Remote working has become a reality for many companies, especially since the COVID-19 pandemic. This arrangement offers flexibility and can boost productivity, but it also brings specific challenges, particularly in document management. Consequently, ensuring security, efficiency and compliance when managing documents remotely requires care and attention. This article examines the main precautions for effective document management when remote working, covering security, accessibility, compliance and good practice.
Essential precautions for effective document management when remote working
Information security
- Protecting sensitive data:
Data protection is fundamental in any working arrangement, but it becomes even more critical when remote working. Companies must protect sensitive data through encryption, both in transit and at rest. Likewise, they should implement restricted access policies, ensuring that only authorised employees can view or edit sensitive documents.
Using a VPN: Virtual private networks (VPNs) are essential to protect communication between remote workers’ devices and company servers. VPNs encrypt the data transmitted, thus protecting it against interception.
Multi-factor authentication (MFA): Multi-factor authentication adds an extra layer of security by requiring several forms of verification before granting access to document management systems. As a result, it significantly reduces the risk of unauthorised access.
Accessibility and efficiency
Cloud-based platforms: Cloud-based document management platforms provide secure and efficient remote access to documents. In addition, these platforms offer features such as scalable storage, automatic backups and real-time synchronisation, making collaboration easier for distributed teams.
Intuitive interface: An intuitive, easy-to-use interface is crucial to ensure that remote workers can find and manage documents without difficulty. Equally important, proper training in the use of document management platforms helps employees maximise efficiency.
Collaboration tools: Collaboration tools, such as document sharing, comments and simultaneous editing, are essential to maintain productivity and effective communication between team members working remotely.
Legal compliance
Regulatory compliance: Companies must ensure that document management in a remote working arrangement complies with all applicable regulations, such as the General Data Protection Regulation (GDPR) in the European Union. This includes implementing privacy and data protection policies that address the specific challenges of remote working.
Audits and monitoring: Carrying out regular audits and monitoring document access and use are essential practices for ongoing compliance. Furthermore, companies should keep detailed records of all document-related activity, including who accessed, changed or shared each document.
Good practice for remote workers
Secure workspace: Remote workers should set up a secure, private workspace, shielded from prying eyes. This includes, for example, using strong passwords, enabling screen lock and adopting safe practices for disposing of paper documents.
Continuous training: Ongoing training for workers in cybersecurity and document management is essential so that they know best practice and new threats. To this end, companies should offer regular courses and workshops that reinforce the importance of security and compliance.
Regular backups: Backing up regularly is an essential practice to prevent data loss. Companies should therefore set clear policies on backup frequency and methods, ensuring that all important documents are copied and stored securely.
The legal framework for remote working
In Portugal, remote working is governed by Articles 165 et seq. of the Labour Code, as amended by Law no. 83/2021. Among other things, the law requires a written agreement, states that the employer must provide the necessary equipment and systems, and provides for compensation of the worker’s additional expenses.
The law also protects the worker’s privacy. For this reason, remote monitoring of activity must respect the principles of proportionality and transparency. In practice, the company may log access to the document management platform for security purposes, but it must not use permanent surveillance tools, such as continuous screen capture or an always-on camera. Workers must also be informed about the logs kept and their purpose.
Paper documents at home
Even when remote working, many employees still handle paper documents. The company should therefore set clear rules:
- avoid printing documents containing personal or confidential data;
- keep documents in a locked place, out of reach of third parties;
- never throw confidential documents in household waste;
- return documents to the company for secure destruction;
- record when important originals leave and return.
Practical example: A remote validation team
Consider a team of five people validating contractor documentation from home. At first, some employees downloaded documents to their personal computers to review them at leisure.
To solve the problem, the company provides managed laptops, enables multi-factor authentication and blocks document downloads outside the platform. Next, it sets up viewing and validation directly in the browser. Finally, it runs a short training session on phishing and screen sharing during video calls. As a result, the team stays productive and the company reduces the risk of data leaks.
Checklist for document management when remote working
- Written, up-to-date remote working agreement.
- Company equipment with an updated system and encrypted disk.
- Platform access with multi-factor authentication.
- Permissions limited to what each role needs.
- Rules for paper documents and printing.
- Automatic, tested backups.
- Procedure for reporting security incidents.
- Regular cybersecurity training.
Common mistakes to avoid
The most frequent mistake is allowing personal computers to be used without any control. In that case, the company does not know whether the device has antivirus software, updates or encryption. Another mistake is storing documents in personal cloud storage services, outside the official platform. In addition, many companies overlook the risks of public Wi-Fi networks and video calls with a shared screen. Finally, without a clear procedure, incidents are reported late or never.
Remote working and document management policy
Rules scattered across emails are easily forgotten. It is therefore advisable to bring the guidelines together in a remote working policy approved by management. This policy should state which platforms may be used, how documents are accessed, which data may be processed off-site and how to report an incident.
The policy should also define each party’s responsibilities. The company provides equipment, systems and training. In turn, the worker follows the rules, protects their credentials and immediately reports any lost equipment or suspected unauthorised access. Lastly, the policy should be reviewed periodically, especially when new tools or new threats emerge.
Indicators to monitor
To find out whether the measures are working, it is worth tracking a few simple indicators and reviewing them periodically with the IT team:
- percentage of users with multi-factor authentication enabled;
- number of devices without security updates;
- security incidents reported per quarter;
- participation in cybersecurity training sessions;
- documents downloaded outside the platform, where this can be measured.
Frequently asked questions
Can workers use their own computer?
Yes, if there is an agreement, but the company should set minimum security requirements. Wherever possible, however, it is preferable to provide company-managed equipment.
Can the company monitor remote workers?
It may log access and operations on its systems for security reasons, in a proportionate and transparent way. However, permanent surveillance is prohibited.
What should be done if a company laptop is lost or stolen?
The worker should report it immediately. The IT team then blocks access and, if personal data is at risk, the company assesses whether it needs to notify the CNPD within 72 hours.
Do the rules also apply to working in public spaces?
Yes, and even more so. In cafés, on trains or in coworking spaces, it is advisable to use privacy screen filters, avoid open Wi-Fi networks and never leave equipment unattended.
Conclusion
Document management when remote working requires a meticulous and comprehensive approach to ensure security, efficiency and compliance. Companies should adopt advanced technologies, such as VPNs and multi-factor authentication, and follow good cybersecurity practice to protect sensitive data. In turn, cloud-based platforms and collaboration tools improve accessibility and efficiency. Meanwhile, regular audits and ongoing worker training help ensure legal compliance. With a well-defined strategy, it is possible to maintain effective and secure document management, even in a remote working context.
Read also: How document management platforms support remote working.
For more information on personal data protection, see the Portuguese Data Protection Authority (CNPD).