In a coworking space, the next company is often just a few metres away. A list of clients appears on the screen, a contract is sitting in the printer, and a video call begins at the neighbouring desk. Situations like these are an everyday occurrence – and illustrate why data protection requires particular attention in shared working environments.
Nevertheless, it is possible to work in a way that complies with data protection regulations. The key factors are choosing the right space, implementing technical safeguards and establishing clear rules of conduct. This guide explains what companies should look out for when selecting a coworking space and answers ten important questions about working in compliance with data protection regulations in a shared office environment.
Yes – provided that the workplace is appropriate to the security requirements of the tasks and that companies take suitable measures. Article 32 of the General Data Protection Regulation (GDPR) requires a level of protection commensurate with the risk, but does not, as a matter of principle, require a private office or rule out coworking. The key factor is whether personal data is protected against unauthorised access, disclosure or loss.
The company remains responsible for its data processing and the working practices of its staff. The provider can supply a suitable infrastructure with regulated access, networks and premises. However, this does not replace secure end devices or internal data protection guidelines.
When selecting a coworking space, businesses should pay particular attention to regulated access permissions, separate rooms for confidential discussions, a secure network infrastructure, secure document management processes and clearly identified points of contact. Which requirements are particularly important depends on the nature and sensitivity of the data being processed.
• Access: Are workspaces, the issuing of keys and access cards, and visitor routes regulated in a transparent manner?
• Rooms: Can confidential telephone calls or client meetings take place in a separate office or meeting room?
• Network: Is there a secure Wi-Fi and network infrastructure, and a point of contact for technical queries?
• Documents: How are printouts, scans, post and confidential documents that are no longer required handled?
• Organisation: Are there designated points of contact and procedures in place for security incidents and lost access credentials?
Practical advice: A coworking desk is often sufficient for general research. Anyone who regularly handles personnel files, client information or confidential contracts should opt for a physically secure workspace.
10 common questions about data protection in coworking spaces
Where possible, avoid positioning the monitor facing walkways or neighbouring workstations. If a higher level of security is required, a privacy filter can help by making it more difficult for people to see the screen from the side. You should also check whether preview windows, pop-up notifications or open documents are displaying any unnecessary confidential information.
Example: An employee is working on a customer quotation. Instead of positioning the spreadsheet so that it faces the corridor, they sit with the screen facing the wall or use a suitable private area.
Even a brief absence can be enough for unauthorised persons to view confidential information or access business applications. Locking devices prevents other people from gaining easy access to sensitive data during this time.
Always lock your devices, even if you are only leaving the room briefly. You should also enable an automatic lock after a reasonable period of inactivity. Devices, access cards and portable storage media must not be left unattended; passwords should not be written on visible sticky notes.
When holding client meetings, conducting job interviews, making staffing decisions or discussing financial information, a private room is usually more suitable than an open-plan area. Headphones prevent others from hearing the person on the other end of the call – though your own voice remains audible in the room. You should therefore book a day office or a meeting room for sensitive appointments.
Use the provider’s designated network and secure your own devices separately. A VPN (Virtual Private Network) establishes an encrypted connection to another network and may, for example, be required to access company systems. Multi-factor authentication (MFA) protects accounts by requiring at least two different forms of verification, such as a password and confirmation via an app.
• Install security updates promptly and encrypt your laptop’s hard drive.
• Use strong login credentials for business accounts and, where applicable, MFA.
• Use a VPN in accordance with company policy; do not use third-party USB sticks or unverified cloud services.
Collect your printouts straight away and check that all pages are present. Make confidential post available only to authorised recipients. If paper documents are no longer required, first check the statutory and company retention periods. Documents containing sensitive information must then be disposed of via a designated, secure shredding process – not in the general waste bin.
Example: A misprinted list of job applicants is not left lying openly by the printer. The employee takes it and arranges for it to be securely destroyed in accordance with their company’s approved procedure.
The ‘Clean Desk’ policy means that confidential documents, data storage devices and access media are securely stowed away when you are away from your desk; shared workstations are handed over free of sensitive information. Anyone wishing to establish binding procedures within their organisation will find guidance, including a sample template, in our supplementary guide ‘Clean Desk Policy: Rules, Benefits and Practical Implementation’.
After the meeting, stop screen sharing and disconnect from presentation systems. Take any printouts, notes and data storage devices with you. Check whiteboards and flipcharts for any confidential content and remove it before the next meeting begins. For team meetings, explicitly specify who is responsible for the final check.
A clear induction is more effective than a set of unread rules. Set out which activities are permitted at open-plan desks, when a private room is required, which printing and cloud services may be used, and to whom incidents should be reported. New staff and external project partners should be familiar with the rules before their first day at work.
Respond immediately: inform the internal data protection or IT contact person, secure any available information relating to the incident, and take coordinated measures to prevent further disclosures. Do not attempt to cover up the incident on your own initiative or to document it in an unsecured manner. In the event of a personal data breach, the data controller must assess whether and when a notification to the supervisory authority is required; under Article 33 of the GDPR, this must generally be done ‘without undue delay and, where feasible, within 72 hours’ of the breach becoming known, provided that there is a relevant risk.
It’s better to avoid this | Better to do this |
Leaving your laptop unlocked whilst you go to get a coffee | Lock the screen and keep your devices safe |
Conducting a staff appraisal at an open desk | Move a confidential conversation to a suitable room |
Leaving customer data in the shared printer | Collect printouts immediately and secure any misprints |
Passing on access cards to colleagues or visitors | Use access cards for personal purposes and report any loss |
Professional infrastructure and responsible user behaviour go hand in hand. The following overview shows the division of responsibilities in a typical COLLECTION Business Center. The specific services included in a particular package should be agreed in advance.
Area | COLLECTION Business Center | Client Company |
IT and Network | Operation of the company’s own Wi-Fi and network infrastructure with encryption, firewalls and restricted administrator access. | Securing staff laptops, accounts, data and applications; updates, MFA and access rights. |
Rooms and Access | Regulated access permissions, reception and visitor procedures, and bookable meeting rooms. | Select a suitable room, protect your own access cards and comply with visitor rules. |
Documents and post | Defined processes for post, printing, scanning and document destruction as part of the services provided. | Classify confidential content correctly, collect printouts, and set deadlines and your own document workflows. |
Incidents | Defined internal processes for operational security incidents and technical faults. | Report your own data protection incidents internally immediately, assess them and check for statutory reporting obligations. |
With the COLLECTION Secure Workspace Framework, COLLECTION Business Center 15 sets out company-wide security standards. These include, amongst other things, data protection and confidentiality, access and visitor management, encrypted Wi-Fi infrastructure, firewall systems, document and post processes, and staff training. Emergency and escalation procedures are also covered. According to COLLECTION, the standard applies to all Business Centres in Germany and Austria.
Its practical strength lies in the combination of managed infrastructure and a variety of space solutions: coworking areas are available for routine tasks requiring concentration, whilst, depending on the location, day offices, private offices or meeting rooms may be suitable for sensitive discussions. However, the company’s own data protection process remains essential.
You can find out more about the documented security areas in the COLLECTION Secure Workspace Framework.
Quick check: Is your coworking space organised in accordance with data protection regulations?
☐ The workspace I’ve chosen is suitable for the level of security required for my work.
☐ Outsiders cannot easily see or overhear confidential information.
☐ Devices and user accounts are locked or technically protected.
☐ Prints, post and documents are not left unattended.
☐ Access credentials are kept secure and visitor routes are regulated.
☐ An internal point of contact is designated for security incidents.
If a box is not ticked, the organisation should first clarify the relevant security measure. For data requiring particular protection, it is also advisable to carry out an individual risk assessment before use.