In this guide · 7 sections
Short answer
In Outlook, use Encrypt (Microsoft Purview Message Encryption), included in Microsoft 365 Business Premium and E3/E5. In Gmail, confidential mode limits forwarding but is not full encryption. On any plan, send a password-protected file and give the password by phone or SMS, never in the same email.
Your options for sending confidential documents
Normal business email is usually encrypted in transit between mail servers, but it is stored readable in the sender's and recipient's mailboxes. If either mailbox is hacked or the message is misaddressed, the document is exposed. The options below add protection to the message or file itself.
| Option | Works on | Protects against | Main limit |
|---|---|---|---|
| Outlook Encrypt (Purview) | Business Premium, E3/E5 or add-on | Wrong recipient, forwarding, mailbox snooping | Licence needed |
| Gmail confidential mode | All Gmail and Workspace accounts | Forwarding, printing, downloading; adds expiry | Not end-to-end encryption |
| Password-protected file | Any email system | Readable attachment in a hacked mailbox | Password must go separately |
| Restricted share link | OneDrive, SharePoint, Google Drive | Copies lingering in mailboxes; can expire or be revoked | Recipient needs to sign in or get a code |
| Client portal | Practice software or a secure upload tool | Everything above, with an audit trail | Set-up effort |
For personal data, PDPC's Guide to Data Protection Practices for ICT Systems lists encrypting exported data and communicating the password separately to the recipient as a practice. Whatever you choose, check the recipient address before you send.
Outlook: Microsoft Purview Message Encryption
Microsoft's Purview Message Encryption replaces the older Office 365 Message Encryption. It lets you encrypt mail to anyone, including Gmail and Yahoo users. Recipients on Outlook read it normally; others get a wrapper email linking to a portal where they sign in or receive a one-time code.
Licensing is the catch. Microsoft's encryption FAQ lists it as part of Office 365 E3 and E5, Microsoft 365 E3 and E5 and Microsoft 365 Business Premium, among others. Business Basic and Business Standard do not include it; Microsoft's training material says other plans can add Azure Information Protection Plan 1. Business Premium is listed at US$22 per user a month on annual billing, before GST, on Microsoft's Singapore pricing page (approximate, as of October 2026).
Check your licence
In the Microsoft 365 admin centre, open Billing, then Your products. Business Premium or E3/E5 means encryption is available.
Compose the email in Outlook
Write the message and attach the file as normal.
Choose Encrypt or Do Not Forward
In new Outlook and Outlook on the web, open Options, then Encrypt. Encrypt-only protects the message; Do Not Forward also blocks forwarding, copying and printing.
Send and tell the recipient what to expect
Non-Outlook recipients get a link to read the message in a browser. A quick heads-up stops them deleting it as phishing.
Automate it for sensitive keywords
An admin can add a mail flow rule that encrypts any external email with, say, "[secure]" in the subject, so staff don't need to remember the button.
Gmail: confidential mode and its limits
Gmail confidential mode is in every Google Workspace edition and personal Gmail. According to Google's help page, it lets you set an expiry date, revoke access, and disable forwarding, copying, printing and downloading.
Pros
- Free on every Gmail and Workspace account
- You can remove access after sending
- Expiry dates stop old copies hanging around
- Blocks casual forwarding and downloading
Cons
- Google says recipients can still screenshot or photograph it
- SMS passcodes are not offered for Singapore numbers
- Not end-to-end encryption; Google still holds the message
- Recipients outside Gmail open it through a link, which looks like phishing to some
Google's stronger options, hosted S/MIME and client-side encryption, are limited to higher editions. Its hosted S/MIME help page lists Enterprise Plus, Frontline Plus and Education editions, so most small businesses on Business Starter or Standard won't have it. For those, a password-protected file or a restricted Drive link is the practical choice.
Password-protected files: the method that works everywhere
Microsoft Word, Excel and PowerPoint can encrypt a file with a password (File, then Info, then Protect, then Encrypt with Password). Adobe Acrobat and most PDF tools can do the same for PDFs. Zip tools that use AES-256 encryption work for a folder of files.
Use a long password (four random words is fine) and a different one per client. Old Office formats and the legacy ZipCrypto method are weak, so save as .docx, .xlsx or .pdf and pick AES in your zip tool.
Do it yourself or get help?
Any team can start today with password-protected files and a rule that passwords go by phone. If you already have Business Premium, turning on a mail flow rule for encryption takes an admin under an hour. Test it by sending to a personal Gmail account first.
Confidential email basics
Our Microsoft 365 / Google Security Lockdown (S$590) sets up encryption rules, sharing defaults and MFA together. The PDPA Compliance Pack (S$690) adds the written policy for handling and sending personal data.
Frequently asked questions
Microsoft lists Purview Message Encryption as part of Business Premium, Office 365 and Microsoft 365 E3 and E5, and some education and government plans, not Business Basic or Business Standard. Microsoft's training material says other plans can add Azure Information Protection Plan 1. Check Billing, then Your products, in the admin centre to see what you hold.
Not in the end-to-end sense. Confidential mode controls what the recipient can do: it can block forwarding, copying, printing and downloading, set an expiry date and let you revoke access. Google warns that recipients can still take screenshots or photos. Full encryption features such as hosted S/MIME need higher Google Workspace editions like Enterprise Plus.
Encrypt the PDF with a strong password in Acrobat or another PDF tool, attach it to the email, then send the password by a different channel such as a phone call, SMS or messaging app. Never put the password in the same email thread. PDPC guidance lists encrypting exported data and giving the password separately as a good practice.
Yes. Recipients on Gmail, Yahoo and other services get a wrapper email with a link to Microsoft's encrypted message portal. They sign in with their Microsoft, Google or Yahoo account or request a one-time passcode, then read and reply in the browser. Tell them in advance so they don't mistake it for phishing.
Only if you have a valid reason to collect the NRIC copy in the first place, which PDPC limits to cases like legal requirements or high-risk identity checks. If you must send one, protect it with encryption or a password sent separately, check the address, and delete copies you no longer need. This is general information, not legal advice.