How to treat E-mail services as a means of storing Personal Data?

Question

Email

Good afternoon!
I work at a small enterprise, we are engaged in professional development of teachers. Often, teachers, and students themselves, send a copy of their passport to e-mail (Yandex) to buy air tickets, to conclude contracts, etc.
Based on this manual , I defined class 3K, category 3, data volumes are small.
In connection with this issue, we have 10 employees have access to a single mail where all this data is. Is it enough to simply subscribe to the "non-disclosure notification" of mail passwords, and prohibit downloading applications containing personal data to a working PC (since the service allows you to watch passport photo scans online).
Is it necessary to immediately delete data from mail, and store copies, for example, on a separate computer with access only via local network, well, etc.?

Answer 1

For starters, security classes have been gone for many years now, there are security levels so you've wasted your time.
Next, watch the video to understand what to do and what to learn https://youtu.be/DQku16k5Kw0