does not prevent coworkers with that link from reading it. The team replaces the link with named-recipient access, checks who could retrieve the earlier copy, and reviews how new reports inherit sharing settings. It also removes unnecessary personal fields from a separate management summary.
Put it to work
- Identify the information and its intended audience, then map storage locations, transfers, shared links, printed copies, and exports.
- Apply permissions and suitable encryption along those paths, and define how staff verify recipients and approve any new sharing requirement.
- Test access with both an authorized account and an unrelated test account, including inherited permissions and previously created links.
How to check your work
Show that approved recipients can retrieve the information and that an unrelated account cannot. Review the sharing record and data copies to explain the scope of that result, including what cannot be recalled.
Connect the ideas
- CIA triad
A shorthand for naming whether a loss is disclosure, unauthorized change, or downtime.
- Authorization
The decision about whether a person, device, workload, or anonymous requester may perform a particular action on a resource.
- Encryption
Transforming data so only holders of the appropriate key can read it, protecting confidentiality in transit or at rest.
- Data classification
Labeling records by the harm of disclosure, alteration, or loss so protection and retention can follow.