Data Loss Prevention (DLP): Sensitive data policy alerts
Email is quick and convenient - but it's also one of the easiest ways for sensitive data to be sent in error. Nexus365 now includes built-in tools that help protect information automatically by spotting certain types of data and prompting you to double-check before sending.
On this page
- Why did I get a sensitive data policy alert?
- Top tips for safe emailing
- What to do if you think you've had a data breach
- What if it's a false positive?
- Guidance for people receiving frequent alerts
- How does it work? Am I being watched?
- Further information and guidance
Why did I get a sensitive data policy alert?
Whilst drafting your email, the system detected information that might be sensitive. Don't worry - an alert doesn't mean a data breach has happened. It's just a nudge to make sure youre comfortable with what you're sending and who you are sending it to.
An alert does not mean a data breach has occurred. It's there to help prevent one.
Top tips for safe emailing
- Send only what's needed - Include only the necessary recipients, attachments, and information. Before forwarding, check if the whole email chain is required.
- Protect others' privacy - Use BCC when emailing multiple people who don't know each other, or when their addresses shouldn't be shared.
- Share links instead of attachments - Use Microsoft's built-in tools to share files securely. Setting expiry dates and managing access helps you stay in control of shared information.
- Secure sensitive files - When a shared link can't be used, protect attachments containing personal data with a strong password, and send the password by a separate method.
Did you know... 53% of data breaches at the University happen through email?
What to do if you think you've had a data breach
If you have recently sent the email, you can try and recall it. We recommend using Outlook on the web to do this, even if you usually access your email in another app.
Follow Microsoft's step-by-step guide: Recall an Outlook email message - Microsoft Support.
To report a data breach or get guidance on personal data breaches for staff, visit: Staff guidance on personal data breaches
What if it's a false positive?
Sometimes the system can be overcautious. If you're sure the content is fine, you can ignore the alert. Policy alerts contain an option to report a false positive. You can do this when you next receive an alert, and a message will be sent for review.
If you are receiving frequent alerts
Whenever sensitive content is detected, an alert will appear. You'll still be able to send your email if you choose to. If you receive alerts often, this can be frustrating, but they exist to protect everyone in the University. These reminders are there to encourage you to think about how you handle sensitive data and find safer ways to share it.
How does it work? Am I being watched?
The email system automatically checks for patterns that match defined sensitive data. It isn't monitored by a person, and no one is “watching” you type. While you're drafting, the system scans for certain text patterns and flags them to you automatically.
Further information and guidance
Stay safe on email | Information Security
Tips on staying safe when using email.
Email management | Information Security
Practical guidance on managing email effectively and securely.
Do the online training | Information Security
Complete your mandatory annual information security training.
Need help?
Contact the Service Desk for support.