Privacy policies describe states. Real exposure is created by movement. A document leaves the private office for a lawyer. A bank requests identity evidence. A doctor sends a report. A transaction team opens a data room. An assistant forwards a message to a household provider. Each party may be trusted. Each system may be defensible. The handoff between them can still collapse the boundary. Wrong recipient, wrong version, excessive context, personal email, open link, indefinite access, uncontrolled download: these are not exotic attacks. They are ordinary work performed without a transfer discipline.
The sender and recipient see different risks
The sender thinks about the information being delivered. The recipient thinks about the task to be completed. Neither may consider the new copy that now exists, the people who administer it, the retention rule that applies or the route through which it can be forwarded again. A secure transfer therefore requires more than encryption. Encryption protects a channel or object. It does not decide whether the transfer should occur, whether the recipient is correct, whether the package contains too much or what happens after use.
Treat every material handoff as a temporary trust expansion
When information crosses into another organisation, device or system, the institution expands the number of people and mechanisms capable of affecting it. Before the handoff, establish:
- Purpose: the specific task requiring the information.
- Minimum content: the least information capable of completing that task.
- Recipient identity: the named person or controlled group, verified independently for sensitive transfers.
- Permitted use: what may be done and what may not be inferred, combined or forwarded.
- Duration: when access or possession should end.
- Return path: how corrections, results and final records come back.
- Evidence: what proves delivery, access change and final disposition.
Context is often the real leak
A team may carefully redact a document and then reveal the same fact in the filename, email thread, folder name or surrounding correspondence. A calendar invitation can expose the relationship. A data-room index can reveal the transaction. A request to a specialist can disclose a medical or legal issue before the attachment is opened. Review the envelope as well as the content: subject line, participants, metadata, access notification, download naming and audit trail.
Value object — The Sensitive Handoff Card
For a consequential transfer, attach a one-screen instruction card:
- Information: what is being transferred and its classification.
- Purpose: the exact work authorised.
- Recipient: named people, organisation and verified channel.
- Restrictions: no forwarding, no local copy, no model processing, no new recipient or other relevant boundary.
- Expiry: access end date or completion event.
- Owner: the person who confirms return, retention or deletion.
- Incident route: whom the recipient contacts if the package is misdirected, exposed or unavailable.
The card can live in a workflow, not necessarily as a literal attachment. Its value is that the transfer decision becomes visible and repeatable.
Design for correction and recall
A wrong file or wrong recipient will eventually occur. The quality of the privacy system is revealed by what happens next. The sender should be able to revoke access, identify who opened or downloaded the material, issue a corrected version and reach a real person at the receiving organisation. For extremely sensitive work, prefer controlled access over permanent attachment and prevent local export where the task allows.
Do not confuse a contract with a handoff control
Confidentiality clauses and data-processing terms establish obligations. They do not prevent an assistant from forwarding the wrong thread or a recipient from storing the only usable copy in an unmanaged workspace. Contract, technology and operating behaviour must reinforce one another. The institution should test the actual transfer route used by people under time pressure, not merely review the approved platform.
The boundary is an event
Privacy is often imagined as a wall around information. A better model is a series of decisions made whenever the information moves, changes form or gains a new audience. Protect the handoff and the boundary becomes real. Ignore it and the institution’s strongest system will be defeated by the first necessary act of collaboration.