I'm working with personnel data in my job, including lots of details which I know to be sensitive and most certainly covered by GDPR.

In order to maintain compliance with the regulations while preserving the ability of our team to work on the same spreadsheets, we have hidden sheets and locked the Excel workbook every time it has been saved. This effectively obscures all personal data behind password protection.

A problem I have noticed however is that once the spreadsheet is unlocked and in use, MS Excel makes "AutoRecovery" copies of it which are accessible upon opening Excel.

I wanted to check where things stand under these circumstances - of Excel autosaves effectively leaving a copy of the document without password protection. I presume this is non-compliant, if this is the case, is the only way around this to turn off autosaving and recovery mechanisms from Excel (providing this is possible)?

Many thanks for any answers to what I hope is a fairly clear-cut question, but I can't be sure of my assumptions on the matter.

  • 1
    If anyone without a need to view or edit the sheets with the sensitive data on them has access to wherever you're storing your excel files your measures aren't appropriate and you aren't going to be compliant, password protection or no.
    – Cubic
    Commented Sep 3, 2021 at 7:48
  • @cubic Do you have a source for that? If the data is encrypted then on what basis is it non compliant? Practically, what is the difference between having access to encrypted data without the key, and not having access?
    – JBentley
    Commented Sep 3, 2021 at 8:19
  • The data is protected from unwanted access through the password protection and encryption, which I think is compliant (grateful to be corrected if that is not the case). The trouble I'm having is that Microsoft seems determined to circumnavigate that with AutoRecovery - it's here where I'm erring on the side of this being non-compliance.
    – csm98
    Commented Sep 3, 2021 at 8:30

1 Answer 1


What does your Data Protection Officer say?

It’s their role to be aware of and assess if you policies, procedures and processes comply with the principles. For the particular application is it:

  • “specified, explicit and legitimate purposes”?
  • “adequate, relevant and limited to what is necessary”
  • “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”
  • “processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures”

And can you clearly demonstrate compliance with the above?

Just a personal observation: WTF are you using a spreadsheet for what is clearly a database problem? This is several dozen steps away from best practice data security.

  • 2
    +1 for "WTF are you using a spreadsheet for"
    – Dave
    Commented Sep 3, 2021 at 10:10
  • 1
    In particular, Art 32 requires appropriate technical and organizational security measures to be implemented. What is appropriate depends a lot on context, and on a proper threat model. If the issue is that a computer might fall into the wrong hands, then full-disk encryption seems like the appropriate approach. If the concern is that a file on a shared drive might be viewed by unprivileged persons, then local unencrypted copies don't matter a lot – proper permission management on the shared folder would seem to be more important.
    – amon
    Commented Sep 3, 2021 at 14:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .