We are often asked by organisations what information they are permitted to share with colleagues at different stages of the INWO process.
The answer is case dependent, but our general approach is the same:
-
We gather information in a sensitive way that respects the confidentiality of the person who has raised a concern, and those involved in the investigation.
-
In particular, we are mindful that, where the information involves personal data, there must be a lawful basis for processing the data (A guide to lawful basis | ICO).
This diagram sets out what you need to think about at each stage of our involvement.
Top tips
-
Always consider what is the minimum level of information you need to share internally when responding to an INWO enquiry.
-
Never routinely or automatically share the name of the person raising the concern at any point, either during the investigation or afterwards.
-
Take care when forwarding emails that you have the addresses correct and have not included someone in the chain of emails who should not have received the confidential content.
-
Share links rather than documents wherever possible to minimise the risk of multiple versions of a document being created and shared around the organisation.
-
Talk to us if you are in any doubt. The INWO team will always be happy to speak with you about the best approach for a specific case.