When authorities ask for data.
WHAT TO ESTABLISH FIRST
What is being requested, by whom, under what authority.
WHY
Not every request carries legal force.
WHAT TO CHECK
Whether it is a formal order or an informal request Whether the requesting body has jurisdiction Whether the scope is defined
WHAT TO DO
Route it to a designated person, immediately.
WHAT NOT TO DO
Have support staff respond Provide data because the request sounded official
WHY
Improper disclosure is itself a breach, and impersonation occurs.
WHAT TO VERIFY
The identity and authority of the requester.
WHAT TO CONSIDER
Whether you may or must inform the individual.
WHY THAT VARIES
Some orders prohibit disclosure; others do not.
WHAT TO PROVIDE
Only what is within scope.
WHY NOT MORE
Over-disclosure is a breach.
WHAT TO RECORD
The request, the authority, what was provided, and who approved it.
WHAT TO PREPARE IN ADVANCE
A procedure, and a designated contact.
WHY IN ADVANCE
These arrive with urgency and pressure.
WHAT TO TAKE ADVICE ON
Anything unclear, or any request from a foreign authority.
WHAT TO PUBLISH, IF YOU CHOOSE
Aggregate figures about such requests.
