Information Transfer Policy Template: Email, File Sharing, Removable Media and AI Tools

Most data leaves an organisation through ordinary channels: an attachment sent to the wrong address, a sharing link set to "anyone", a USB stick in a courier bag, a contract pasted into a public AI chatbot, or an integration quietly pushing records to a partner's API. The ISO/IEC 27001:2022 Annex A control on information transfer expects rules, procedures or agreements for every type of transfer, inside the organisation and with other parties. This template is that governing document. It covers electronic, physical and verbal transfer, including file sharing services, AI tools and machine-to-machine transfers that most policies forget. It is written for CISOs, data protection officers and policy owners. Classification levels and the handling matrix come from your Data Classification Policy Template; this policy applies them to transfers.

How to use this template

• Replace text in square brackets, such as [Organisation], [Confidential] and [CISO], with your own terms and values. Bracketed values are suggested defaults, not external requirements.
• "Must" indicates a mandatory requirement. "Should" indicates a recommended practice where a documented exception may be justified.
• Use your own classification level names. The transfer matrix in section 4.1 assumes four levels: [Public], [Internal], [Confidential] and [Restricted].
• Email platform rules (SPF, DKIM, DMARC, forwarding) sit in the Email Security Policy Template, and detailed USB controls in the Removable Media Policy Template. This policy sets what may be transferred, how and with whose agreement.
• Place this policy beneath your Information Security Policy Template.

1. Purpose

This policy sets the requirements for transferring information within [Organisation] and between [Organisation] and other parties. Its aims are to protect information in transit from interception, alteration, misdirection and loss; to make sure each transfer uses a channel suited to the information's classification; to put agreements in place before regular transfers with third parties; and to keep a record of who sent what to whom where the classification requires it.

2. Scope

This policy applies to:

• All information owned or processed by [Organisation], in any format.
• Electronic transfer: email, file sharing and collaboration services, managed file transfer, messaging and chat, APIs and integrations, cloud storage links and uploads to external websites, including AI tools.
• Physical transfer: removable media, laptops and devices in transit, paper documents and courier or postal services.
• Verbal transfer: telephone, video calls, voicemail and meetings.
• Transfers carried out by applications, service accounts, scripts and AI agents on behalf of [Organisation].
• All employees, contractors and third parties who send or receive information for [Organisation].

3. Roles and responsibilities

4. Policy statements

4.1 Approved channels by classification

Personal email accounts, personal cloud storage and consumer file transfer services must not be used to transfer [Organisation] information above [Public].

4.2 Rules for all transfers

1. The sender must check the classification of the information and use a channel approved for it in section 4.1.
2. The sender must check the recipient address, link permissions and attachments before sending. Autocomplete suggestions must be checked for [Confidential] and above.
3. Only the minimum information needed for the recipient's purpose may be sent.
4. Information must be protected in transit with encryption where section 4.1 requires it. Passwords or keys for encrypted files must be sent through a different channel from the file.
5. Credentials, private keys, API keys and tokens must never be transferred by email, chat or file sharing. They must be shared only through [the secrets management tool].
6. A misdirected or wrongly shared transfer must be reported to [the service desk] immediately and handled as a potential incident. Prompt reporting will not lead to disciplinary action.
7. Legal and regulatory obligations that affect a transfer, such as export controls, contractual restrictions and data protection rules, must be checked before the transfer.

4.3 Electronic transfer and file sharing

1. Only file sharing and collaboration services on [the approved channels list] may be used.
2. The default sharing setting must be "specific people". "Anyone with the link" sharing must be disabled for [Confidential] and above, and should be disabled organisation-wide unless a business case is approved.
3. External sharing links must expire after [30 days] by default. Owners must review active external shares every [quarter].
4. Files must be scanned for malware on upload and download.
5. Data loss prevention must detect and block or warn on transfers of [payment card numbers, national identifiers, classified labels] through email, file sharing and web uploads. See the Data Loss Prevention Policy Template.
6. Automatic forwarding of email to external addresses must be disabled at platform level, as set out in the Email Security Policy.
7. Large or regular transfers to third parties should use managed file transfer or an API rather than email. See the Secure File Sharing Guide.

4.4 AI tools

1. Entering or uploading information into an AI tool is a transfer and must follow section 4.1.
2. Only AI tools on [the approved AI tools list] may receive information above [Public]. Approval must confirm whether the provider retains prompts, uses them for training, and where they are processed.
3. Browser extensions, meeting transcription bots and AI assistants that read mail, files or calls must be approved before use.
4. Staff must not paste credentials, customer personal data or [Restricted] information into any AI tool unless that tool is approved for it. See the Shadow AI Policy Template and the AI Acceptable Use Policy Template.

4.5 Machine-to-machine transfers

1. Every automated transfer to a third party (API, SFTP, managed file transfer, webhook, data pipeline) must be recorded in [the integration register] with its owner, data types, classification, destination and transfer agreement.
2. Each integration must authenticate with its own service identity and credential, scoped to the data it needs. Shared or personal credentials must not be used.
3. Transfers must use encrypted protocols (for example TLS 1.2 or higher, SFTP). Unencrypted FTP must not be used for [Internal] information or above.
4. Transfer logs must record source, destination, volume and outcome, and be retained for [12 months].
5. Integration credentials must be revoked when the integration or agreement ends. See the NHI Offboarding and Decommissioning Guide.
6. AI agents that can send information outside [Organisation] must be limited to approved destinations and must not send [Confidential] information externally without human approval unless [an approved exception] applies.

4.6 Physical transfer

1. Removable media must be encrypted and used as the Removable Media Policy requires.
2. [Confidential] and [Restricted] items must be sent only by couriers on [the approved courier list], whose identity must be checked on collection.
3. Packaging must protect contents from damage and show tampering. [Restricted] items must be double-packaged with the outer layer showing no classification.
4. The sender must log dispatch time, courier, recipient and tracking reference; the recipient must confirm receipt. Missing items must be reported within [1 business day].
5. Laptops and devices in transit must have full-disk encryption and must not be left unattended in vehicles or public places.

4.7 Verbal transfer

1. [Confidential] matters must not be discussed in public places or on calls where others can overhear.
2. [Confidential] information must not be left in voicemail.
3. Callers requesting [Confidential] information or changes to payment details must be verified through a known, independent contact method. See the Payment Verification Policy Template.
4. External participants in meetings where [Confidential] information is shared must be identified and admitted by the organiser. Recording and transcription must be announced.

4.8 Transfer agreements

1. Regular transfers of [Internal] information or above to a third party must be covered by a transfer agreement or contract clause before the first transfer.
2. Agreements must state: the information and classification, purpose, approved channel and protection, contacts on both sides, notification of incidents and misdirected transfers, onward transfer limits, retention and return or deletion, and liability.
3. Personal data transferred to another country must meet the transfer rules of applicable data protection law before it is sent. Under UK GDPR, for example, this means adequacy regulations, an Article 46 safeguard with a transfer risk assessment, or a documented Article 49 exception, as the ICO describes. See the Transfer Impact Assessment Template and the International Data Transfers Map.

5. Exceptions

1. Exceptions must be requested through [the exception process] with the business reason, compensating controls and an expiry date of no more than [12 months].
2. Exceptions for [Restricted] information, public sharing links or new external channels must be approved by [the CISO].
3. All exceptions must be recorded in [the risk register].

6. Compliance and monitoring

Breaches of this policy may lead to removal of access and to action under [the disciplinary policy]. Honest mistakes reported promptly under section 4.2 are not treated as breaches.

7. Review and approval

Implementation guidance

The sequence below is NHI Mgmt Group's recommendation.

1. Start with the channel list. Decide which email, sharing, transfer and AI services are approved for each classification level before publishing the matrix; a policy that forbids everything pushes staff to personal tools.
2. Change platform defaults. Set sharing links to "specific people", add expiry, and turn on external forwarding blocks. Defaults do more than training. Pilot with one department, measure helpdesk calls, then roll out; if a business process breaks, grant a time-limited exception rather than reverting the default.
3. Build the integration register. Machine-to-machine transfers usually move the most data and have the least oversight. Start from firewall egress rules, SFTP accounts and API keys issued to partners.
4. Put agreements in place for the top suppliers first. Rank third parties by volume and classification of data received.
5. Size it to the organisation. A small firm can use one sharing service and one rule: "Confidential goes by encrypted link, never by attachment". Larger organisations need DLP and the full register.

Framework mapping

The main exfiltration techniques this policy limits are MITRE ATT&CK T1567 Exfiltration Over Web Service and T1052.001 Exfiltration over USB.

Standards and references

• ISO: ISO/IEC 27001:2022 Information security management systems
• NIST: SP 800-53 Rev. 5 (AC-21 Information Sharing, MP-5 Media Transport)
• NIST: Cybersecurity Framework 2.0
• ICO: International transfers, a guide
• MITRE ATT&CK: Exfiltration Over Web Service

This template is provided for guidance and must be adapted to your organisation. Related NHI Mgmt Group resources: Data Classification Policy Template · Secure File Sharing Guide · Removable Media and USB Control Guide · Managed File Transfer Buyer's Guide