IDG40210 - Sharing information outside of HMRC: procedural guidance: record of disclosure
If you make any form of information disclosure, you must keep a full record of that disclosure.
This is important so that you can demonstrate an audit trail, should there be an appeal or other consequences following your actions. Additionally, the penalties for wrongful disclosure are personal to you, see IDG40130. Therefore it is important that you are personally able to provide evidence to support the fact that a disclosure has been properly made.
When information is disclosed a record must be retained of:
- the recipient
- the purpose of the disclosure
- the authority under which the disclosure was made, for example by a legal gateway or with the customer’s consent. See IDG40300 for ways in which disclosures may be made lawfully.
- if a legal gateway was used, which one
- any considerations and judgements made on proportionality (see IDG40140)
- the material disclosed
- any restrictions imposed on further use of the material
- on the rare occasions a public interest disclosure was made, records must be kept as specified in the public interest guidance (see IDG60000).
Records should in principle be retained for 3 years, however regular reviews should be carried out to ensure information is only retained for as long as there is a business need or legal requirement to do so.
Internal users; Guidance on good retention practice, records management and disposal can be found on the intranet.
Local senior management assurance
In all cases a system of assurance must be in place to enable local senior management (at not less than Grade 7 level) to verify, when required, that disclosures have been carried out in accordance with this guidance. Any irregularity or other problem revealed by the management assurance process must be escalated through the management chain in line with established procedures.
Child Benefit Office
Please note that Child Benefit Office (CBO) have a policy of 14 months for document retention, however regular reviews should be carried out to ensure information is only retained for as long as there is a business need or legal requirement to do so.
Insolvency Matters
Please note that for disclosures involving insolvency a form is available to record your decision making- internal users please search for this on the intranet.
Further guidance
For further guidance and assistance generally on confidentiality please contact your Security & Information Business Partner (SIBP),