Collect only what you need
List the information collected on each form and explain why each field is needed. Remove fields with no clear purpose. Make optional fields clear, and explain intended use before collection.
Try this:
Assign an owner, record the current practice and agree one improvement to review with your team.
Keep access under control
Give staff access according to their duties. Review shared folders, exports and administrator permissions. Remove access when someone leaves or changes role, and review access regularly.
Try this:
Assign an owner, record the current practice and agree one improvement to review with your team.
Set sensible retention periods
Identify the legal, contractual and business reasons for keeping each category of record. Agree retention periods and review dates. Include copies, exports and supplier-held records in deletion planning.
Try this:
Assign an owner, record the current practice and agree one improvement to review with your team.
Review suppliers before sharing data
Record what a supplier receives, why they need it, where it is processed and who else can access it. Review security, contracts, incident reporting, return of records and deletion at the end of the service.
Try this:
Assign an owner, record the current practice and agree one improvement to review with your team.
Prepare for information requests
Give staff a clear route for requests about personal information. Record the request, verify identity proportionately and assess applicable duties and deadlines. Seek advice before withholding information or sharing third-party records.
Try this:
Assign an owner, record the current practice and agree one improvement to review with your team.