The short answer
A screen sharing security policy is a short set of rules for what employees must do before, during and after they share a screen or record a call, so that customer data, credentials and internal information never appear to people who should not see them. A good one covers five things: what may never be shown, how to prepare, how to share (a window or tab, never the whole screen), how to handle recordings, and what to do after a slip. It complements the “clear desk and clear screen” control in ISO/IEC 27001:2022 (Annex A 7.7). The template below is free to copy, and tools such as BlurPilot turn its hardest rule, “never show sensitive data”, into one keyboard shortcut.
Key takeaways
- People leak data on calls by accident, not by intent. The policy should make the safe path the easy one.
- Keep it to one page. A rule people remember beats a complete rule nobody reads.
- Back the rules with tools: Do Not Disturb, window-only sharing and automatic in-browser blur.
- Write down what happens after a slip, so people report it in minutes instead of hiding it.
Why remote teams need a screen sharing policy
Screen sharing is now the main way remote teams sell, support, hire and teach, and it puts internal screens in front of outsiders many times a day. Mistakes are the norm in security incidents: Verizon's 2025 Data Breach Investigations Report found a human element in about 60% of the breaches it analyzed, and IBM's Cost of a Data Breach Report 2025 put the global average cost of a breach at USD 4.44 million.
Regulators expect you to plan for it. The GDPR requires “appropriate technical and organisational measures” to protect personal data (Article 32) and data protection by design (Article 25). ISO/IEC 27001:2022 includes a clear desk and clear screen control (Annex A 7.7), traditionally about locking screens and tidying desks. A screen share is a clear-screen problem with an audience.
The template: screen sharing and recording policy
Free to copy and adapt. Replace the text in [brackets]. This is a starting point, not legal advice; have your security or privacy lead review it.
1. Purpose and scope
This policy protects customer data, credentials and confidential information when [Company] employees and contractors share their screen or record meetings on any platform, including Zoom, Google Meet, Microsoft Teams and screen recorders. It applies to internal and external calls, webinars, demos, interviews, training and recorded tutorials.
2. What must never appear on a shared screen
- Passwords, API keys, tokens, private keys and recovery codes.
- Full payment card numbers, security codes and bank account numbers.
- Personal data of customers, candidates or colleagues who are not on the call, including names, emails, phone numbers and addresses.
- Other customers' names, contracts, prices or results, when anyone outside [Company] is on the call.
- [Add your own: health data, legal matters, unreleased financials, roadmap.]
3. Before you share
- Turn on Do Not Disturb (Windows) or a Focus (macOS), and close email, chat and password managers you do not need.
- Turn on the approved masking tool, [BlurPilot Presenter Mode, Alt+Shift+H], and check that it is active.
- Use demo accounts and test data for demos and training. Use live accounts only when the purpose requires it.
- Open the tabs and files you need in advance.
4. While you share
- Share a single window, tab or screen portion. Share the entire screen only when there is no alternative.
- Do not open files, inboxes, admin panels or search boxes you have not checked first.
- Do not paste credentials or payment details while sharing.
- If something sensitive appears, stop sharing immediately, then continue.
5. Recordings
- Record only when needed, tell participants, and store recordings only in [approved location].
- Review the recording before sharing it outside [Company]. Cover sensitive data with an opaque block, not a light blur.
- Delete recordings after [retention period] unless there is a documented reason to keep them.
6. If something is exposed
- Stop sharing, and stop the recording if there is one.
- Revoke and rotate any credential that was visible, immediately.
- Report it to [security contact] within [1 hour], with the time, meeting, attendees and what was shown. Reporting quickly is never penalized.
- [Security / privacy lead] decides whether customers or authorities must be told, and records the incident either way.
7. Responsibilities
Every employee follows this policy. Team leads make sure their team has the approved tools and rule packs. [Security lead] owns the policy, reviews it every [12 months] and after every incident.
How to roll it out so it sticks
Policies fail when they depend on memory in the middle of a call. Make the safe behavior automatic:
- Announce it in five minutes, not fifty. Walk through sections 2, 3 and 6 in a team meeting, and pin the policy where people prepare for calls.
- Give everyone the same masking setup. With BlurPilot Team, one yearly invoice covers 10 people. Leads export a rule pack with the team's custom words (client names, project code names) and saved rules for your CRM and admin tools; everyone imports it.
- Enforce it where you can. IT can push the rule pack to managed Chrome and Edge browsers through policy (key
rulePack), where it applies read-only, and pre-approve site access. See managed deployment. - Practice the slip. Once a quarter, ask: “If a key showed up on screen right now, what would you do?” The answer should be section 6, from memory.
- Review after every incident and add the screen that leaked to the shared rules, so it cannot happen twice.
BlurPilot runs entirely in the browser: page content, rules and custom words never leave the device, which keeps the tool itself out of your data-processing worries. The security overview lists every network call.
Extra rules worth adding for specific teams
- Sales: demo accounts first; customer names as custom words on live accounts. See demoing without real customer data.
- Support and billing: last four digits only, never full card numbers. See card numbers and PCI DSS.
- Engineering: scoped demo credentials, clean terminals, and an API key blur. See hiding API keys on screen shares.
- Recruiting: close other candidates' profiles before sharing the applicant tracking system; blur emails and phone numbers. See BlurPilot for recruiters.
- Marketing and training: review every recording before it is published. See blurring personal information in recordings.
Frequently asked questions
What should a screen sharing policy include?
What must never be shown, how to prepare before sharing, how to share (a window or tab rather than the entire screen), how recordings are made, stored and reviewed, and what to do immediately after sensitive data is exposed.
Does ISO 27001 require a screen sharing policy?
Not by that name. ISO/IEC 27001:2022 includes a clear desk and clear screen control (Annex A 7.7), and a screen sharing policy is a practical way to apply it to video calls and recordings.
Is accidentally showing customer data on a call a data breach?
It can be. Under the GDPR, an accidental disclosure of personal data to people who should not see it is a personal data breach. Whether it must be reported depends on the risk; our GDPR article explains how to judge it.
How do we enforce the policy without slowing people down?
Automate the hardest rule. A tool like BlurPilot blurs emails, phone numbers, card numbers and, with Pro, API keys and client names on every tab with one shortcut, and IT can push the same rules to every managed browser.
Can we use this template for our company?
Yes. Copy it, adapt the bracketed parts to your company and have your security or privacy lead review it.
How much does BlurPilot cost for a team?
The Team plan is $199 a year for 10 people on one invoice. Individuals can use the Free plan, or Pro from $4 a month, and every install starts with a 7-day Pro trial with no card.