Skip to content

Update MOU for save and return - #3267

Open
theseanything wants to merge 3 commits into
mainfrom
update-mou-for-save-and-return
Open

theseanything wants to merge 3 commits into
mainfrom
update-mou-for-save-and-return

Conversation

@theseanything

Copy link
Copy Markdown
Contributor

What problem does this pull request solve?

Trello card:

Updates the MOU to cover form fillers saving their progress and returning later. Stacked on #3265.

Changes:

  • Signing in to a form does not verify a person's identity
  • Form Filler Personal Data includes answers from forms that haven't been submitted and the data that links saved answers to a person
  • Saved answers are kept for 30 days from the last save

Things to consider when reviewing

  • The edited text was based on a copy from before Update MOU notice periods and response data security #3265, so only the save and return changes are applied.
  • "GOV.UK Forms Filler Technical Data" is still defined as data from people who "use and submit a form". Does it need the same "whether or not the form is submitted" wording?

Base automatically changed from update-mou-variations-and-response-data-security to main October 29, 2026 16:38
@theseanything
theseanything marked this pull request as ready for review October 30, 2026 10:55
The MOU said forms are unauthenticated, but people can now sign in to
a form to save their progress. Signing in only links saved answers to
a person, it doesn't prove who they are, so organisations still need
their own identity checks where they're required.
The definition only covered answers from submitted forms. When people
save their progress, GOV.UK Forms holds their answers before the form
is submitted, along with the data that links those answers to the
person who saved them. Both need to be covered so that GDS's role as
Data Processor for that data is clear.
Annex C said answers are deleted 20 hours after a session becomes
inactive, which isn't true for people who save their progress. Saved
answers are now kept for 30 days from the last save, so the MOU needs
to say how long that data is held and when it's deleted.
@theseanything
theseanything force-pushed the update-mou-for-save-and-return branch from b54037e to e36ae7b Compare October 30, 2026 10:56
@github-actions

Copy link
Copy Markdown

🎉 A review copy of this PR has been deployed! You can reach it at: https://pr-3267.admin.review.forms.service.gov.uk/

It may take 5 minutes or so for the application to be fully deployed and working. If it still isn't ready
after 5 minutes, there may be something wrong with the ECS task. You will need to go to the integration AWS account
to debug, or otherwise ask an infrastructure person.

For the sign in details and more information, see the review apps wiki page.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant