Evaluating file-upload permissions

Evaluate file uploads by testing who can submit a file, who can retrieve it, and where it goes after submission. A form builder's upload feature may require a respondent account or restrict access to an organisation, making it unsuitable for public intake even when the form itself can be shared publicly.

Start with the respondent

Define whether respondents are staff, known customers or anyone with a public link. Try the form using an account outside the organisation and, where relevant, without signing in. Check whether the platform requires respondents to sign in before they can upload a file.

Microsoft Forms says its upload question is available only when responders are limited to people in the organisation or specified people in it. Google Forms has a similar gate: to answer a file upload question, responders need to sign in to a Google Account. Those constraints matter more than an Upload button appearing in the editor.

Check the allowed file types, number and size in the actual account. Microsoft Forms allows a maximum of 10 files per question and a single-file limit of 10MB, 100MB or 1GB. Google Forms lets the owner set file types, the maximum number of files and the maximum file size. Cognito Forms caps a single file at 100MB on its Individual plan and 250MB on Pro, Team and Enterprise.

Follow the file after submission

Submit a harmless sample document and trace its path: who receives a notification, who can open the file directly, whether its location appears in an exported response, and whether a colleague who edits the form can also access uploaded documents. Test permission changes, not just the first successful upload.

Know where each product puts the file. Microsoft Forms stores uploads in the owner's OneDrive for Business, in Files, then the Apps folder, then the Microsoft Forms folder, followed by a folder matching the form name and a folder for the question that has uploaded files. Google Forms stores them in a new folder on the form owner's Google Drive, so that folder's sharing settings decide who else can open them.

Write down a retention and deletion process before collecting real files. Decide who may download copies, where local copies are stored and how an accidental or sensitive submission is handled. Do not ask for an identity document or other sensitive material merely because the form builder supports uploads.

The Privacy Act 1988 and its 13 Australian Privacy Principles cover Australian Government agencies and organisations with an annual turnover of more than $3 million, among others. If your organisation is covered and a data breach involving personal information is likely to result in serious harm, the Notifiable Data Breaches scheme requires you to notify affected individuals and the OAIC.

Key Evaluation Criteria for File Uploads

Decide on the whole journey

Ask a colleague to submit the form on a phone with both an accepted and rejected sample file. Inspect the response and file permissions as a form owner and as a teammate who should not have access.

If an external customer cannot meet the sign-in rule, choose another intake route or redesign the request.