Clear screen policy for screen sharing: a clause you can copy

Most clear screen policies were written for an empty desk: lock your screen when you walk away, so nobody passing can read it. The riskier moment now is the opposite one, when you are sitting at the desk and your screen is on a call. ISO/IEC 27002, the guidance behind ISO 27001’s clear screen control, already names screen sharing, and GDPR, HIPAA and India’s DPDP Act all treat an accidental share like any other disclosure.

Below is what each of them asks, a clause you can paste into your own policy, and the evidence that shows an auditor the clause is followed.

What clear screen policies say today

Before writing this we read two published clear desk and clear screen policies, one from a hospital trust and one from a software company. Both are sound, and both are about the same moment: lock the screen when you leave it. Neither mentions sharing one.

That was the right moment to write for when a screen was something people walked past. It is not where most exposure happens now. The person most likely to read your screen today is in a meeting you are presenting to, and they are reading it because you asked them to.

What ISO 27001 asks

Control 7.7 in Annex A of ISO/IEC 27001:2022, Clear desk and clear screen, asks for clear screen rules that are defined and enforced. It does not say what the rules are. That is left to each organisation.

The guidance for the same control, in ISO/IEC 27002:2022, is more specific, and screen sharing is in it. Among the rules it recommends is guidance on how screen pop-ups are configured, with switching off new email and messaging pop-ups during presentations, screen sharing and in public places, where possible, given as the example. ISO’s standards are paid documents, so that is a paraphrase; control 7.7 is the place to check it in your own copy.

So a policy that covers only locking meets the wording of 7.7 and misses the part of its guidance that matters most for remote work. An auditor will not fail a policy for choosing different words. They are likely to ask how your rules apply to the way your people actually use their screens, and for most organisations that now means video calls all day.

What the law says when it goes wrong

A clear screen rule exists to prevent one kind of mistake. Here is how three privacy laws treat that mistake: someone’s personal data appearing on a screen shared with people who were not entitled to see it. We build software and are not lawyers, so this is what each law’s text says about this one situation, not legal advice.

Three details matter more than a table can show.

Under GDPR, every breach is written down. A breach you decide not to report still goes in your internal breach register, with what happened and what you did about it. A two-second glimpse of a name is usually not reportable; a readable list of customer records may well be. Either way the decision is written down, and the regulator can ask to see it.

HIPAA cares whether safeguards existed. Showing a record to a colleague who is authorised to see it is excluded from the breach definition, and so is a disclosure where you believe in good faith the viewer could not reasonably have retained what they saw. Beyond those, a covered entity must reasonably safeguard health information against unintended disclosure, and a written rule for screen sharing is one of the plainest ways to show that it did.

DPDP has no small-breach exception. Unlike GDPR, neither the Act nor the 2025 Rules set a level below which a breach goes unreported. The rules on the safeguards duty and the breach notice take effect in May 2027, eighteen months after they were published, and failing to keep reasonable security safeguards carries the Act’s highest penalty, up to ₹250 crore. Indian organisations have time, and this is one of the cheapest items to settle early.

The thread through all three is the same: what you had in place before the mistake. A rule on paper is the start of that. A rule people can follow without thinking is the rest of it.

A clause you can copy

Written to sit inside an existing clear desk and clear screen policy. Replace the part in square brackets.

Screen sharing. When sharing a screen in a meeting, presentation or support session, staff must:

1. Share a single application window where the meeting allows it, and the entire screen only when the task needs it.
2. Turn on Do not disturb, or the equivalent setting, before sharing, so that email, chat and other notifications cannot appear.
3. Close any window or browser tab holding confidential or personal information that the meeting does not need, or protect it so that viewers cannot see it.
4. Check the meeting’s preview of the shared screen once sharing starts.
5. Stop sharing as soon as it is no longer needed.
6. Report any accidental disclosure during a screen share to [the information security or data protection contact] the same day.

Why each line is there

1. One window first. A single-window share contains only that window, so nothing else on the screen can reach the call. It stops working the moment someone needs two applications, which is why the clause allows the whole screen when the task needs it rather than pretending it never will.

2. Do not disturb, before. Notifications are the commonest way something private reaches a shared screen, and they are the example ISO 27002 itself gives. Before is the word that matters: switching it on after someone says “I can see your messages” is too late. The settings, and the pop-ups they miss, are in our guide to turning off notifications while sharing.

3. Close, or protect. Closing is the default. Protecting is for the window that has to stay open: the inbox you are watching for a client, the queue of other customers’ tickets, the chat you are on call for. This is the line people break, and rarely from carelessness.

4. Check the preview. Your own screen is not what the room receives. The preview is, and three seconds on it catches the wrong window, the second monitor, and the thing you thought was hidden. What still shows during a share covers the gaps that catch people out.

5. Stop sharing. A share left running after the demo is a share nobody is managing.

6. Report the same day. GDPR’s 72 hours run from when the organisation becomes aware, and DPDP asks for notice without delay. A same-day report is what makes either deadline reachable. Make the report easy and unembarrassing, because the alternative is someone quietly hoping nobody noticed.

The evidence an auditor will look for

Auditors test whether a rule is followed, not only whether it is written. For this clause the evidence is ordinary:

• The clause, acknowledged. Most organisations already collect policy acknowledgements, and this clause rides along with the rest.
• Training that mentions it. One slide in security awareness training with the six lines shows people were told.
• Settings, where IT can set them. Some notification and sharing settings can be configured centrally rather than left to memory. Where yours can, the configuration is evidence.
• An incident log with screen-share entries in it. In an organisation that shares screens every day, a year with none recorded more likely means nothing was reported than that nothing happened, and auditors know it.
• A spot check. Sit in on a routine meeting where someone shares a screen, and see whether the six lines hold.

Where Hushglass fits, and where it does not

Line 3 is the gap we build for. A recruiter on a client call still needs the candidate tracker open. A support agent sharing with one customer still has the queue of everyone else. An accountant walking one client through their figures still has the inbox. Closing those windows costs the work, and leaving them open puts them on the call.

Hushglass protects a window you choose. Anyone watching the share sees an opaque cover marked “Private content protected” where it is, while it stays open and usable on your own screen. We have tested it from the viewer’s side in Zoom, the Microsoft Teams desktop app and Google Meet, and against OBS Display Capture and the Windows Snipping Tool. The free tier protects one window and does not expire. Pro protects every window an app opens, including the pop-ups a protected app raises mid-call.

What it does not do, stated plainly, because a compliance reader needs the edges more than the pitch:

• It needs an entire-screen share. Share the protected window itself as a single window and viewers see the real thing. A single-window share under line 1 does not need protecting anyway, because nothing else is in it.
• Notifications are separate windows and are not covered. That is line 2’s job.
• Task View and Alt-Tab show live previews of a protected window while it is open. A minimised one shows its app icon there instead.
• It guards against mistakes, not against a determined person. Microsoft’s own documentation for the Windows feature it is built on says there is no guarantee that it protects window content, for example from a camera pointed at the screen. A clear screen rule is a guard against mistakes too, which is why the two fit.
• It changes what screen capture records on that computer, and not only in meetings. Expect your organisation’s own screen recording or screenshot-based monitoring to record the cover as well. Roll it out with IT, not around it.

For a team, two facts usually settle the IT conversation. Hushglass sends nothing about your windows anywhere: its only network traffic is a once-a-day check for a newer version and, with Pro, a licence check. And the Microsoft Store version is signed by Microsoft and installs without the browser and Windows warnings our own installer can still meet.

The short version

Most clear screen policies cover the empty desk. Add six lines for the occupied one: share one window where you can, switch on Do not disturb before every share, close what you can and protect what you cannot, check the preview, stop when you are done, and report a slip the same day. That is what ISO 27002’s guidance points at, and it is what GDPR, HIPAA and DPDP will ask you to show after a mistake.