Skip to content

Update MOU notice periods and response data security #3265

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
theseanything merged 4 commits into from
Oct 29, 2026
Merged

Update MOU notice periods and response data security #3265

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7496fdb
State that GDS is part of DSIT in the MOU
theseanything Oct 29, 2026
b011046
Update how GDS gives notice of changes to the MOU
theseanything Oct 29, 2026
954d715
Cover all response delivery methods in MOU security responsibilities
theseanything Oct 29, 2026
02638a1
Update the MOU last updated date
theseanything Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
113 changes: 59 additions & 54 deletions app/views/mou_signatures/_mou_version_current.html.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
<p>Last updated: 22 May 2025</p>
<p>Last updated: 29 October 2026</p>

<nav aria-labelledby="sections-heading">
<h2 class="govuk-heading-m" id="sections-heading">Contents</h2>
Expand Down Expand Up @@ -32,8 +32,9 @@
<ol class="govuk-list govuk-list--number">
<li>
<p>
This is a memorandum of understanding (“MOU”) between the Government Digital Service (“GDS”) and your organisation (together the
“Parties”). The single MOU covers all the forms an organisation publishes using GOV.UK Forms.
This is a memorandum of understanding (“MOU”) between the Government Digital Service (“GDS”), which is part of the Department for
Science, Innovation & Technology (“DSIT”) and your organisation (together the “Parties”). The single MOU covers all the forms an
organisation publishes using GOV.UK Forms.
</p>
</li>
<li>
Expand Down Expand Up @@ -93,15 +94,48 @@
</p>
</li>
<li>
<p>
Any updates to this agreement will be emailed to the person who agreed on behalf of your organisation (or the first account in your
organisation that is still active). This will happen 30 calendar days before any change is due to be made, along with a summary of the
changes. The changes will then take effect on the date specified in the notification email. No action is required by your organisation
if you accept the changes.
</p>
<p>GDS will aim to give your organisation no less than:</p>
<ul class="govuk-list govuk-list--bullet">
<li>
<p>
15 calendar days notice of any variations to this MOU which reflect the appointment of a new Sub-Processor or a change to the
geographic region in which GOV.UK Forms infrastructure is hosted; or
</p>
</li>
<li>
<p>6 months notice of any changes which will introduce or vary charges for your organisation’s use of the GOV.UK Forms platform.</p>
</li>
</ul>
</li>
<li>
<p>If your organisation doesn’t wish to accept the change, you must notify GDS and this MOU will terminate with immediate effect.</p>
<p>GDS will notify your organisations about any variations to this agreement by emailing a summary of the changes to:</p>
<ul class="govuk-list govuk-list--bullet">
<li>
<p>the person or people who agreed to this agreement on behalf of your organisation; and/or</p>
</li>
<li>
<p>the person or people acting as Organisation Admins for your organisation at the time.</p>
</li>
</ul>
<p>The changes shall come into effect immediately unless the email specifies an alternative effective date.</p>
</li>
<li>
<p>
No action is required by your organisation if you accept the variation. If your organisation does not wish to accept the variation,
you must:
</p>
<ul class="govuk-list govuk-list--bullet">
<li>
<p>notify GDS</p>
</li>
<li>
<p>unpublish any forms your organisation has published on the GOV.UK Forms platform.</p>
</li>
</ul>
<p>
This agreement shall cease when GDS has been notified, any forms have been unpublished and GDS has ceased processing personal
information on behalf of your organisation.
</p>
</li>
<li>
<p>
Expand All @@ -116,7 +150,7 @@
</li>
</ol>
<h2 class="govuk-heading-m" id="people-involved-in-this-agreement">People involved in this agreement</h2>
<ol class="govuk-list govuk-list--number" start="13">
<ol class="govuk-list govuk-list--number" start="14">
<li>
<p>
For this agreement, the main point of contact for GDS is:<br />
Expand All @@ -141,7 +175,7 @@
</li>
</ol>
<h2 class="govuk-heading-m" id="gov.uk-forms-pricing">GOV.UK Forms pricing</h2>
<ol class="govuk-list govuk-list--number" start="17">
<ol class="govuk-list govuk-list--number" start="18">
<li>
<p>
There is currently no cost for using GOV.UK Forms or for the hosting of forms made on the platform. This is intended to help reduce
Expand All @@ -157,7 +191,7 @@
</li>
</ol>
<h2 class="govuk-heading-m" id="security-responsibilities">Security Responsibilities</h2>
<ol class="govuk-list govuk-list--number" start="19">
<ol class="govuk-list govuk-list--number" start="20">
<li>
<p>You must not use GOV.UK Forms to handle data classified above OFFICIAL.</p>
</li>
Expand Down Expand Up @@ -199,49 +233,20 @@
</li>
<li>
<p>
You are responsible for managing the security of the mail server you will use to receive form responses. Before using GOV.UK Forms you
must ensure that this meets the
<a href="https://www.gov.uk/guidance/securing-government-email">government secure email policy</a>, including:
You are responsible for the security and configuration of any system you use to receive form response data including, but not limited
to, email servers, APIs, or cloud storage buckets.
</p>
<ul class="govuk-list govuk-list--bullet">
<li>
<p>
supporting
<a href="https://www.gov.uk/government/publications/email-security-standards/transport-layer-security-tls"
>Transport Layer Security Version 1.2</a
>
(TLS v1.2) or later
</p>
</li>
<li>
<p>
<a href="https://www.security.gov.uk/guidance/email-guidance/mta-sts/"
>publishing a Mail Transfer Agent Strict Transport Security (MTA-STS) policy</a
>
for all of your domains that receive email
</p>
</li>
<li>
<p>implementing spam and malware filtering</p>
</li>
<li>
<p>enforcing DMARC on inbound email</p>
</li>
<li>
<p>setting up DMARC and TLS reporting (TLS-RPT) and reviewing the data regularly</p>
</li>
</ul>
</li>
<li>
<p>
Note: The NCSC’s
<a href="https://www.ncsc.gov.uk/information/mailcheck">Mail Check</a>
service can be used for assessing email security compliance. If your mail server does not support the use of TLS, form response data
could be transmitted in plain text across the Internet.
You must ensure any mailbox(es) you use to receive form response data meets the
<a href="https://www.gov.uk/guidance/securing-government-email">government secure email policy</a>.
</p>
</li>
<li>
<p>
You are responsible for managing the security of the designated mailbox(es) used to receive form response data. Anyone with access to
the mailbox(es) will potentially be able to see the form response data.
You are responsible for managing and securing access to form response data within your organisation and for ensuring that only
authorised individuals or systems can access that data.
</p>
</li>
<li>
Expand All @@ -263,7 +268,7 @@
<p>
Parties should report any messages received by this mailbox that are outside of the email output expected from the GOV.UK Forms
service (e.g. incorrect content format, incorrect sender or bulk messages sent through the service), to the GOV.UK Forms team (see
contact at item 13).
contact at item 14).
</p>
</li>
<li>
Expand All @@ -277,7 +282,7 @@
</li>
</ol>
<h2 class="govuk-heading-m" id="compliance-with-data-protection-legislation">Compliance with Data Protection Legislation</h2>
<ol class="govuk-list govuk-list--number" start="32">
<ol class="govuk-list govuk-list--number" start="34">
<li>
<p>
The parties agree that for GOV.UK Forms User Personal Data and GOV.UK Forms Filler Technical Device Data processed under this MoU, GDS
Expand Down Expand Up @@ -321,7 +326,7 @@
</li>
</ol>
<h2 class="govuk-heading-m" id="protection-of-personal-data">Protection of Personal Data</h2>
<ol class="govuk-list govuk-list--number" start="35">
<ol class="govuk-list govuk-list--number" start="37">
<li>
<p>
GDS will not disclose GOV.UK Forms User or Filler Personal Data to any outside organisation other than as set out in this MOU unless
Expand Down Expand Up @@ -768,7 +773,7 @@
<h2 class="govuk-heading-m" id="how-gov.uk-forms-deals-with-freedom-of-information-requests">
How GOV.UK Forms deals with Freedom of Information requests
</h2>
<ol class="govuk-list govuk-list--number" start="53">
<ol class="govuk-list govuk-list--number" start="55">
<li>
<p>
Both GDS and your organisation agree to work with each other in order to comply with Requests For Information in line with the Law.
Expand Down
Loading