Setting Sharing Permissions on Spreadsheets

Why permissions deserve attention

Sharing a spreadsheet is one of the easiest things to do and one of the easiest to get wrong. A single click can give someone access to years of records, or make a file readable by anyone who obtains its link. Most online spreadsheet tools offer similar controls, even though the exact wording and menus vary. The sections below describe the general ideas rather than any particular product’s screens.

The aim is simple: give each person the least access they need to do their part, and no more. No setting guarantees safety, but sensible habits reduce the chance of an accident.

The usual roles

Online spreadsheets typically offer a few levels of access:

• Viewer. Can open and read the file but cannot change it. This is the right choice for most readers, such as someone who only needs to see a summary.
• Commenter. Can read and leave comments or suggestions but cannot directly change the contents. Useful for reviewers who should give feedback without risking the data.
• Editor. Can change the contents, often including formulas, formatting and sometimes sharing settings. Reserve this for people who genuinely need to enter or correct data.
• Owner or manager. Controls who else has access and may be able to delete the file. There should be a clear owner, and it should be someone who will still be around.

Names and exact abilities vary. Some tools let editors invite further people, which can spread access beyond what you intended. Check whether that option is on and turn it off if you do not want it.

Two ways to share

With named people. You enter the email addresses of the individuals who should have access. This is generally more controlled, as access is tied to specific accounts, and you can see exactly who has it.

With a link. Anyone who has the link may be able to open the file, sometimes without signing in. This is convenient but makes the file only as private as the link itself. Links can be forwarded, posted or saved in places you do not control. Use link sharing only for material you are comfortable with a wider audience seeing, and prefer the narrowest setting offered, such as limiting the link to people in your organization or to specific accounts.

Avoiding accidental exposure

1. Look before you share. Open the file and check every sheet, including hidden ones, for anything that should not leave your hands. Personal data such as home addresses, phone numbers, account numbers or health details deserves particular care. The broader subject of protecting personal data applies directly here.
2. Share a copy when in doubt. If only part of the data is needed, create a new file containing just that part, with values rather than links to the sensitive original. Deleting columns in a file you share is not always enough, since hidden sheets, old versions and linked data can remain.
3. Check where data comes from. A summary sheet may pull from a private sheet. Someone with access to the whole file might see both.
4. Mind the comments and version history. Comments and earlier versions can contain details you did not intend to share. Review them or share a clean copy.
5. Check which download, copy and print options viewers have. Even a viewer may be able to make a copy. If this matters, ask yourself whether the data should be shared at all.
6. Be careful with mail and chat. Pasting a link into a group chat gives access to everyone who can read it, including people added later.

Protect the account too

A permission setting is only as strong as the accounts behind it. If an editor’s account is taken over, the attacker inherits their access. Encourage collaborators to use unique passwords, ideally stored in password managers, and to turn on two-factor authentication. Be cautious with phishing emails that imitate share notifications, asking you to sign in; open files through your own bookmarks or app rather than links in unexpected messages. Review the privacy settings of your accounts occasionally, too. These basics apply to online safety in general.

Protect the content from mistakes

Not all risks come from outsiders. Collaborators make honest mistakes. To reduce them:

• Give editor access sparingly, and viewer or commenter access where possible.
• Where the tool allows, protect important sheets or ranges so formulas cannot be overwritten, and have people enter data in designated areas.
• Keep a master copy and regular file backups. Version history can help you recover a previous state, but do not rely on it alone.
• Agree on who may change structure, such as adding columns, to avoid broken formulas. Such breakage is one of the typical spreadsheet errors.

Review access periodically

Permissions tend to accumulate. People change roles, projects finish and temporary access stays in place. Put a recurring item on your weekly review or a quarterly list: open the sharing panel, check who has access and remove anyone who no longer needs it. Do the same for any open link. When someone leaves a team, remove their access promptly.

A simple rule of thumb

Ask three questions before sharing:

1. Who really needs to see this?
2. Do they need to change it, or only read or comment?
3. What is the worst thing that could happen if this reached someone else?

If the answer to the last question is serious, share less, share a reduced copy or use another method. Shared documents are valuable precisely because many people can work together, and a few minutes spent on permissions keeps that convenience from becoming a risk. When sensitive records are stored in the cloud, a thoughtful approach to cloud storage generally is worthwhile as well.