Secure Resource Sharing: Google Drive, Dropbox, Padlet

Anyone with the link is the setting that causes almost every accidental disclosure in small services, and for a reason that is not carelessness: it is the option that always works. Named access fails when someone has no account, or has two accounts, or is on a phone signed into a different one, and the person sharing switches to the open link to get past that.

The fix is structural rather than a rule about being careful. Keep two places. One folder holds general material, where an open link is fine because nothing in it is about a person. One folder holds anything naming a mentee, and that one never leaves named access, no exceptions, even when it is inconvenient.

Then go through the existing links now rather than later. Both Drive and Dropbox let you list what is shared and revoke it. Assume any open link created for a single conversation has been forwarded at least once.

That split is easy enough to do. Is there a rule about how long we keep the mentee folder?

There is, and it is a legal one rather than a preference. The GDPR requires that personal data be adequate, relevant and limited to what is necessary, and kept in a form allowing identification no longer than is necessary. In plain terms: collect less, and delete on a schedule you have actually written down.

Two things that follow, which small services usually miss. Free text notes are where the risk sits. A line saying a mentee is waiting on an asylum decision or has a health condition is special category data under Article 9 and carries stricter conditions than a name and a phone number. Write notes that a mentee could read without harm, and keep the sensitive detail out unless there is a reason it must be there.

And decide what happens at the end of the project. A shared folder that nobody owns after the funding stops is the most common way this data outlives its purpose.