Public body data and transparency

Two quick questions so we only show what's relevant to your organisation. These aren't scored.

1. Does your organisation share personal data with other public bodies, or receive it from them, outside a specific statutory scheme?
2. Is your organisation a State body covered by the Code of Practice for the Governance of State Bodies?

FOI and good records management go together. You can't release, or protect, what you can't find.

1. Has the organisation published an FOI publication scheme under section 8 of the Freedom of Information Act 2014, and reviewed it in the last year? FOI officer
2. Has the organisation published its section 15 reference book and section 16 manual of rules and guidelines used in decisions affecting the public? FOI officer
3. In the last 12 months, how often were FOI decisions issued within the statutory four weeks? FOI officer
4. Does the organisation publish an FOI disclosure log of non-personal requests and decisions? FOI officer
5. Does the organisation have a records management policy and retention schedule that cover email, shared drives and line-of-business systems, not just paper? Records manager

From the help text

Section 8 requires FOI bodies to publish information proactively in line with the model publication scheme. 'Yes' means a current scheme on your website with working links.

These questions apply because you share personal data with other public bodies.

Asked only if you answer “Yes” to: Does your organisation share personal data with other public bodies, or receive it from them, outside a specific statutory scheme?

1. Where you rely on the Data Sharing and Governance Act 2019, is each arrangement covered by a data sharing agreement that went through public consultation and Data Governance Board review, and is published? Data Protection Officer
2. For every arrangement not under the Act, have you recorded the specific statutory basis that allows the sharing? Data Protection Officer
3. Is only the minimum data shared, by secure means, with access logged on both sides? IT lead
4. When did you last review your data sharing arrangements to confirm they're still needed and working as agreed? Data Protection Officer

From the help text

The Act sets a formal process for data sharing agreements, including consultation, review by the Data Governance Board and publication. 'Yes' means every arrangement under the Act has been through it.

Duties that show the public the organisation is run openly and fairly.

1. Does the organisation have internal reporting channels and procedures under the Protected Disclosures Act 2014, as amended in 2022, including acknowledgement within seven days and feedback within three months? CEO or Secretary General
2. Has the organisation published the list of its designated public officials for lobbying purposes, as section 6(4) of the Regulation of Lobbying Act 2015 requires? Corporate governance lead
3. Are annual statements of interests collected from people in designated directorships and positions under the Ethics in Public Office Acts? Corporate governance lead
4. Has the organisation assessed the equality and human rights issues relevant to its functions, and set out how it addresses them in its strategic plan and reports on progress in its annual report? CEO or Secretary General
5. Do your websites and apps meet the accessibility requirements for public sector bodies, with a published accessibility statement and a way for people to report problems? Digital lead

From the help text

All public bodies must have formal channels, regardless of size, and publish an annual report on disclosures received. 'Yes' means a written procedure, a designated person, the statutory timelines and the annual report.

These questions apply because the Code of Practice for the Governance of State Bodies covers your organisation.

Asked only if you answer “Yes” to: Is your organisation a State body covered by the Code of Practice for the Governance of State Bodies?

1. Does the Chairperson's comprehensive report to the Minister confirm compliance with the Code, and are any departures explained? Chairperson
2. Is there a risk management framework with a risk register that includes data protection, cyber security and information risks, reviewed by the Audit and Risk Committee? Chief Risk Officer
3. When did the board last carry out an evaluation of its own performance? Chairperson
4. Does the board receive at least an annual report on data protection, FOI and protected disclosures? Board secretary

From the help text

The Code expects a yearly confirmation of compliance, with reasons for any departure. 'Yes' means the latest report did this.

Close with the safeguards that protect the data and the sign-off that makes your passport count.

1. Does the organisation have a breach procedure that ensures risky breaches are reported to the Data Protection Commission within 72 hours and affected people are told when the risk is high? Knock-out Data Protection Officer
2. Has the organisation assessed itself against the NCSC's cyber security guidance for the public service, and is there a plan for the gaps? IT lead
3. Do contracts with suppliers who process personal data include the Article 28 terms, and are data protection and security requirements built into tenders? Procurement lead
4. I confirm these answers reflect the organisation's current position and have been reviewed by the DPO and FOI officer. CEO or Secretary General

From the help text

'Yes' means a written procedure, a named decision-maker, the DPO's involvement and a breach register.