Use information for an agreed purpose. Before collecting or sharing personal data, understand why the task requires it and follow your organisation’s instructions. Avoid adding unnecessary details to a record or retaining extra copies simply because they might be useful later.
Check the recipient and the access. Review who needs the information before sending a message or sharing a file. Confirm addresses, attachments and access permissions. Use the approved sharing method, especially where information is sensitive or a file is being sent outside the organisation.
Keep work in approved systems. Store records where the business has agreed they should be held. Avoid creating uncontrolled copies in personal accounts or unapproved services. Follow the organisation’s arrangements for secure access, device use and working away from the office.
Keep records accurate and manageable. Correct mistakes through the approved process and refer questions about retention or deletion to the responsible team. Do not decide a new retention period on your own or remove records that the organisation needs to preserve.
Recognise incidents early. A misdirected email, lost device or unexpected access request should be raised through the internal incident route. Give the responsible team the information it needs to assess what happened. Do not assume that a small mistake is too minor to report.
Build the habits into training. Use realistic examples of sending, storing and finding customer information. Ask learners to demonstrate the approved process and explain who they would contact if they were unsure. The instructions should reflect the systems and rules that actually apply to the organisation.
A daily handling checklist
Subscribe to our newsletter
Thank you!
Created with
