Information gets moved around all day, by email, shared links, calls and messaging apps, and now by pasting it into AI assistants. This guidance sets out the checks to make before anything leaves, whichever route it takes.

Effective Guidance Documents

This guidance document is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Guidance number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested guidance documents. No junk, jargon or unnecessary content. Simple and usable guidance documents developed over 25 years through practical use in the real world.

Further Reading

Further guidance on information transfer and cloud services:

• Handheld Devices, Encryption and Remote Working
• Cloud Computing Risks and Exit Strategies
• Supplier and Third-Party Information Security
• Data Protection
• Information Security knowledge base

How to Download

These files are included in the alphaZ subscription.  

Need Help Implementing?

If you'd like hands-on help putting secure information transfer and cloud arrangements in place, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Information Transfer Guidance

A general guidance document on transferring information securely, for all employees who send, share or carry company information. It covers what counts as a transfer, the common risks, the checks to make before sending anything, the controls for each type of transfer, transfers outside the UK and what to do if a transfer goes wrong.

Topics Covered

• What counts as a transfer - examples from post and email to cloud links, backups, phone calls and information typed into an AI tool
• Transfer risks - common slips such as auto-completed addresses, reply-all, the wrong attachment, overheard calls and open sharing links
• Before you transfer anything - checking the classification, permission and recipient, sending the minimum needed and agreeing how it will be handled
• Email, file sharing and media - encrypting confidential attachments, sending passwords separately, sharing with named people and encrypting removable media
• Post, calls and meetings - tracked delivery and plain labels, confirming who you are speaking to, and telling everyone if a call is recorded
• Cloud, messaging and AI tools - approved cloud services only, keeping confidential information out of messaging, and approved AI tools under company accounts
• Transfers outside the UK - why personal data sent overseas needs a lawful basis in place, and raising unapproved services before sending
• If a transfer goes wrong - reporting misdirected information, lost packages or devices and open links immediately, and flagging personal data straight away

Who Is It For?

All employees who send, share, carry or discuss company information, whether by email, post, phone, cloud services or AI tools.

Included in the GDPR / Data Protection Toolkit

This guidance document is part of the GDPR / Data Protection Toolkit - the registers, forms, policies, procedure and guidance for documenting how you collect and process personal data, in one download. The TT-8-06 Information Transfer training talk that carries it is also part of the ISO 27001 and ISO 22301 toolkits.

Using the Guidance

Issue it at induction, go through it with the matching training talk, and keep it to hand as a quick check before sending anything confidential. Record who has received it, for example on the training matrix.

Controls for Each Type of Transfer

The guidance sets out practical controls for each way information moves: email, file sharing and secure file transfer, removable media, post and courier, telephone and video calls, collaboration platforms and cloud services, text and instant messaging, and AI tools. Staff can turn straight to the method they are about to use, such as setting an expiry date on a sharing link.

Adapting the Guidance

Edit the guidance to match your own arrangements - your approved encryption method, sharing service, cloud services and AI tools, and who staff report a misdirected transfer to.

Related Documents

Other documents that work alongside this guidance:

• PP-8-06 Information Transfer Policy Procedure
• PP-8-09 Cloud Computing Policy Procedure
• P-27 Password Policy
• F-Q21 Data Transfer and Processing Agreement
• GG-8-01 Information Security General
• GG-8-07 Information Classification and Protection