I have some data in a Google sheet that needs to be accessed by quite a number of people so I need to make it available to them online. I know this is dead easy in terms of sharing a link, but the data contains names and addresses so has to be treated in accordance with GDPR. Consequently I can't just pass out the link to the Google sheet, as anyone who happened to get the link would then be able to view it.

 

I initially thought I'd just be able to add a password to the Google sheet but it appears (somewhat surprisingly) that it's not possible to do this. The only thing that it seems you can do is control which cells within the sheet are editable.

 

So I'm looking at ways of making this available online but behind some kind of password protection. It would need to be kept up to date from the Google sheet (i.e. changes to data in the sheet would be visible). I know it's possible to render a Google sheet as HTML fairly easily, but from what I've seen that would require a link to the Google sheet to be embedded in the HTML, so anyone with half an ounce of know-how would be able to extract it and then access the sheet directly.

 

I'm just wondering if anyone has done anything like this before? Or could give any pointers on the easiest way to achieve this? I've been having a nose around Google Web Apps scripts but I don't know if that's the best option or whether there might be an easier way to do this?

 

Thanks

You can share it with specific people and make the link restricted - you'll need both the link and to be on the 'allowed list' to view:

 

2 hours ago, langers2k said:

You can share it with specific people and make the link restricted - you'll need both the link and to be on the 'allowed list' to view:

 

 

Thanks Langers...I did originally try this but it seems to only be an option if you have a Google account. If you don't, then you can't open the doc. I tried sharing the link with a test user (that has no Google account) and following the link just takes you to the Google login screen. I know that quite a number of the people who need to access this don't have a Google account so it's not a solution that would work in this instance.

If it's Google you are probably already in breach of the DPA2018 since Google transfers information outwith the EEA.

Also Google relies upon the Privacy Shield EU agreement to provide adequacy for the storage of personal information and that agreement was nullified under the successful Shrems II challenge last year.

 

Also putting personal information online needs to comply with Article 32 of the GDPR relating to the security of storage and processing of personal information inculding the requirrment to "consider the state of the art" with regard to technical security measures. i.e. passwords protecting a file generally isn't considered good enough on it's own.

 

^ this stuff if 80% of my working day usually arguing with very large businesses who are doing their utmost to avoid speding a penny to act lawfully