Below is an example policy you can adapt for a campground. It is aligned with ISO/IEC 27001:2022 Annex A control 5.14, “Information transfer”: organizations should establish information-transfer rules, procedures, or agreements for transfers within the organization and with external parties. The protection must reflect the information classification and address risks such as interception, unauthorized access, modification, misdirection, loss, and inability to prove delivery.[educacao.pr.gov][isms]

Information Transfer Rules

Document owner: Information Security Coordinator / Campground Manager

Approved by: Owner / General Manager

Applies to: Employees, seasonal staff, contractors, volunteers, and suppliers

Related controls: Information classification, access control, supplier security, encryption, incident management, privacy and retention

Review cycle: At least annually and after a material incident or system change

1. Purpose

These rules ensure that information transferred by, to, or on behalf of [Campground Name] is protected against unauthorized access, disclosure, alteration, loss, misdirection, interception, or destruction.

They apply to information sent:

• Internally between staff, departments, devices, or sites.
• Externally to guests, suppliers, booking platforms, payment providers, accountants, insurers, authorities, emergency services, and other third parties.
• Electronically, physically, or verbally.

2. General Rules

1. Transfer information only where there is a legitimate business purpose and the recipient is authorized to receive it.
2. Apply safeguards proportionate to the classification of the information. Public information may use ordinary approved communication channels; confidential and restricted information requires stronger controls.
3. Use only approved business accounts, systems, and transfer methods. Personal email accounts, private cloud storage, unapproved file-sharing services, and personal messaging applications must not be used for campground information.
4. Before sending information, confirm:
   • The recipient’s identity and contact details.
   • That the recipient needs the information.
   • That the correct files, records, and version are being transferred.
   • That the selected method provides adequate protection.
   • That no unnecessary personal, payment, security, or operational data is included.
5. Do not transfer more information than necessary. Where possible, remove or mask personal data, booking references, account details, access codes, or other sensitive fields.
6. Transfers of confidential or restricted information must be traceable. The sender must be able to show what was sent, to whom, when, by which method, and—where required—that it was received.