Re: 'Information governance'

[vonbraunbates]

Problem with 'Information governance' (https://user-guidance.analytical-platform.service.justice.gov.uk/information-governance.html)

Users are asking for more explicit info on what governance forms are required when. I suggest we add something explicit for the addition of new datasets onto the AP:

1. Create a OneTrust account by emailing the Data Protection Team <dataprotection@justice.gov.uk>
2. Under “assessments automation” create and complete a new data movement form (to move data onto the AP)
3. Complete a new “asset registration form” (to store data on the AP)
4. Complete a new screening DPIA (for personal data)
5. You may be asked to complete a full DPIA depending upon the outcome of step 4.

[vonbraunbates]

And to export data from the AP another data movement form is required.

I am not sure whether this is needed for moving data to local devices (e.g. this request on Slack). Suggest we get an official steer from Data Protection before clarifying this in the guidance.