What are an individual employee's day-to-day duties for handling personal data, and what counts as mishandling it?

Most data protection failures do not begin with a sophisticated cyberattack. They begin with an ordinary employee making an ordinary mistake while handling personal data in the course of their job. Because of this, day-to-day responsibilities for personal data rest with every individual who touches it, not only with privacy officers or IT staff.

Your everyday duties

Whatever your role, a few habits cover most of what you are expected to do with personally identifiable information (PII):

• Collect and use only what you need. Access personal data because your job requires it, and use it only for the purpose it was collected for.
• Keep it where it belongs. Store records in approved systems and shared locations, not on personal devices, personal email, or unmanaged cloud accounts.
• Verify before you send. Double-check recipients, attachments, and reply-all chains before sharing anything containing names, contact details, or sensitive identifiers.
• Lock it down. Use strong authentication, lock your screen, and protect printed material. Do not leave records visible on desks or screens.
• Dispose responsibly. Retain records for as long as the applicable retention schedule requires, then dispose of them through approved channels. Shred paper; do not just delete or discard.
• Speak up. Report suspected exposure, loss, or unauthorized access promptly. Early reporting limits harm.

These habits reflect widely recognized privacy principles such as purpose limitation, data minimization, and accountability, which are reflected in frameworks like the NIST Privacy Framework.

What counts as mishandling

Mishandling is any action, or inaction, that puts personal data at unnecessary risk or uses it improperly. Common examples include:

• Sending PII to the wrong recipient or to an unsecured address.
• Looking up records out of curiosity or for personal reasons rather than a work need.
• Storing or moving personal data to unauthorized systems or removable media.
• Keeping records long past their required retention, or destroying them too early.
• Leaving sensitive documents unattended, unencrypted, or improperly discarded.
• Failing to report a known incident.

Intent is not required. An honest accident that exposes data is still mishandling and still carries consequences, which is why careful daily habits matter. Government employees handling covered records also operate under specific legal duties, including those in the Privacy Act of 1974.

For more guidance, explore the privacy and PII topic hub.