A personal data breach does not always start with a cyberattack. Often, a document left on a desk or an unlocked laptop screen is enough. Clean desk and clear screen procedures are a set of organizational rules designed to eliminate these risks. Here are practical guidelines on what to implement, who is responsible for enforcing the rules and how AI may help.
What are clean desk and clear screen procedures?
These are organizational rules that prevent the accidental disclosure of confidential information within a company. They cover physical protection of documents and data displayed on device screens.
Clean desk procedure
At the end of work, all documents, data storage media and materials containing personal or sensitive data must be placed in locked drawers, cabinets or safes. This reduces the risk of sensitive data being left accessible to unauthorized people.
Basic rules:
- Keep the desk clear: at the end of work, put all documents in locked cabinets, drawers or safes.
- Do not leave sensitive documents unattended: personal data, contracts and reports must not be left on a desk without supervision.
- Secure devices: put away and secure laptops, USB drives, phones and other portable devices when they are not in use.
- Dispose of documents securely: destroy unneeded documents containing sensitive data using a shredder.
Clear screen procedure
This procedure protects data displayed on computer and other electronic-device screens. Every employee locks the screen when leaving their workstation. Privacy filters are recommended in public spaces.
Basic rules:
- Lock the screen: always lock it when leaving your workstation (shortcut: Windows + L).
- Passwords and logins: do not write passwords on sticky notes or leave them in easily accessible places.
- Close applications: close applications and documents containing confidential information when you finish work.
- Privacy filters: when working in public spaces, use screen filters that limit the visibility of data to bystanders.
- Automatic locking: set the screen to lock after a specified period of inactivity, for example 5 minutes.
How to implement these procedures in your organization
- Formal implementation: introduce the procedures as part of your information security policy. Inform employees of the rules and require them to follow them.
- Employee training: provide regular training to build awareness of data security.
- Compliance monitoring: monitor adherence to the procedures, for example through internal audits.
- Enforcement: define disciplinary consequences for violations. Without them, the procedure will remain only on paper.
- Adapt the rules to the company: take account of the types of data processed and the working model: office-based, remote or hybrid.
What risks do these procedures reduce?
- Risk of unauthorized access to data, both by people inside the organization and by outsiders.
- Risk of a GDPR breach: the absence of these procedures may mean non-compliance with personal data protection rules.
- Risk of losing the trust of clients and partners: a data incident directly affects the company’s reputation.
- Risk of data leaks, identity theft or financial loss: every unsecured document or screen is a potential point of leakage.
Who is responsible for implementation and enforcement?
Implementation
The company’s management board or a designated person, for example someone from HR, IT or administration, or the Data Protection Officer (IOD, the person responsible for overseeing compliance with data protection rules).
Keeping the documentation
Keep the procedure in a central policy repository, a document-management system or as a paper copy in a place accessible to employees, for example in the HR department.
Making the rules available to employees
- Share them through the internal intranet, by email or as part of training.
- Put a short version in visible locations, such as near workstations or in conference rooms.
Monitoring and enforcement: division of responsibilities
| Role | Area of responsibility |
|---|---|
| Managers | Monitoring employees’ day-to-day compliance with the rules |
| IT department | Enforcing automatic screen locks and monitoring access logs |
| Administration department | Regular checks of office areas to see whether documents are being left on desks |
| Data Protection Officer (IOD) | Oversight of compliance with the data protection policy and identification of breaches |
| Management board | Enforcing the rules during audits and implementing corrective measures |
How can AI support these procedures?
- Device monitoring: AI detects unauthorized access or open applications containing sensitive data. It automatically alerts administrators if an employee has not applied the required safeguards.
- Automatic screen locking: AI integrated with computer systems locks the screen after a set period of inactivity, without requiring the user to configure it manually.
- Cloud data management: AI monitors which documents are stored without adequate security and suggests corrective steps, such as encrypting or deleting the data.
- Risk analysis: AI tools analyze security data, identify threats related to improper data storage and indicate what needs to be fixed.
Summary: what to do now
Clean desk and clear screen procedures reduce the risk of accidental disclosure of personal data, whether on paper or in digital form. Their effectiveness depends on three things: clear rules, regular training and consistent enforcement.
Your checklist:
- Check whether your company has clean desk and clear screen procedures in place.
- If not, prepare them and include them in the information security policy.
- Appoint people responsible for monitoring and enforcement.
- Train employees.
- Set automatic screen locking on all company devices.
- Schedule the first compliance audit within 30 days of implementation.
If you process personal data, and you certainly do, these procedures are not optional. They are one of the requirements reviewed by the UODO (Polish Personal Data Protection Office) during an inspection.
Frequently asked questions
What do clean desk and clear screen procedures mean in practice? They are organizational rules that prevent accidental disclosure of confidential information within a company. A clean desk procedure requires all documents, data storage media and materials containing personal data to be put in locked drawers, cabinets or safes at the end of work. A clear screen procedure covers locking the screen when leaving a workstation, automatic locking after a period of inactivity, closing applications containing confidential data and using privacy filters in public spaces.
How do you implement clean desk and clear screen procedures in a company, step by step? Start by introducing them as part of the information security policy and requiring employees to follow them. Then provide awareness training, monitor compliance through internal audits, define disciplinary consequences for violations and adapt the rules to the company’s circumstances, including the types of data processed and the working model: office-based, remote or hybrid. Schedule the first compliance audit within 30 days of implementation.
Who in a company is responsible for implementing and enforcing clean desk and clear screen rules? Implementation is the responsibility of the management board or a designated person, for example someone from HR, IT or administration, or the Data Protection Officer (IOD). Enforcement requires a division of responsibility: managers monitor day-to-day compliance, IT enforces automatic screen locks and monitors access logs, administration checks office areas, the IOD oversees compliance with the data protection policy, and the management board enforces the rules during audits and implements corrective measures.
What risks do clean desk and clear screen procedures reduce? They reduce the risk of unauthorized access to data by people inside and outside the organization, the risk of a GDPR breach, the risk of losing clients’ and business partners’ trust, and the risk of data leaks, identity theft and financial losses. Every unsecured document or unlocked screen is a potential point of leakage. The absence of these procedures may mean non-compliance with personal data protection rules, which the UODO reviews during inspections.
How can AI support clean desk and clear screen procedures? AI detects unauthorized access or open applications containing sensitive data and automatically alerts administrators. When integrated with computer systems, it locks a screen after a set period of inactivity without manual configuration. AI also monitors documents stored without adequate security in the cloud and suggests corrective steps, such as encryption or deletion. In addition, AI tools analyze security data, identify threats related to improper data storage and indicate what needs to be fixed.
