1. Purpose

This procedure defines how the organization evaluates, approves, protects, executes, and monitors the sharing of organizational information with customers, suppliers, consultants, auditors, business partners, regulators, service providers, and other external parties.

The objective is to ensure that external data sharing is:

• Authorized.
• Business-justified.
• Limited to the information required.
• Appropriate to the information classification.
• Securely performed.
• Consistent with legal, regulatory, privacy, contractual, and customer requirements.
• Properly recorded where required.

---

2. Scope

This procedure applies whenever organizational information is shared outside the organization with:

• Customers
• Suppliers
• Vendors
• Consultants
• Contractors
• Auditors
• Certification bodies
• Business partners
• Legal advisors
• Financial advisors
• Regulators
• Government authorities
• Insurance providers
• Managed service providers
• Cloud/SaaS providers
• Other authorized third parties

It covers:

• Customer data
• Personal data
• Confidential business information
• Financial information
• Contracts
• Security reports
• Audit evidence
• Source code
• Technical information
• System configurations
• Security architecture
• Vulnerability information
• Documents
• Database extracts
• API/system data
• Physical records

---

3. Key Principle

External data sharing should follow:

Business Need → Identify Data → Classify → Assess Recipient → Check Legal/Contractual Requirements → Approve → Minimize → Secure Transfer → Confirm Receipt → Monitor → Revoke/Dispose → Record

---

4. Definitions

External Party

Any person, organization, supplier, customer, or service provider outside the organization’s authorized workforce.

Data Sharing

Providing, transmitting, granting access to, or otherwise making information available to an external party.

Data Owner

The person responsible for determining how information should be protected and shared.

Data Recipient

The external individual or organization receiving or accessing the information.

Sensitive Information

Information classified as Confidential or Restricted, or information subject to legal, regulatory, privacy, contractual, or customer restrictions.

---

5. External Sharing Principles

External information sharing must follow:

1. Legitimate business purpose.
2. Data minimization.
3. Need-to-know.
4. Least privilege.
5. Recipient verification.
6. Appropriate authorization.
7. Secure transfer.
8. Classification-based protection.
9. Contractual and legal compliance.
10. Retention and deletion requirements.
11. Access expiry where appropriate.
12. Evidence and accountability.

---

6. Step 1 – Initiate the Data Sharing Request

The person requesting external sharing should provide:

Field	Details
Request ID	[EXT-2026-001]
Requestor	[Name]
Department	[Department]
External Party	[Organization]
Recipient	[Name/Role]
Business Purpose	[Purpose]
Information	[Description]
Classification	[Public/Internal/Confidential/Restricted]
Data Type	[Customer/Employee/Financial/etc.]
Transfer Method	[Portal/Email/API/etc.]
Required Date	[Date]
Expiry Date	[Date]

---

7. Step 2 – Identify the Information

Identify exactly what will be shared.

Consider:

• Documents
• Files
• Database extracts
• Customer information
• Personal information
• Source code
• Security information
• Financial information
• Contracts
• Audit evidence
• Credentials
• Technical configurations

Avoid vague descriptions such as:

“Customer information”

Instead specify:

“Customer support ticket export containing customer names, email addresses, ticket IDs, and support history.”

---

8. Step 3 – Determine Information Classification

Classify the information before sharing.

Classification	External Sharing
Public	Permitted when officially approved for public release
Internal	Normally not externally shared without authorization
Confidential	Specific authorization and secure transfer required
Restricted	Explicit approval and enhanced controls required

If classification is unclear, consult the Information Owner or Security/ISMS Manager.

---

9. Step 4 – Identify Data Sensitivity

Determine whether the information contains:

• Personal data
• Customer data
• Financial information
• Authentication information
• Credentials
• Source code
• Security configuration
• Vulnerability information
• Intellectual property
• Contractual information
• Regulatory information
• Confidential business information

Additional controls may be required based on the type of information.

---

10. Step 5 – Confirm Business Purpose

External sharing must have a legitimate business purpose.

Examples:

• Customer implementation
• Customer support
• Security assessment
• SOC 2/ISO 27001 audit
• Legal review
• Supplier implementation
• Regulatory reporting
• Product integration
• Technical support
• Business transaction
• Insurance assessment

Only the minimum information required for that purpose should be shared.

---

11. Step 6 – Assess the External Recipient

Before sharing sensitive information, confirm:

• Organization identity.
• Recipient identity.
• Business relationship.
• Role.
• Need-to-know.
• Authorization.
• Security requirements.
• Data-processing role.
• Geographic location where relevant.

For higher-risk sharing, perform a supplier/security assessment where appropriate.

---

12. Step 7 – Check Contractual Requirements

Before sharing information, determine whether an agreement is required.

Examples:

• NDA
• Master Service Agreement
• Statement of Work
• Data Processing Agreement
• Security Agreement
• Customer contract
• Information-sharing agreement
• Supplier agreement

Check for requirements relating to:

• Confidentiality
• Security
• Privacy
• Data location
• Subprocessors
• Retention
• Deletion
• Incident notification
• Audit rights
• Access controls

---

13. Step 8 – Privacy and Regulatory Assessment

Where personal or regulated information is involved, determine whether additional requirements apply.

Consider:

• Applicable privacy laws
• Data protection requirements
• Regulatory requirements
• Cross-border transfer requirements
• Customer requirements
• Data-processing obligations
• Notification requirements

Legal/Privacy should be consulted where the assessment is complex or high risk.

---

14. Step 9 – Obtain Approval

Approval should be based on the classification and risk.

Sharing Type	Typical Approval
Public information	Business owner/process approval
Internal information	Information Owner
Confidential information	Information Owner / designated authority
Restricted information	Information Owner + Security or designated authority
Personal/regulated data	Privacy/Legal where applicable
High-risk customer data	Business + Security/Privacy as applicable

Approval should be recorded.

---

15. External Data Sharing Approval Form

Request Details

Request ID: [EXT-XXX]
Requestor: [Name]
External Party: [Organization]
Recipient: [Name/Role]
Business Purpose: [Purpose]

Information

Information Description: [Description]

Classification: [Public/Internal/Confidential/Restricted]

Contains Personal Data: Yes / No

Contains Customer Data: Yes / No

Contains Financial Data: Yes / No

Contains Security Information: Yes / No

Assessment

Contract Reviewed: Yes / No / N/A

NDA Required: Yes / No / N/A

DPA Required: Yes / No / N/A

Privacy Review: Yes / No / N/A

Security Review: Yes / No / N/A

Cross-Border Transfer: Yes / No / N/A

Approval

Approved By: [Name/Role]

Approval Date: [Date]

Expiry Date: [Date]

Conditions: [Conditions]

---

16. Step 10 – Minimize the Data

Before sharing, remove unnecessary information.

Examples:

Instead of sharing:

Full customer database

share:

Required customer records only.

Instead of sharing:

Full employee file

share:

Required fields only.

Where practical, use:

• Masking
• Redaction
• Pseudonymization
• Anonymization
• Aggregation
• Data filtering

---

17. Step 11 – Select Secure Transfer Method

Select a transfer mechanism appropriate to the sensitivity.

Data	Preferred Method
Public information	Approved public channel
Internal information	Approved corporate system
Confidential document	Secure portal/cloud sharing
Restricted document	Restricted repository/secure transfer
Customer information	Customer-approved secure channel
Credentials	Secrets-management platform
Source code	Approved repository
API data	Authenticated encrypted connection
Physical document	Secure controlled delivery

Avoid personal email and personal cloud storage.

---

18. Step 12 – Apply Security Controls

Depending on risk, apply:

• Encryption
• MFA
• Named-recipient access
• Password protection
• Expiring links
• Download restrictions
• Read-only permissions
• Watermarking
• Data masking
• DLP controls
• Access logging
• Monitoring

---

19. Step 13 – Verify Recipient

Immediately before transfer:

• Verify email address/account.
• Verify organization.
• Verify recipient identity.
• Verify sharing permissions.
• Confirm that no unauthorized users have access.

For Restricted information, use an additional verification mechanism where appropriate.

---

20. Step 14 – Execute the Transfer

Transfer the information using the approved method.

Examples:

Secure Portal

Upload → Restrict recipient → Apply expiry → Notify recipient → Confirm access.

Secure Cloud Link

Named users → Minimum permissions → Expiry → MFA → Share → Monitor.

API

Authenticate → Encrypt → Authorize → Transfer → Log → Monitor.

Physical

Package → Secure → Track → Deliver → Confirm receipt.

---

21. Step 15 – Confirm Receipt

For Confidential and Restricted information, confirm receipt where appropriate.

Evidence may include:

• Recipient confirmation
• Portal record
• Ticket
• Email acknowledgement
• Transfer log
• API log
• Customer confirmation

---

22. Step 16 – Monitor Access

Where technically possible, monitor:

• Access
• Downloads
• Changes
• Sharing
• Administrative actions
• Failed access attempts
• Unusual activity

Investigate suspicious activity according to the Incident Response Procedure.

---

23. Step 17 – Expire or Revoke Access

After the business requirement ends:

• Revoke external user access.
• Disable sharing links.
• Remove temporary accounts.
• Delete temporary copies where appropriate.
• Revoke API access.
• Rotate credentials if required.
• Confirm data return/deletion where contractually required.

---

24. Third-Party Data Sharing

When sharing data with suppliers or service providers:

Supplier Identification → Risk Assessment → Contract Review → Data Classification → Approval → Secure Transfer → Monitoring → Access Review → Return/Deletion

Where applicable, verify:

• Security controls
• Privacy controls
• Subprocessor requirements
• Data location
• Incident notification
• Retention
• Deletion
• Business continuity
• Access control

---

25. Customer Data Sharing

Customer data should be shared externally only when:

• Contractually permitted.
• Business purpose is documented.
• Recipient is authorized.
• Appropriate security controls are applied.
• Applicable privacy requirements are satisfied.

Customer-specific transfer mechanisms should be followed where required by contract.

---

26. Auditor and Certification Body Sharing

When providing information to auditors or certification bodies:

• Confirm scope of the audit.
• Confirm authorized audit team.
• Share only relevant evidence.
• Use the approved audit repository.
• Restrict access to audit personnel.
• Protect sensitive security information.
• Remove access after the audit where applicable.
• Maintain evidence of information provided where required.

---

27. Regulator or Government Authority Sharing

Information provided to regulators or government authorities should be reviewed by the appropriate Legal, Compliance, Security, or Management function where required.

Before sharing:

• Confirm authority identity.
• Confirm legal/regulatory basis.
• Identify requested information.
• Confirm scope.
• Preserve relevant records.
• Use the approved communication channel.
• Record the disclosure.

---

28. Security and Vulnerability Information

Highly sensitive security information requires special controls.

Examples:

• Penetration-test findings
• Active vulnerabilities
• Exploitation details
• Security architecture
• Firewall configurations
• IAM configurations
• Production credentials
• Incident investigation information

Share only what is required and only with authorized recipients.

Credentials and secrets should be transferred using approved secrets-management mechanisms rather than ordinary documents.

---

29. AI and External Data Sharing

Public or unapproved AI tools must not be treated as ordinary external recipients.

Before entering organizational data into an AI service:

Identify → Classify → Verify Tool → Verify Use Case → Confirm Authorization → Minimize Data → Transfer → Review Output

Confidential and Restricted information requires specific approval before being shared with an AI provider.

---

30. Cross-Border Data Sharing

Where information is shared across countries:

• Identify countries involved.
• Identify information and classification.
• Determine whether personal data is involved.
• Review applicable privacy requirements.
• Review contractual restrictions.
• Assess data-transfer mechanisms.
• Obtain Legal/Privacy review where necessary.
• Record the decision.

---

31. External Data Sharing Register

For higher-risk or formally controlled sharing, maintain a register.

Field	Details
Sharing ID	EXT-2026-001
Date	[Date]
Requestor	[Name]
External Party	[Organization]
Recipient	[Name/Role]
Information	[Description]
Classification	[Classification]
Data Type	[Customer/Personal/etc.]
Purpose	[Purpose]
Contract	[Reference]
NDA/DPA	[Reference]
Approval	[Approver]
Transfer Method	[Method]
Protection	[Encryption/MFA/etc.]
Access Expiry	[Date]
Receipt Confirmed	Yes/No
Data Return/Deletion	[Date/Status]
Status	Active/Completed/Revoked

---

32. Incorrect or Unauthorized Sharing

If information is accidentally shared:

Report Immediately → Restrict Access → Preserve Evidence → Assess Impact → Notify Appropriate Parties → Remediate → Document → Learn

Examples:

• Wrong recipient.
• Public link accidentally enabled.
• Customer information sent to wrong party.
• Confidential document uploaded to public storage.
• Source code shared externally without approval.
• Personal data sent to an unauthorized processor.
• Restricted information entered into an unauthorized AI tool.

Do not attempt to hide or destroy evidence.

---

33. Incident Assessment

Security/Privacy should determine:

• What was shared?
• Classification?
• Who received it?
• Was the recipient authorized?
• Was the information accessed?
• Was it downloaded?
• Can access be revoked?
• Was personal data involved?
• Was customer data involved?
• Was the information encrypted?
• Is notification required?
• Are contractual obligations triggered?
• Is regulatory reporting required?

---

34. Exceptions

Any exception must:

• Have a documented business justification.
• Be risk assessed.
• Define compensating controls.
• Have an owner.
• Have an expiry date.
• Be approved by the appropriate authority.

Exception ID	Requirement	Reason	Risk	Compensating Control	Owner	Expiry	Approval
EX-001	[Requirement]	[Reason]	[Risk]	[Control]	[Name]	[Date]	[Name]

---

35. Startup-Friendly Workflow

For normal external sharing:

Need → Classify → Verify → Approve → Secure Share → Confirm

For Confidential information:

Need → Classify → Contract/Privacy Check → Approve → Secure Transfer → Confirm → Record

For Restricted information:

Need → Classify → Risk Assessment → Explicit Approval → Restricted Transfer → Strong Protection → Confirm → Record → Revoke

This provides stronger controls for high-risk information without creating unnecessary bureaucracy for routine business communication.

---

36. Evidence and Records

Potential evidence includes:

• External Data Sharing Register
• Data-sharing approvals
• Information classification records
• Contracts
• NDAs
• DPAs
• Supplier assessments
• Customer agreements
• Transfer logs
• Secure portal records
• Access-control records
• Encryption evidence
• DLP alerts
• Receipt confirmations
• Data deletion/return confirmations
• Access revocation records
• Incident records
• Exception approvals

---

37. Responsibilities

Role	Responsibility
Information Owner	Approves classification and sensitive sharing
Requestor/Sender	Initiates request and verifies information/recipient
Security/ISMS	Assesses security risks and controls
Privacy/Legal	Reviews applicable legal/privacy requirements
Procurement	Manages supplier-related requirements
IT/Cloud	Provides secure technical transfer mechanisms
Recipient	Protects information after receiving it
Management	Approves significant/high-risk sharing
Internal Audit	Verifies effectiveness of applicable controls

---

38. Common Mistakes

Avoid:

• Sharing data because a customer or supplier simply requested it without checking authorization.
• Sending more data than necessary.
• Using personal email.
• Creating public cloud links.
• Forgetting to check CC/BCC recipients.
• Sharing customer data without checking contractual requirements.
• Sharing personal data without considering privacy requirements.
• Sending credentials through email.
• Giving third parties permanent access.
• Failing to revoke access after project completion.
• Uploading confidential information to unapproved AI tools.
• Failing to retain evidence for significant transfers.

---

39. Relationship With Other ISMS Documents

This procedure should operate together with:

• Information Security Policy
• Information Classification Policy
• Data Handling Guidelines
• Information Handling Procedure
• Information Transfer Policy
• Secure Information Transfer Procedure
• Restricted Document Template
• Access Control Policy
• Data Inventory
• SaaS Application Register
• Supplier Security Assessment
• AI Acceptable Use Policy
• Remote Working Policy
• Incident Response Plan
• Data Breach Response Procedure
• Regulatory Compliance Register
• Risk Register

The overall control chain is:

Data → Classification → Purpose → Recipient → Contract/Legal Check → Approval → Secure Transfer → Monitoring → Access Removal → Return/Deletion → Evidence

---

40. ISO 27001 Connection

This procedure may support applicable requirements relating to:

• Information transfer
• Information classification
• Access control
• Access rights
• Data leakage prevention
• Supplier security
• Cloud service security
• Privacy and protection of personal information
• Secure disposal
• Logging and monitoring
• Incident management

The organization should determine the exact applicable controls through its risk assessment and Statement of Applicability (SoA).

---

41. Review and Maintenance

This procedure should be reviewed:

• According to the organization’s ISMS review cycle.
• After significant data-sharing incidents.
• When new external service providers are introduced.
• When new customer requirements are introduced.
• When data-processing activities change.
• When applicable laws or regulations change.
• After significant audit findings.

---

42. Final Audit Trail

A complete external data-sharing activity should be traceable as:

Business Need → Data Identified → Classification → Recipient Assessment → Legal/Contractual Review → Approval → Data Minimization → Secure Transfer → Receipt → Monitoring → Access Removal → Return/Deletion → Evidence → Review

Final Principle

Share only what is necessary, with only the right external party, for an authorized purpose, using an appropriately secure method — and know when that access must end.