TL;DR:
Share with named people, not an open link, and give the lowest permission that lets them do their job.
Where the app allows it, set an expiry date, and remove access when the work is done.
Check what the recipient actually sees, and never send passwords in the same message as the file.
You need to send a contract to an outside lawyer for review. The quickest option is an attachment or a link that anyone can open. It is also the option most likely to put a confidential document in the wrong hands, because email is forwarded and links get pasted into chats. A few minutes of care at the start keeps the file in the hands of the people who should have it.
The principle: least access
Give each person only what they need and only for as long as they need it. For a reviewing lawyer that is usually the ability to read and comment, not edit or reshare. If someone needs more later, you can grant it then. Taking back access after the fact is harder.
Where the controls live
File apps differ, but most cloud storage and document apps offer the same ideas under a Share button: who can open it, what they can do, and sometimes until when. Look for these:
Who can open it. Choices usually range from named people only, to anyone in your organisation, to anyone with the link. Choose the narrowest one.
What they can do. Typical roles are viewer, commenter and editor. Start with viewer or commenter.
Reshare and download options. Some apps let you stop viewers from downloading or sharing it onward. Use them if offered, knowing that anyone who can see a file on screen can still photograph it.
Expiry. Some apps let you set an access end date. If yours does not, put a reminder in your calendar.
Activity or access list. A list of who has access, which you can review later.
Check your own app: Names and layouts change between apps and versions. Read your own app's sharing panel rather than following a menu path from an article.
Worked example: sharing a contract with an outside lawyer
You have a draft supplier contract, Supplier agreement v3, and the lawyer is at another firm. Your company has its own rules for confidential files, so check them first or ask whoever runs IT.
Check the policy: Find out whether your company wants confidential files kept in one approved app. Use that app.
Remove what the lawyer does not need: If the document has internal notes, comments or tracked changes, save a clean copy for sharing. Check the file name too:
Supplier agreement v3 (our walk away price)should not go out.Share with a name: Open the sharing panel and type the lawyer's exact email address. Do not turn on an anyone-with-the-link setting.
Set the lowest role: Choose commenter so they can mark up the text. If they need to make edits, give editor for this file only.
Set an expiry: Choose an end date shortly after you expect the review to finish, for example the Friday of the week after next. If there is no expiry feature, add a calendar reminder for the same day.
Send the message separately: Email a short note saying a file has been shared and which one. Do not include passwords or codes in this email.
Confirm access: Ask the lawyer to confirm they can open it. Look at the access list to check that only the two of you are on it.
Close it out: When the review is done, remove their access, save the final version in your own records and note the date.
Count: eight steps, and in each one the file reaches only one outside person for a limited time.
If you must send a password
Some files are protected by a password. Send the file through one channel, such as email, and the password through another, such as a phone call or an approved messaging app, so one intercepted message is not enough. Do not reuse that password elsewhere.
Keep a note of what you shared, with whom, and when. A one line log in a spreadsheet is enough, and it answers the question "who has seen this?" when someone asks months later.
Mistakes to avoid
Anyone-with-the-link on a confidential file because it is quicker.
Sharing a whole folder when you meant one file. Folder access includes everything inside, now and later.
Forgetting about old shares. Review who has access to your sensitive files every few months.
Sending a file to a similar looking address. Check the spelling of the email before pressing send.
Using your personal account for work files if your company forbids it.
Safety: This is general information and not legal advice. If the file contains personal data or legal obligations, check with your IT or legal contact or another qualified professional about what rules apply.
Doing it faster
Once your steps are settled, put them in a short checklist and reuse it. Most of the time goes into step two, cleaning the document, so keep a clean copy of any template you share often.
Frequently asked questions
Is a password protected PDF enough?
It adds a layer, but only if the password is strong and sent separately. It does not replace limiting who has the file.
How do I know the person opened it?
Some apps show activity on a file. Not all do, so ask for a reply confirming receipt.
Get started
