Everyone is responsible for protecting personal and sensitive data, which is essential to the University’s teaching and research. Email is quick and convenient, but also one of the easiest ways to send such data in error. Protecting it should be part of our everyday working practices.
University email on Nexus365 now includes tools that help safeguard information by detecting certain types of data and prompting you to review messages before sending.
Why did I get an alert while drafting an email?
Whilst drafting your email, the system detected certain data that might be personal or sensitive, either in the email itself, in any attachments, or within messages you are forwarding.
In some cases, you might not see the alert as a pop-up while typing. Instead, you may have received an automated email notification advising you that such data has been detected.
What to do if you think you have had a data breach
The Information Compliance Team (ICT) manages all data breaches involving personal data, which is any information that relates to an individual, directly or indirectly. If you have experienced a breach, or think you might have, email data.breach@admin.ox.ac.uk as soon as you become aware of it, as time is critical.
Visit the Staff guidance on personal data breaches for more information.
Can you recall an email sent by accident?
If you have recently sent the email, you can try and recall it. We recommend using Outlook on the web to do this, even if you usually access your email in another app.
Follow Microsoft’s step-by-step guide: Recall an Outlook email message - Microsoft Support.
Top tips for safe emailing
- Send only what’s needed: Include only the necessary recipients, attachments, and information. Before forwarding, check if the whole email chain is required
- Protect others’ privacy: Use BCC when emailing multiple people who don’t know each other, or when their addresses should not be shared
- Share links instead of attachments: Use Microsoft’s built-in tools to share files securely. Setting expiry dates and managing access helps you stay in control of shared information
- Secure sensitive files: – When a shared link can’t be used, protect attachments containing personal data with a strong password, and send the password by a separate method
Did you know... 53% of reported data breaches at the University of Oxford happen through email.
What if it’s a false positive?
The alerts are based on algorithms and Microsoft policies, which can result in false positives. If you’re sure the content is fine, you can ignore the alert. Alerts contain an option to report a false positive. Using it creates a log entry so the policy can be reviewed.
If you are receiving frequent alerts
Frequent alerts mean the system is regularly detecting personal or sensitive data in your emails. You will still be able to send your email if you choose to. If you receive alerts often, this can be frustrating, but they exist to protect everyone in the University. These reminders are there to encourage you to think about how you handle personal and sensitive data and find safer ways to share it.
How does it work? Am I being watched?
The email system automatically checks for patterns that match University data policies. It is not monitored by a person, and no one is “watching” you type. While you are drafting, the system scans for certain text patterns and flags them to you automatically.
Further information and guidance
Did you know... All University staff must complete the online data protection and information security awareness training course every year.
