IDG42050 - General procedural guidance when making any form of disclosure: Record keeping when making disclosures

If you make any form of information disclosure, you must keep a full record of that disclosure.

This is important so that you can demonstrate an audit trail, should there be an appeal or other consequences following your actions. Additionally, the penalties for wrongful disclosure are personal to you, see IDG40750. Therefore it is important that you are personally able to provide evidence to support the fact that a disclosure has been properly made.

When information is disclosed a record must be retained of:

• the recipient
• the purpose of the disclosure
• the authority under which the disclosure was made, for example by a legal gateway or with the customer’s consent. See IDG40500 for ways in which disclosures may be made lawfully.
• if a legal gateway was used, which one
• any considerations and judgements made on proportionality (see IDG41050)
• the material disclosed
• any restrictions imposed on further use of the material
• on the rare occasions a public interest disclosure was made, records must be kept as specified in the public interest guidance (see IDG46050).

Records must be retained for a minimum of 3 years.

Local senior management assurance

In all cases a system of assurance must be in place to enable local senior management (at not less than Grade 7 level) to verify, when required, that disclosures have been carried out in accordance with this guidance. Any irregularity or other problem revealed by the management assurance process must be escalated through the management chain in line with established procedures.

Child Benefit Office

Please note that Child Benefit Office (CBO) have a policy of 14 months for document retention, and for CBO staff this overrides guidance to the contrary in this section.

Further guidance

For further guidance and assistance generally on confidentiality, contact KAI Knowledge Resources (see IDG90100).