This policy procedure sets out how personal and confidential information is protected when it is sent by email, file transfer, removable media, post, phone or messaging.

Effective Policy Templates

This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Policy number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on information transfer:

• ISO 27001 Annex A 5.14 - Information Transfer
• Information Classification and Protection
• Handheld Devices, Encryption and Remote Working
• Information Security knowledge base

Logo Update Service *

Download this policy with your company name and logo already added!
Document Preparation available with all document toolkits.

How to Download

To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download.

Need Help Implementing?

If you'd like hands-on help setting up secure ways to send confidential information, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Information Transfer Policy Procedure Template

The Information Transfer Policy Procedure is a Word template that sets out how a business controls and protects information during any type of transfer. It covers transfer risks, authenticating recipients, encrypted email attachments, secure file transfer, removable media, delivery by post or by hand, telephone calls, online collaboration sites and text or instant messaging.

Passwords for encrypted files follow the password policy the file refers to. The file has Title, File Location, Issue No, Issue Date, Controlled By and Approved By fields, an Amendment Record and a Business Use information classification in the footer.

What the Policy Covers

• Amendment record, summary, scope and applicability - the purpose of protecting information during transfer, the activities and staff covered, and disciplinary action for breaches
• Transfer risks and recipient checks - risk assessments of information transfer, and authentication of the identity and authorisation of every recipient of personal or confidential information
• Electronic mail - confidential attachments encrypted to at least AES 256 bit, passwords sent by a different route, and filenames that do not reveal contents
• Electronic data transfer - no unencrypted standard FTP for personal or confidential information, secure FTP set up by IT, and care with external transfer systems
• Removable media - information on discs, USB drives and memory cards encrypted, with the password sent separately and the transfer checked afterwards
• Post, hand delivery and telephone - sealed, labelled and tracked packages signed for by the addressee, and minimal information by phone once identity is confirmed
• Collaboration sites and messaging - approved secure cloud storage for encrypted file sharing, and no personal or confidential information by text or instant message

Built for Secure Transfer Methods

• Minimum encryption standard of AES 256 bit for confidential attachments and removable media
• Passwords of at least 12 characters, sent to the recipient by a different method than email
• Package labels that do not show the nature or value of the contents
• Senders check each transfer has succeeded and report any issues to their line manager

Who Needs an Information Transfer Policy Procedure?

Businesses that send personal or confidential information to customers, suppliers or other parties, whether by email, file transfer, removable media or post.

Using the Policy

Edit the approved encryption product, file transfer systems and delivery arrangements to match those your business uses, and name the person in the Controlled By field. Give it top level approval and brief everyone who sends personal or confidential information.

Related Documents

GG-8-06 Information Transfer Guidance and TT-8-06 Information Transfer Training Talk help managers and staff put these transfer rules into practice.

Sending Files by Post or by Hand

Physical transfers get the same care as electronic ones. The file or paperwork must be kept secure and tracked in transit, packed with a seal that has to be broken to open it, labelled with a return address but nothing that shows the contents, and signed for by the addressee.