Digital Rights Management for File Transfer

Executive Summary

Digital Rights Management (DRM) are the controls a user can apply to a file that restrict certain actions undertaken by the recipient. These restrictions applied to the transferred file can limit downloading and printing, helping protect sensitive information beyond initial delivery. Restrictions are chosen by the sender and can be applied per file transfer, rather than automatically applied. The way the sender intends the recipient to use the file often decides which restrictions, if any at all, should be applied.

Key Takeaways

Digital Rights Management applies restrictions to a transferred file that can limit downloading and printing, helping protect sensitive information beyond initial delivery.
Encryption, Digital Rights Management, file or message recall and file expiry are all different concepts. Encryption protects the file in transit and at rest. Digital Rights Management limits what the recipient can do with the file after it has been sent. Recall and expiry can be applied to restrict access to the file when the sender decides.
Watermarks can prove a file is a copy in the event of a data breach to prove it wasn’t the person that shared the document that caused the breach.
Restrictions are applied on a per transfer basis, allowing users to explicitly decide where to apply DRM.

What is Digital Rights Management?

Digital Rights Management is a set of restrictions attached to a file that limit what can be done with it. For a File Transfer or File Sharing platform, those restrictions govern whether the file can be downloaded and printed.

The same term is used about consumer media, where it describes the controls applied to music, film and eBooks. The principle is the same but what differs is the subject. In File Transfer, the protected item is a business document or sensitive data, and the person applying the restriction is the user or organisation sending it rather than a publisher.

What restrictions does Digital Rights Management apply?

Typically, without the use of DRM, sending a file allows the recipient to open, save, print and send on with the sending organisation having no further say in any of it.

Digital Rights Management changes that. It lets you decide what a recipient can do with a file - for example, view it in a secure portal viewer with no ability to download, save or print it. The restrictions are important tools used to help protect sensitive information beyond initial delivery.

Restrictions sit alongside authentication and the audit trail rather than replacing them. Recipients are authenticated to decide who can open the file. Only the intended recipient can access shared files, with configurable authentication methods to suit the organisation's security. The audit trail ensures a clear understanding of what happened to the file: it records every transfer, view and download so you can always evidence how sensitive information was handled.

How Digital Rights Management differs from encryption, recall and a file expiry date

Control	What it does	When it applies	What the recipient can do
Encryption	Protects the file against being read as it moves between systems.	In transit (and at rest if the data is being stored).	No restriction on the recipient.
Digital Rights Management	Limits the actions available to the recipient: downloading and printing.	When it is received by the recipient.	Only the actions that have not been restricted by the sender.
Recall	Removes the recipient's access to a transfer.	On demand, including after the transfer has been delivered.	Nothing, once the transfer has been recalled. However, they may have already downloaded the file.
File expiry	Ends the file's availability on a schedule set in advance.	Whenever the sender specified.	Nothing, once the file has expired. It may still be usable if the recipient downloaded it before the expiry date.

Why Digital Rights Management applies to file transfer suppliers

Under UK GDPR, personal data must be processed in a way that ensures appropriate security, using appropriate technical or organisational measures. The ICO describes the goal of those measures as ensuring that data can be accessed, altered, disclosed or deleted only by people the organisation has authorised, and that those people only act within the scope of the authority given to them.

That second half is the part a file transfer platform can act on. Authenticating the recipient establishes who is authorised. Restricting what the recipient can do with the file is how the scope of that authority is enforced on a file that has left the organisation.

The clearest case for DRM is a file leaving the organisation for people whose systems it does not administer. For example, an NHS organisation disclosing records containing patient identifiable data to an external party cannot manage what happens on the recipient's systems.

business-meeting-in-a-glass-panelled-room-4-people

When to apply restrictions, and when not to

There is typically two questions which help a sender identify when to apply DRM to a transfer.

The first is whether the recipient must work on the file. A document that has to be edited, annotated and returned must be downloaded, and restrictions would obstruct the task. A document that only has to be read, checked or referred to does not.

The second is what would follow if a copy went further than intended. Where the file contains personal data, restrictions are worth applying even where the recipient is trusted, because the control removes the route rather than relying on the recipient's handling of the file.

Where neither question applies, encryption alone is usually sufficient. Applying restrictions to every transfer as a matter of habit can produce frustration from recipients who legitimately need a copy.

How to choose a File Transfer platform with Digital Rights Management

Which actions can be restricted

Confirm whether the platform can limit downloading and printing.

Whether restrictions are chosen per file

A control applied to everything is harder to use than one where the sender selects which restrictions should be applied by file or transfer. Some providers, AMS File Transfer included, offer digital rights management as an optional control.

Where the file is opened

Ask whether a restricted file is downloaded to the recipient's device or read in the solution’s built-in viewer.

Whether access can be removed after delivery

Restricting what a recipient can do with a file is a different solution than removing their access to it. Ask whether a transfer that has already been delivered can be recalled.

Additional Checks

Encryption, authentication, audit logging and retention should be checked as well. They apply to any sensitive disclosure rather than to Digital Rights Management specifically.

How AMS Secure Cloud approaches Digital Rights Management

AMS File Transfer can apply restrictions when necessary to limit downloading, and printing, helping protect sensitive information beyond initial delivery. Digital Rights Management lets you decide what a recipient can do with a file — for example, view it in a secure portal viewer with no ability to download, save or print it. It is an optional control, applied per transfer by the sender rather than by default.

Recall and lifecycle rules. You can recall a transfer and remove access even after it has been delivered. Automated rules help manage file expiry, deletion and lifecycle handling, reducing manual effort and the risk of human error.
Encryption and authentication. All data is encrypted in transit and at rest, two way file delivery and sharing is protected with 256 bit AES encryption. Only the intended recipient can access shared files, with configurable authentication methods to suit the organisation's security policy.
Audit trail and retention. Every action is recorded, providing a clear, traceable history of file access, sharing and activity, with a full audit trail of the transfer or sharing process end to end. If a customer were to ever leave AMS. On contract termination, customer data is securely deleted from AMS systems within 60 days, in line with the AMS retention and disposal policy.
Hosting and certification. All AMS Secure Cloud solutions are hosted in Microsoft Azure UK datacentres. AMS is ISO 27001 and Cyber Essentials certified, and holds a published NHS DSPT status of Standards Met for 2025-26.

Amongst other regulated industries, AMS File Transfer is heavily used across NHS and healthcare environments for the secure handling of patient identifiable and highly sensitive data. Many customers use the platform for point to point encrypted transfer when disclosing files as part of processes, such as Subject Access Requests, Complaints and Litigations Requests, most of which contain PID or extremely sensitive data.

Certifications & Standards

We maintain internationally recognised certifications and accreditations that demonstrate our commitment to security.

ISO 27001

Certified Information Security Management System

Cyber Essentials

Demonstrating core security controls

NHS DSPT

Compliant the NHS Data Security and Protection Toolkit