Interested in our Cybersecurity Framework?
Visit our article on how to organise an effective cybersecurity strategy to download a copy of our framework.
Interested in a Free Phishing Security Test?
VirtueUK are partners with KnowBe4, the world's largest security awareness training and simulated phishing platform.
If you're interested in assessing the Phish-prone percentage of your users, contact us to arrange a free simulated phishing attack.
If you're interested in assessing the Phish-prone percentage of your users, contact us to arrange a free simulated phishing attack.
What UK GDPR Expects from Boards and Senior Leaders
Cloud collaboration tools like Microsoft SharePoint have become central to how UK organisations operate. Documents are shared instantly, teams collaborate in real time, and staff can access information from anywhere.
For organisations with 30–400 users across London and the South East, SharePoint is often the backbone of day‑to‑day operations.
But there’s a common and risky assumption we regularly see as a UK‑based IT Managed Service Provider (MSP):
“SharePoint is secure because it’s Microsoft.”
Microsoft provides a highly secure platform but most data incidents don’t stem from hacking. They result from everyday user behaviour and configuration decisions, often made with efficiency, not risk, in mind.
Most UK Data Breaches Aren’t Cyber Attacks
UK regulators consistently show that the majority of reported data incidents are caused by internal mistakes, not external attackers.
According to the Information Commissioner’s Office (ICO), over three‑quarters of reported breaches are non‑cyber incidents, commonly involving:
- Unauthorised internal access
- Data shared too widely
- Human error
These are exactly the types of risks that develop quietly inside SharePoint environments.
Common SharePoint Risks We See in UK Organisations
In practice, most SharePoint risk builds up gradually through normal use, including:
- SharePoint folders shared too broadly “just in case”
- Former employees or contractors retaining access
- External sharing enabled permanently for convenience
- Assumptions that SharePoint data is automatically backed up
Individually, none of these feel serious.
Together, they are among the most common causes of data exposure reported to UK regulators.
The UK Government’s Cyber Security Breaches Survey 2025 confirms that medium‑sized organisations remain disproportionately affected, with 67% of medium organisations experiencing a breach or attack in the past year.
The Microsoft Shared Responsibility Model: Often Overlooked
Microsoft secures the platform infrastructure.
Your organisation is responsible for:
- Who can access data
- How it’s shared
- How long access remains active
- How data is protected and recovered
This is clearly outlined in the UK National Cyber Security Centre’s guidance on the cloud shared responsibility model, which stresses that customers are always responsible for secure configuration and access control
In SharePoint, this responsibility gap commonly appears in:
- External sharing settings
- Permission inheritance
- Backup and retention assumptions
- Role‑based access governance
Why SharePoint Risk Is a UK GDPR Leadership Issue
For UK organisations, SharePoint security is not just technical – it is a governance obligation.
Under UK GDPR, organisations must implement “appropriate technical and organisational measures” and be able to demonstrate compliance.
The ICO is explicit that accountability sits at senior leadership and board level, not solely with IT teams
A key ICO expectation is robust access control, including:
- Role‑based permissions
- Timely removal of leaver access
- Regular access reviews
If personal or sensitive data is exposed through over‑sharing, regulators will not accept “Microsoft 365” as a defence.
The Risk Is Usability, Not Malice
SharePoint’s biggest strength is also its Achilles heel: it’s easy to use.
Over time:
- Permissions multiply
- Temporary access becomes permanent
- External links are rarely reviewed
- Data ownership becomes unclear
This aligns with UK breach data showing that human error and unauthorised access remain leading causes of incidents.
Is Your SharePoint Helping or Quietly Increasing Risk?
UK regulators consistently emphasise that “no incidents” doesn’t mean “low risk.”
It often means limited visibility.
A short, structured SharePoint review can quickly answer:
- Who has access to what – and why?
- Where is data shared beyond necessity?
- How recoverable is your data if something goes wrong?
- Can leadership evidence UK GDPR‑aligned controls?
For growing London‑based organisations, these questions are increasingly part of responsible governance, not optional IT hygiene.