Safe Group Email Checklist

Sending one email to several people? Use this checklist before pressing Send, particularly where the recipients are customers, applicants, suppliers, attendees or other unrelated external contacts.

Step 1 — Choose the Method

• □ Is ordinary email appropriate for this communication?
• □ Would a mailing platform be better (newsletters, recurring campaigns)?
• □ Should a document be shared securely via a link rather than attached?

Step 2 — Check the Audience

• □ Does every recipient genuinely need this message?
• □ Do the recipients know one another?
• □ Would seeing the group reveal personal information or relationships?

Step 3 — Choose the Field

• □ To contains the main visible recipient (for example, your own address)
• □ Cc contains only people who genuinely need visibility of the communication
• □ Unrelated external recipients are in Bcc
• □ No group addresses have accidentally remained in To or Cc

Step 4 — Verify Addresses

• □ Check each full email address, not just the display name
• □ Check similar names — two contacts with the same first name or surname
• □ Check external recipients — look for the external indicator where shown
• □ Remove incorrect autocomplete suggestions
• □ Confirm that former staff or obsolete contacts are not included

Step 5 — Check Content

• □ Correct subject line
• □ Correct message body
• □ Correct customer or organisation name (not copied from a previous email)
• □ No confidential previous email history included in the thread
• □ No personal data intended for a different recipient

Step 6 — Check Attachments

• □ Correct file
• □ Correct version
• □ Recipient access is appropriate for all Bcc recipients
• □ No tracked changes or comments
• □ No hidden sheets, hidden rows or embedded metadata
• □ Secure link used where more appropriate than a direct attachment

Step 7 — Final Pause

• □ Review To
• □ Review Cc
• □ Review Bcc
• □ Confirm sender mailbox is correct
• □ Consider enabling a short send delay (Undo Send or Delay Delivery)
• □ Press Send only when satisfied

Step 8 — If Something Goes Wrong

• □ Report it immediately through the organisation’s internal process
• □ Record what was sent, to whom and from which mailbox
• □ Preserve evidence — do not delete the sent message
• □ Revoke file links where possible
• □ Follow the organisation’s data-incident process

Last checked: 30 July 2026. Covers Microsoft 365 Outlook on Windows, Mac, web and mobile. Interface wording varies by version.