People teams handle information that can affect someone's privacy, livelihood and trust: contracts, performance material, compensation data, occupational records, investigation documents and identity evidence. Much of it needs to move between HR, managers, employees, advisers and service providers.
The responsible objective is not to mark everything. It is to minimise distribution, use controlled systems and add accountability where sensitive copies genuinely need to leave.
Prefer controlled access
Where possible, let authorised people view information inside a private HR or employee portal rather than sending permanent attachments. Strong authentication, role-based access and timely removal remain essential.
The ExactMark SDK can add session-specific signals to authenticated pages without capturing the page content. If a screenshot later surfaces, Evidence Lab can compare it with permitted Web Sessions.
Use individual copies when a file must leave
Some workflows still require a PDF or image: a contract for signature, a report for an external adviser or a document provided directly to the employee. ExactMark Imprint can create one recipient-linked output for each person receiving that material.
Use accurate recipient records and avoid a single marked file sent to a broad mailing list. If several internal managers require access, consider whether controlled portal access is more appropriate than multiple downloaded copies.
Limit the information first
Before uploading or sharing, remove unrelated employee records, hidden spreadsheet tabs and pages the recipient does not require. Check whether identifiers can be reduced. Confirm that the sharing purpose, authority and retention period are understood.
ExactMark does not provide the legal basis for processing employee data. Employers should follow applicable law, internal policy, collective arrangements and specialist advice.
Restrict investigative access
Recipient identities and evidence findings are sensitive. Use ExactMark roles to ensure only appropriate people can create copies, review sessions or analyse evidence. A technical colleague may need to install the SDK without receiving access to HR investigations.
Audit access to the system and review membership when roles change. A security control becomes a new risk if too many people can browse its records.
Respond without presuming guilt
If an employee document or screenshot surfaces, preserve the best evidence and surrounding context. Search the source that matches the workflow—Web Apps for a portal screenshot, ExactMark Imprint for a recipient-linked file.
A result pointing to one recipient copy does not prove the recipient deliberately leaked it. Consider delegated mailbox access, shared devices, manager forwarding, compromised credentials, authorised disclosure and process errors.
Employment consequences should never rest on an automated score alone. Use a fair, documented investigation with appropriate HR, legal, security and employee representation input.
Make the rules understandable
Employees and managers should know how sensitive people information is expected to move. Explain approved portals, restrictions on local copies, who may forward documents and how suspected incidents are reported.
The process can remain straightforward:
- Keep sensitive information in controlled systems where possible.
- Share only the fields and pages required.
- Generate named recipient copies where export is necessary.
- Deliver through an approved secure channel.
- Remove access when the purpose ends.
- Preserve and review evidence responsibly if material surfaces.
Accountability should support trust and due process, not create a culture of automatic suspicion. Used proportionately, ExactMark helps teams understand the route behind sensitive material while keeping human judgement firmly in control.