That Screenshot Could Be a Compliance Problem

How often do you take screenshots?

Maybe you see an error message you need to send to IT, so you send a picture instead of typing out a long and confusing error code. If you want to show a coworker something unusual in an account they can’t access, you might quickly screenshot the information and send it over. Maybe you need to remember something for later, so you take a quick screenshot instead of writing it down.

Unfortunately, your screenshot might capture much more than you intended.

If customer information, financial records, employee data, or other Personally Identifiable Information (PII) appears on your screen, you may have just created a brand-new copy of sensitive data.

Where Did That Screenshot Go?

What system settings do you have? Depending on your device, screenshots might automatically save to your desktop, Photos folder, clipboard, or a cloud service.

Now think about what happens next.

Maybe that screenshot gets backed up to a personal cloud account. Perhaps you paste it into a chat with the wrong person. You might forget about it entirely, thereby leaving confidential information sitting in your Screenshots folder for years to come.

The original information may have been stored safely inside an approved application, but your screenshot isn’t necessarily protected by those same safeguards.

You May Capture More Than You Need

Imagine that you are having trouble with a customer account and want to show IT the error message. So, you take a screenshot of the entire window.

The error message is in the middle of the screen…but the customer’s name, email address, account number, and other information are visible around it. IT didn’t need any of that extra information to solve your problem.

It’s called data minimization, and it’s a critical concept in cyber-compliance. Collect, access, or share only the information necessary for a legitimate purpose.

If all someone needs to see is an error message, then don’t send them an entire customer record!

Screenshots Are Still Company Data

Many of us think of screenshots as a temporary file. From a compliance perspective, however, the format doesn’t make the information any less sensitive.

Think about it: Your Social Security number is still sensitive whether it appears in a database, PDF, email, photograph, or screenshot. Protected Health Information (PHI) doesn’t stop being protected simply because you captured it with the Snipping Tool.

Once you create that screenshot, you also have to think about how you store, share, and eventually delete it.

Be Careful with Screen Sharing, Too

Screenshots aren’t the only way that we accidentally display information. Video meetings create a similar problem.

What happens if you share your entire screen to show coworkers a presentation, and then an email notification suddenly appears with a customer’s full account information attached? Behind the presentation, another application containing confidential information is visible as well. When you switch windows and tabs, you may briefly expose data that no one else in the meeting is authorized to see.

These exposures might only last a few seconds, but that doesn’t mean they don’t matter.

Whenever possible, share a specific application or window instead of your entire screen. Close unnecessary applications and documents before the meeting, and consider disabling notification previews while presenting.

Think Before You Capture

Before capturing or sharing a screenshot, ask yourself:

• Is there sensitive information visible that the recipient doesn’t need?

• Can I crop or redact unnecessary information?

• Am I sending it through an approved company system?

• Where will the screenshot be stored afterward?

• Do I actually need to take the screenshot at all?

You don’t need to stop taking screenshots. Treat them like any other document containing private company information.

Conclusion

Screenshots are convenient because they can turn anything on your screen into a shareable file in seconds. That’s also what makes them so risky.

Information that was safely contained inside a protected application can suddenly end up on your desktop, in a chat conversation, or backed up somewhere you never intended.

Before you press Print Screen, look at everything you’re about to capture.

A screenshot may only take a second to create, but the sensitive information inside it can stick around much longer.