Could opening a shared document create a viewing record?¶

Yes. Opening a shared cloud document may create a viewing or access record.

Avoid this assumption: Simply looking at a shared document is passive. The provider may record the account, device, IP address, browser, time, document and session used.

The document may also show another user that someone is present, update a recent-view list or trigger notifications.

Before opening, preserve the sharing page, file name, owner, visible link, permissions, document ID, timestamps and current account.

Record whether the document is already open, previewed, cached or merely listed.

Do not open it simply to see whether it contains relevant material.

Consider whether a preview, provider preservation, version record or specialist process can preserve the evidence with less disturbance.

If opening is necessary, record who authorised it, who performed it, the exact time, device, account and network.

Capture any collaborator indicator, presence icon, access warning, notification or recent-activity change.

Do not assume that a viewing record identifies the investigator personally where shared, delegated or service accounts are used.

Likewise, do not infer that an earlier view was made by the named account holder without considering shared access and automation.

Where the document changes during viewing, record the earlier and later states separately.

Record whether the document opens in view, comment or edit mode, because the mode may affect audit records, presence indicators and what another collaborator can see.

Operational takeaway¶

Assume opening a shared document may create provider-side viewing and presence records, and preserve the sharing context before any justified access.