Sharing information outside of HMRC: procedural guidance: record of disclosure
If you make any form of information disclosure, you must keep a full record of that disclosure.
This is important so that you can demonstrate an audit trail, should there be an appeal or other consequences following your actions. Additionally, the penalties for wrongful disclosure are personal to you, see IDG40130. Therefore it is important that you are personally able to provide evidence to support the fact that a disclosure has been properly made.
When information is disclosed a record must be retained of:
- the recipient
- the purpose of the disclosure
- the authority under which the disclosure was made, for example by a legal gateway or with the customer’s consent. See IDG40300 for ways in which disclosures may be made lawfully.
- if a legal gateway was used, which one
- any considerations and judgements made on proportionality (see IDG40140)
- the material disclosed
- any restrictions imposed on further use of the material
- on the rare occasions a public interest disclosure was made, records must be kept as specified in the public interest guidance (see IDG60000).
Records must be retained for a minimum of 3 years.
Local senior management assurance
In all cases a system of assurance must be in place to enable local senior management (at not less than Grade 7 level) to verify, when required, that disclosures have been carried out in accordance with this guidance. Any irregularity or other problem revealed by the management assurance process must be escalated through the management chain in line with established procedures.
Child Benefit Office
Please note that Child Benefit Office (CBO) have a policy of 14 months for document retention, and for CBO staff this overrides guidance to the contrary in this section.
For further guidance and assistance generally on confidentiality please contact your Data Guardian.