Recruitment, finance and business support can involve personal or commercially sensitive information. Before delivery begins, the parties need a documented approach to access, permitted use, approved systems and the handling of requests or incidents.
Agree roles and instructions
Clarify which organisation determines how information is used and which activities the service team is instructed to perform. Identify data categories, approved purposes, delivery locations and any third parties. Appropriate contractual and information-handling terms need to be settled before candidate, worker, customer or financial records are shared.
Limit access and unnecessary movement
Provide the access needed for the task and keep information within approved systems where possible. Sensitive documents, financial changes and privileged system actions need specific handling and authorised reviewers. Do not use the public enquiry form for CVs, payroll records, bank details, identification documents or health information.
- Approved systems and proportionate permissions
- Defined retention and deletion instructions
- A route for requests and incident escalation
Agree information-handling controls
Establish the controls, evidence and review rights needed for each scope, including any cross-border handling. This page outlines subjects for agreement; it does not replace the final contract, privacy information or a specialist assessment of the arrangement.
