Should You Use Outlook to Send Confidential Data?

Email is a quick and simple way to exchange documents containing confidential information.

But should you send confidential data using a basic email provider like Microsoft Outlook?

The short answer is no — not with the default settings, and not without additional protection for sensitive data.

You should never send private information in an unprotected email using Outlook or any other email provider.

Messages are left open to risk at several points in their journey.

You should assume that anyone can intercept or manipulate them.

The good news is that there are a number of steps you can take to make your confidential data in Outlook more secure.

As a writer and researcher in cybersecurity, I've spent countless hours studying email security and its vulnerabilities.

Let me share how you can use encryption and more to send confidential data using Outlook without putting it at risk.

"Encryption is essential in protecting sensitive data, but it's just one piece of the puzzle.

A layered approach to security ensures better protection against modern cyber threats."

— Mike Wakefield, CTO, Beyond Encryption

1. Use Encryption

The most important step you can take to protect confidential email data is to encrypt it.

Encryption scrambles the data so that it cannot be read by anyone who does not have the key.

However, it's important to note that not all encryption types offer the same level of security.

Encrypting an Email in Outlook

TLS (Transport Layer Security) encryption is used for all Outlook emails but is not considered secure enough alone for sensitive messages.

You can use additional encryption types to send a secure email in Outlook.

These are designed to increase the security barrier around your data:

S/MIME Encryption

Available to all Outlook users, you can set up an S/MIME certificate to encrypt an email in Outlook.

S/MIME provides relatively strong protection against interception but can only be used with systems that have certificates.

For this reason, usage of S/MIME is quite limited.

Microsoft Purview Message Encryption (MPME)

Available only to Enterprise Microsoft 365 subscribers, MPME is more user-friendly than S/MIME and has advanced encryption.

However, Microsoft's secure email offering includes robust encryption but lacks features like recipient identity authentication, which may leave messages more vulnerable to specific threats.

Because of this, Microsoft does not advise using MPME as a barrier for highly sensitive information, though it is useful as a preventative tool.

MPME is also not designed to deliver sensitive information to customers at scale, with some user experience and volume-based limitations.

Learn how to encrypt an email in Outlook.

Or, read our review of Microsoft's secure email.

Third-Party Secure Email Solutions

Third-party secure email solutions are designed to address the limitations of built-in encryption options like MPME, offering advanced features to enhance security and usability.

These solutions often include recipient authentication, making sure that messages are delivered only to the intended recipient, and robust audit capabilities for tracking access.

Many also provide military-grade encryption for complete end-to-end protection (from outbox to inbox).

Unlike MPME, third-party solutions are typically easier to deploy and manage, making them suitable for businesses of all sizes.

For instance, the Mailock secure email add-in integrates with Outlook, offering a user-friendly experience with high levels of security.

Choosing the right secure email solution depends on your specific needs, but third-party options often provide the flexibility and security required for protecting sensitive customer communications.

Read our review of the best secure email services.

Summary: Is Outlook's Encryption Secure?

The Microsoft team itself has made it clear that its strongest email encryption is preventative only, not to be used as a security barrier.

Businesses' sending highly sensitive or personal customer data are required by the ICO (Information Commissioner's Office) to secure it.

A secure email solution can provide advanced encryption, recipient authentication, and audit capabilities for full protection.

Many of these solutions offer Outlook encryption add-ins that bring security features to your email client's navigation menu.

2. Use Strong Passwords

When setting up your email account (or your encryption), it is important to use strong passwords.

"A strong password is your first line of defence.

Using a password manager makes your credentials unique and secure."

— Adam Byford, CCO, Beyond Encryption

Strong passwords are at least 12 characters long and include a mix of upper and lowercase letters, numbers, and symbols.

In addition to creating robust passwords, it's crucial to avoid reusing passwords across different accounts.

Using unique passwords can significantly reduce the risk of security breaches, especially in the event one of your accounts is compromised.

If you are sending confidential business data, it is vital these practices are in place for individual and administrator accounts.

3. Check Email Addresses

Only send confidential data to people you trust.

Before sending the message, take a moment to check the recipient's email address.

You can do this by hovering over the email address to see if it is a valid address in the correct structure with the correct spelling.

No matter how careful you are, you could still email the wrong person.

It's one of the top causes of a data breach.

That's why many businesses use recipient authentication to make sure highly confidential emails can only be accessed by the right people.

4. Recall Misfired Emails

If you send information to the wrong person, you need a way to retract it.

Outlook offers some recall features that allow you to retrieve messages sent in error. However, there are a few limitations:

• The recipient must use Outlook.
• The email must be unopened.
• A recipient's spam filters can interrupt the process.

If you're sending highly sensitive information, you can't rely on these limited native email recall features.

To make sure you can always retract sensitive emails, you'll need a more advanced solution.

Tools like the Mailock Outlook add-in, or other secure email platforms, offer better options for email revocation and security.

Exploring multiple secure email tools can help determine the best fit for your needs.

5. Enable Account 2FA

Turning on two-factor authentication for your Outlook account means you can only sign in with your password after verifying access to a secondary device, such as your smartphone.

This security measure significantly reduces the chance of an inbox takeover.

It protects against 99.9% of automated attacks, approximately 72% in the UK.

It's a simple but effective measure to make sure you are the only person with access to confidential data in your account.

Again, if you're handling sensitive data, two-factor authentication should be enabled for all accounts, especially administrators.

6. Know the Risks

No matter how careful you are, there will be risks that data could be leaked or intercepted, and there are always new risks arising.

If you regularly send confidential data using Outlook, it's important to be aware of the risks so you can be vigilant.

For businesses, employees must be regularly trained to keep them up-to-date with new threats.

Additional risks to be aware of include:

Phishing Scams

Phishing scams are emails designed to trick you into giving away your personal information.

Don't click on links or open attachments from emails that you don't trust or from people you don't trust.

Malware

Malware is software that can be used to steal your data, monitor your activity, or damage your computer.

Be careful about the sites you visit and the files you download from incoming emails.

Inbox Attacks

Inbox takeover attacks happen when hackers unlawfully breach your email account, gaining access to your private communications.

You should always protect sensitive emails with authentication, creating an additional barrier in case an inbox is compromised.

A Note on the Importance of Data Classification

Data classification is the process of sorting information by its sensitivity and value.

For example, customer credit card details are more sensitive than a company newsletter.

By understanding the level of sensitivity, you can decide on the right security measures.

Highly sensitive data might need encryption, access restrictions, or digital rights management (DRM) tools.

Classifying your data helps you focus your security on protecting the most valuable information.

Sending Confidential Data?

Use encryption, strong passwords, and if you're a business sending highly confidential data, use a secure email solution.

Examples include Mailock, Zivver, and Egress but evaluating multiple options can help you select the one that best fits your needs.

You won't ever protect against every eventuality, but you can make it very difficult for anyone to compromise your data.

Follow the steps in this post and you'll vastly enhance the security of your confidential data when using Outlook.

FAQs

Is Outlook’s Default Encryption Enough for Sensitive Data?

Outlook’s built-in encryption (TLS) is not robust enough to safeguard highly confidential information.

You should add more advanced encryption or use a secure email solution for better protection.

How Do I Retract an Email Sent to the Wrong Person?

Outlook includes recall features, but they work under limited conditions and often fail.

For guaranteed retrieval, you’ll need a secure email solution with a dedicated recall function.

Should I Enable Two-Factor Authentication?

Yes—two-factor authentication adds a crucial extra layer of security, significantly reducing the risk of unauthorised account access.

Do Third-Party Secure Email Solutions Offer Better Protection?

They often provide features like recipient authentication, robust encryption, and better scalability.

But they may require extra investment and administrative oversight.

How Do I Choose the Right Secure Email Platform?

Assess your security needs, regulatory obligations, and user requirements.

References

Microsoft 365 Secure Email vs Mailock: A Comparison, Beyond Encryption, 2024

Microsoft 365 Secure Email vs Mailock: A Comparison, The Register, 2022

Security Requirements, Information Commissioner's Office, 2024

Data Security: An Analysis of the Latest ICO Findings, Beyond Encryption, 2023

One Simple Action You Can Take to Prevent 99.9 Percent of Account Attacks, Microsoft, 2019

Reviewed by

Sabrina McClune, 20.12.24

Sam Kendall, 05.01.25