Every business creates sensitive information every day: client records, contracts, financials, staff details, legal advice and commercially confidential material. Protecting it used to be mostly about keeping outsiders out. Now it’s just as much about who inside the business can see it, and what your AI tools can do with it.
Microsoft 365 makes working together easy. But after years of files piling up, generous permissions and everyone sharing in their own way, sensitive information often ends up visible to far more people than it should be. Nobody may have deliberately shared a document with a particular person, yet they can still reach it through an open SharePoint site, an inherited permission, a Teams channel or a link that was shared with “anyone”.
Copilot raises the stakes
Microsoft 365 Copilot only works with information the user is already allowed to access. It doesn’t hand out new permissions. What it does do is make that information much easier to find, summarise and reuse. So oversharing problems that have quietly existed for years suddenly become very visible. If someone can open a sensitive file, Copilot may be able to draw on it too, depending on the controls you’ve set up and the protection on that file.
The question to answer first
Before you turn on Copilot, or roll it out further, can you say with confidence what sensitive information you have, where it lives, who can get to it, and what should happen when someone tries to share or use it?
If the honest answer is “not really”, you’re in good company. Most businesses are in the same spot.
Two risks, inside and out
- Internal exposure: staff, contractors or teams can see sensitive information they don’t need for their job.
- External disclosure: sensitive information gets emailed, shared, downloaded or otherwise leaves the business when it shouldn’t.
Good access and sharing controls are still the starting point. On top of that, Microsoft Purview Sensitivity Labels and Data Loss Prevention add a consistent layer of policy that can classify content, tell people how to handle it and enforce the rules across Microsoft 365.
Sensitivity Labels
Labels give content a clear classification such as Public, Internal, Confidential or Highly Confidential. Depending on how they’re set up (and your licensing), they can add visual markings, encryption and restrictions on what people can do with a document or email. The label stays with the file as it moves, so the protection goes with it.
Data Loss Prevention (DLP)
DLP spots sensitive information and steps in when someone tries to do something risky with it. A policy can warn the user, ask them to justify it, alert an administrator or block the action outright. It works across Exchange Online, SharePoint, OneDrive and Teams, and Microsoft also offers DLP controls for Microsoft 365 Copilot and Copilot Chat, again depending on licensing and setup.
A sensible way to get there
Through Kinetics Group’s Information Protection and Copilot Readiness service, we help businesses put a proportionate foundation in place without getting in the way of people doing their jobs. It covers:
- a discovery workshop on your most important information, the business risks, access, sharing and licensing
- a practical classification and labelling framework
- setting up and testing the agreed Sensitivity Labels and DLP policies
- looking at both internal oversharing and external disclosure
- Copilot-specific controls and readiness recommendations
- handover for your administrators, guidance for users and next steps
To be clear, labels and DLP don’t replace well-managed permissions, proper site ownership and good information governance. But together they give you a solid base for protecting sensitive data and rolling out Copilot responsibly. You can read more about the service here.
Want to know who can really see your sensitive files before Copilot does? Book a free health check, or call us on 0800 688 768.