In today’s data-driven world, organisations are often handling a lot of sensitive information – from customer records to critical infrastructure data. With increasing regulatory pressures and cyber threats, it’s critical you hold strong data security and privacy practices for maintaining trust and compliance within your organisation.
As detailed in the ArcGIS Trust Centre, ArcGIS integrates security and privacy best practices and complies with global standards to provide a secure and trustworthy system. However, there is always a responsibility on us, the users, to ensure you are also following best practices. Those responsibilities may differ based on how you access ArcGIS – with ArcGIS Online and ArcGIS Enterprise bringing different security and privacy management requirements.
Why security approaches differ
As ArcGIS Online is software-as-a-service (SaaS), baseline security controls such as infrastructure security, patching and availability are all managed by Esri. Anything personal to your organisations ArcGIS account such as data governance, sharing settings and user access are managed by you.
ArcGIS Enterprise is a self-hosted and managed deployment offering. While this gives greater control and flexibility to your deployment, it also introduces additional responsibility such as the infrastructure security, network configuration, patch management and more. Although it’s worth noting, with a Managed Service these responsibilities are taken off your team and managed by us.
Whichever ArcGIS deployment your organisation has, data security and privacy should be something you are aware of and implementing every day. Let’s step through some practical tips to ensure you are working in ArcGIS with the security of your data in mind.
Tip #1: Classify your data
A good starting point is to simply understand what data you are working with. Ask yourself:
- have you identified all datasets containing sensitive or personal data?
- have you appropriately categorised your data (e.g. public, internal, confidential)?
- have you applied appropriate measures based on the above classification?
Not every dataset needs the same level of protection or classification, but knowing which ones do is essential. Being consistent with writing effective metadata for all your ArcGIS content is a great way to ensure others are aware of the usability, confidentiality or sensitivity of your data. To give you a head start, the June 2026 ArcGIS Online update brought the Item Details assistant (beta) to help you write your item details. So, there are no excuses for naming all your layers ‘Test’ and leaving that description empty anymore…
Tip #2: Use hosted feature layer views
Hosted feature layer views can be one of the most effective ways to protect sensitive data while still enabling collaboration.
They allow you to create a subset of your data that can be shared with specific users or groups. You could use these to control editing permissions on certain data, or to remove or hide sensitive fields (names, contact details) before sharing with additional users. Another bonus in creating these views in ArcGIS Online is it also stops users creating different copies of data and using up your Organization’s storage credits.
If you’re new to hosted feature layer views, learn more about what they are and how to make them in this blog.
Tip #3: Check sharing settings carefully
Yes, I know this sounds simple, but an easy way to neglect data security in ArcGIS is unintentional public sharing. Don’t believe me? Why not look now in your Organization’s content, filter to Public and question how much really needs to be shared publicly. It’s good practice for users to avoid setting items to Everyone (Public) unless absolutely necessary. Consider group-level or Organization-level sharing to limit access to within ArcGIS. If you’re looking to share across different deployments (e.g. ArcGIS Online ↔ ArcGIS Enterprise), consider using collaborations.
More tips on sharing and setting up collaborations can be found here.
Tip #4: Conduct regular data reviews
So, you’ve checked and ensured your data is shared and classified correctly? Go you! But remember, data security isn’t a one-time activity – it’s ongoing. Consider:
- reviewing datasets for outdated or unnecessary information
- remove redundant copies or unused layers
- reassess access permissions as teams or projects change
The responsibility of reviewing data security isn’t something that should sit with one individual, it should sit with each and every user. For a consolidated approach, consider implementing a regular housekeeping workflow into your content management, as well as individual users workflows too.
Tip #5: Secure API access
ArcGIS services provide REST endpoints, which is simply a web address that applications use to communicate with a service and retrieve or update data. While they make it easy for systems to share information, if not properly managed and protected, they can also create security risks. Think of APIs as doors into your GIS data. If a door doesn’t need to be open to everyone, make sure it’s locked and only accessible to the right people. A lack of understanding can lead to a security risk, but the Developer documentation is a good place to start. A few things to consider:
- make sure only authorised users can access endpoints that contain sensitive information
- don’t make confidential map layers or datasets publicly available through open APIs
- use security methods such as tokens, API keys, or OAuth to verify who is accessing the data
- ensure users fully understand the workings of API keys before working with them
And remember…
If nothing else, remember this – data security and privacy in ArcGIS is not achieved by only configuring certain settings. It is about building good habits and maintaining awareness. Start with some simple measures like classifying data, controlling access or using hosted feature layer views but most importantly, treat your security as an ongoing process. Revisit your practices regularly, stay aligned with your organisation’s policies and continue learning.
For broader guidance on designing secure, resilient architectures, explore the
ArcGIS Well-Architected Framework.