Repository navigation
Update MOU notice periods and response data security - #3265
Merged
theseanything merged 4 commits intoOct 29, 2026
Merged
theseanything merged 4 commits into
theseanything merged 4 commits into
Conversation
The MOU introduced GDS without saying which department it belongs to. Naming DSIT makes it clear who the other party to the agreement is, which matters because the DSIT Data Protection Officer is the contact for data protection issues later in the document.
Previously every change to the MOU needed 30 days' notice, sent only to the person who agreed it, and an organisation that rejected a change had the MOU terminated with immediate effect. That doesn't match how changes are made in practice, and ending the agreement immediately would leave published forms with no MOU covering the data they collect. GDS now aims to give 15 days' notice of sub-processor or hosting region changes and 6 months' notice of pricing changes. Notices go to the people who agreed the MOU and/or the current Organisation Admins, and take effect immediately unless the email says otherwise. An organisation that rejects a change must unpublish its forms, and the agreement only ends once GDS has stopped processing data for it. The new clauses shift the numbering of later items, so the reference to the GDS contact is updated from item 13 to item 14.
The security responsibilities only covered mail servers and mailboxes, but form responses can also be delivered to an S3 bucket, and other delivery methods may follow. Organisations are now responsible for the security of any system they use to receive responses, such as email servers, APIs or cloud storage buckets, and for controlling who can access that data. The detailed email security checklist is replaced by a reference to the government secure email policy, which already sets out those requirements and is kept up to date separately. The extra clause shifts the numbering of later items.
The MOU has changed, so the date needs to show when the current version was published.
theseanything
marked this pull request as ready for review
October 29, 2026 16:20
|
🎉 A review copy of this PR has been deployed! You can reach it at: https://pr-3265.admin.review.forms.service.gov.uk/ It may take 5 minutes or so for the application to be fully deployed and working. If it still isn't ready For the sign in details and more information, see the review apps wiki page. |
SamJamCul
approved these changes
Oct 29, 2026
theseanything
deleted the
update-mou-variations-and-response-data-security
branch
October 29, 2026 16:38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the MOU: