How to use Transfer Shield to safeguard PII file transfers

The use of users' Personally Identifiable Information (PII) is regulated much more nowadays than it used to be. With data protection frameworks like GDPR, HIPAA, and CCPA now in place, consumers have more protections and control over data than ever before. 

This has also led to a widespread crackdown on how personal information is stored, distributed, and transferred. In many parts of the world, users have the right to know exactly which information about them is being collected and demand that it be released or deleted. Since PII can refer to any information that can refer back to a specific individual, it can be challenging to ensure that it isn't flowing through your systems and being stored in places it shouldn't. 

Instead of manually having to sift through PII requirements to ensure compliance for file transfers, Couchdrop has a simple way to facilitate data privacy requirements through Transfer Shield DLP. 

Using Transfer Shield for PII file transfers 

Couchdrop's Transfer Shield can help companies maintain compliance, especially when the transfers involve external parties that the organization has no control over. The data loss prevention feature can check files in motion for PII markers and flag them, then either allow them through, deny them, or hold them in quarantine for manual review. 

In this guide, we'll show you how to use the PII template in Transfer Shield to set scanning rules and use them to automate file transfers with conditional filtering.

Add PII Rules

The first step for safeguarding PII file transfers is to turn on the PII rules for Transfer Shield. This must be done by an account admin within the Admin Panel within the Transfer Shield settings. 

Since PII is one of the most common types of sensitive data, we have a template you can use to quickly isolate PII content and decide how to handle it. Selecting this rule immediately creates predefined rules for specific content types to be denied, including driver's licenses, banking information, emails, and more.

While the template blocks common, known PII, it is customizable so you can add or remove content from the list in case to match your use case. You can also explicitly allow PII in case a folder is expecting those types of files.

If you don't want to explicitly deny PII, but would instead want a manager to approve the transfer, you can enable the option to allow approval override. 

Choose folders to apply the rule to

By default, Transfer Shield works at the folder level. Once you create rules, you can apply them to folders from the file browser by choosing to manage a folder and going to the options for content rules. First, enable content classification, then select the PII rule you set up to have the rules take effect on that folder immediately. 

Multiple rules can also be added to a single directory. For example, if you want to deny PII and also video files, you can create a separate rule that excludes video filetypes, then add both rules to one directory. 

This flexibility means different folders can have different rules, and since the file browser can work as a virtualization layer for your existing storage accounts, you can essentially add content rules to storage platforms that don't support this natively, like Dropbox Business. You can also limit file types and content for specific platforms using this method, such as allowing PII in a specific SharePoint site but not when transferring to an external partner's SFTP server. 

If you want to add content rules to all directories, you can override the default behaviour and have content classification for the entire account by enabling options in Global Content rules. Here, if you select the rule group you created for PII, those rules will apply to all transfers and all directories in the account. 

Transferring files with content rules

Once you've added the content rules to your folder, they take effect immediately. This means that the actions you configured will begin happening immediately. 

For files that you set to allow, there should be no noticeable difference. Files will be able to be transferred as normal. 

Denials will have an immediate impact. Files that meet your denial criteria will be caught and denied from being transferred to the endpoint with a note in your activity log that the transfer failed because of the DLP rules. Files that are denied are automatically deleted and never touch your endpoint. 

Combining PII rules with automations

When you have the PII rules in place, they apply to any method of transferring files into the folder, including Upload Portals, Mailboxes, receiving files via SFTP, and others. 

Automations that you have in place involving that folder will take on the PII rules immediately. Any new workflows you build will also have those rules apply. This means that your organization is instantly safeguarded with PII file transfers and can create automated transfer and file processing workflows that meet your requirements. 

Try Couchdrop for secure file transfers involving PII

Whether you want to explicitly include or deny PII, Transfer Shield can help make sure all transfers are secure and compliant. Simply create your content rules, apply them to folders, and set up your transfers, and Couchdrop will handle the rest. 

You can try setting up PII content rules yourself and see how easy it is. To get started, simply request access to Transfer Shield and our team will activate it on your account so you can create content rules to safeguard your file transfers.