File permissions, and why most of your staff can open most of your files

August 2026 · 4 min read · Datawise Consulting, Hobart

Does the whole office really need to be able to open, or change, the organisation’s financial records? In many small organisations it can, and nobody decided that it should.

Permissions are usually set thoughtfully in the week the server is installed. Then somebody needs a folder urgently and is added to it, a team is restructured and the groups are never revisited, and the result is a shared drive on which most staff can open most things, payroll and board papers included.

Why this matters more than it used to

Under the Notifiable Data Breaches scheme, an organisation covered by the Privacy Act that has a data breach likely to result in serious harm must notify the individuals affected and the Office of the Australian Information Commissioner.

Where personal information sat somewhere everyone could reach, the breach you have to describe becomes far larger and harder to draw a line around.

Ransomware is the second reason. It runs with the permissions of whichever account it infected, so if that person can reach every folder on the server, so can the ransomware.

A short test you can carry out yourself

Choose three files that ought to be restricted: the payroll spreadsheet, the folder of employment contracts, the board papers. Then ask somebody from an unrelated part of the organisation to try opening them.

If any of them opens, the permissions on that folder are not what everybody assumed.

Share permissions and folder permissions

On a Windows file server, two sets of permissions apply. Share permissions decide who can reach a shared folder across the network. File and folder permissions (NTFS) decide what each person can do with what is inside it. Share permissions are the key to the house; folder permissions decide which rooms you may enter once you are inside.

The two work together, and the more restrictive of them wins. A common approach is to leave share permissions fairly open and set the tighter restrictions on the folders themselves.

Share permissions do not apply to someone working directly on the server, for example through a Remote Desktop server. There, the folder permissions are the only control.

How permissions should be structured

• Permissions are given to groups, not to individuals. A person joins a group and the group holds the access. Done the other way around, every staffing change becomes a folder-by-folder exercise.
• Groups follow roles rather than projects. Project groups accumulate indefinitely, because access is rarely withdrawn once a project ends.
• The default is no access. People have access because it was granted deliberately, not because it was inherited from a folder three levels further up.
• Sensitive material is separated at the top level. Payroll, human resources and board papers should not sit inside the general share with an exception applied.
• Permissions are checked regularly. Once or twice a year, somebody confirms that the groups still match who works here and what they do.

Shared passwords undo all of it

Permissions are attached to user accounts, so they are only as strong as the passwords on those accounts. Where a password is shared, anyone who knows it has the access of the person it belongs to, and a locked-down finance folder makes no difference if the password to a finance account is common knowledge around the office.

The same problem in SharePoint, OneDrive and Google Drive

Cloud storage carries the same problem, and adds one of its own in sharing links. A link created to send a single document to a client can still work years later.

Check whether external sharing is enabled by default, whether links expire, and whether staff can create an “anyone with the link” share without approval. In a Microsoft 365 tenancy left on its default settings, the answers often surprise the owner.

Putting it right without getting in the way of the work

The pressure in a working office is always to grant access rather than withdraw it, so start where it matters most: payroll, human resources, finance and board papers. Get those right, then work outward. Restructuring an entire shared drive in one exercise tends to stall part way through.

If you would like a hand, Datawise can look at how the permissions on your shared files are set up and put a clearer structure in place.