When a spreadsheet link exposes more than you intended

The spreadsheet was meant for one delivery partner. Its link was set to allow anyone with the address to open it. A staff member forwarded that link into a wider group, and now nobody can confidently describe the audience. This is a common kind of hypothetical failure worth rehearsing because the file itself may look entirely ordinary.

The problem is the combination of content, permissions and distribution. A link that is difficult to guess is not the same as a recipient-specific access decision. The business needs to understand who could reach the information and what the available evidence shows.

As of 22 October 2026, the main DPDP duties are scheduled for 13 May 2027 under the commencement notification. The response below is practical guidance, with existing reporting and sector requirements assessed separately.

Restrict the route and preserve useful facts

An authorised administrator should review the sharing setting and take appropriate containment action. That may mean restricting the audience, revoking a public link or moving the operational process to an approved location. Coordinate changes so essential work can continue safely where possible.

Record the prior setting, when it was active, the file owner and the known distribution route. Preserve relevant logs and messages through an approved process. Do not circulate the exposed file to a larger investigation group merely to show what happened.

If a supplier controls the platform, ask what access history is available and how long it is retained. Distinguish a missing log from evidence that nobody opened the file. A service may not provide enough information to establish the complete audience.

Examine the file beyond the visible sheet

Identify all relevant personal data, including other tabs, hidden columns, comments and attached or linked material. The intended view may show only names and delivery areas while the workbook contains phone numbers, addresses or notes elsewhere.

Check whether the file was a live source or an export. A live source may have changed while the link was exposed, so today’s contents may not fully describe the earlier exposure. Record the relevant versions where available.

A hypothetical meal delivery business shares a weekly route file. A hidden tab includes older customers who cancelled months ago. Those records were not needed for the delivery task, but they may still be part of the incident assessment. Necessary operational sharing and unnecessary historical retention should be examined separately.

Do not confuse public access with the public-data exclusion

The Act’s section 3(c)(ii) excludes personal data made publicly available by the individual, including where they caused it to be made public, or by a person legally required under Indian law to make it public. An accidental public link created by the business does not automatically satisfy that exclusion.

Similarly, discovering the link through a search engine would not establish that the individuals voluntarily made their information public. The legal question concerns how the data became public and who made it so, not merely whether it could be found online.

This distinction prevents an incident team from treating an exposure as a convenient reason that protection no longer matters.

Assess the event and reporting routes

The personal data breach definition in section 2(u) is relevant to unauthorised or accidental events compromising confidentiality, integrity or availability. Establish what occurred and what remains uncertain, including possible edits where the sharing setting allowed more than viewing.

Covered entities must separately assess the CERT-In Directions, which require reporting specified cyber incidents within six hours of noticing or being brought to notice. Future DPDP Rule 7 has its own initial information and detailed update stages. Closing the link does not remove the need to assess those obligations.

If recipients are known, an authorised request to stop using and delete an unintended copy may be part of containment. Record responses, but do not treat an unanswered message as proof of deletion or assume it reaches unknown downstream recipients.

Change the sharing habit that caused the exposure

Create a small operational export containing only what the recipient needs. Prefer controlled access appropriate to the platform and task, with an owner who can review or revoke it. Set a review or expiry process where supported and appropriate.

Before sharing, ask a colleague to test the recipient experience without using the owner’s account. Check the audience, permission level, tabs and content. This is a recommended verification step, not a prescribed statutory ritual.

Keep the decision record and update the team instruction. The goal is to make the approved sharing route easy enough that staff use it, while ensuring that a convenient link does not silently become an indefinite distribution channel for the entire customer history.