Data protection and security

GOV.UH Forms provides the common technical platform. The organisation delivering the underlying service remains responsible for deciding what information it needs and how that information is used.

Data protection

Before publishing a form, the service-owning organisation must:

• identify the purpose and authority for collecting personal information
• collect only the information needed for the service
• provide accurate privacy information
• restrict access to submissions to authorised people
• apply its records and retention requirements
• provide the appropriate route for information rights requests

Security

Use GOV.UH Forms only from authorised work accounts and devices and follow your organisation’s security requirements.

Do not use a form for information that the service is not authorised or equipped to handle. If the service involves sensitive, safeguarding or security-relevant information, the responsible organisation must put the necessary handling and escalation arrangements in place before publication.

Report suspected compromise through your organisation’s security or incident-management route and the published Government Digital Service contact route where the Forms platform itself is affected.