Restricted Subject Handling

Restricted subject information needs a clear operating purpose and an accountable custodian. The Data Custodian records the subject code, identity reference and access purpose, then reviews the retention date alongside any legal hold. An access grant identifies the person, purpose and expiry so colleagues can understand why the information is available for the work.

A disclosure has a different record. It identifies the recipient, time, scope and authority reference for information that was shared. Keeping those details separate helps the custodian explain both internal access and the basis of an external disclosure without treating either as a general permission to reuse subject information.

• Subject record. Keep a stable subject code and an identity reference that authorized staff can resolve. State the access purpose clearly enough for a later custodian to understand the intended work. Review the retention date together with the legal-hold flag.
• Access grant. Identify the team member receiving access and record the approved purpose, expiry and approver. The Data Custodian checks that the grant fits the intended subject and person. An expired grant belongs in the review queue before access continues under a renewed decision.
• Disclosure record. Record the recipient and the actual scope of an authorized disclosure. Retain its authority reference and disclosure date so the team can explain what was shared and why. Access to a subject does not itself supply disclosure authority.

Ask the customer to define its access policy, retention handling and disclosure authority. Configure those decisions with the Data Custodian and Admin before using real subject information. Confirm how team-member identities are matched and how the approved purpose limits the work people can perform.

Agree where identity references and authority references lead. Check that permitted colleagues can inspect the necessary material while other users cannot obtain it through a direct record or file request. A retention date prompts review; it does not resolve a legal hold or authorize deletion by itself.

Use a synthetic subject under legal hold with a retention date that has arrived. The Data Custodian reviews the record and keeps the hold visible. A team member requests access for a particular assessment task. Record the approved purpose and expiry, then rehearse what happens when the grant expires and the person tries to continue the work.

Next, rehearse an authorized disclosure limited to the agreed scope. Record the recipient and authority reference, and ask another permitted custodian to reconstruct the decision. The handoff succeeds when that person can distinguish the access approval from the disclosure authority and see why the subject remains under hold. Review direct access with an unrelated account before introducing live information.

• Restricted Subject Retention — Review subjects whose retention date has arrived, keeping legal holds visible.
• Expired Access Grants — Inspect grants whose expiry date has arrived by subject, recipient and stated purpose.

Use subject access and disclosure and access rehearsal before the first operating cycle.