From 1de10a2f998b86d860a592eae58e8c8a0a5bda8e Mon Sep 17 00:00:00 2001 From: Sean Rankine Date: Thu, 29 Oct 2026 16:24:38 +0000 Subject: [PATCH 1/3] Clarify that signing in to a form does not verify identity in the MOU The MOU said forms are unauthenticated, but people can now sign in to a form to save their progress. Signing in only links saved answers to a person, it doesn't prove who they are, so organisations still need their own identity checks where they're required. --- app/views/mou_signatures/_mou_version_current.html.erb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/app/views/mou_signatures/_mou_version_current.html.erb b/app/views/mou_signatures/_mou_version_current.html.erb index 23a6f4991..5fbc18e19 100644 --- a/app/views/mou_signatures/_mou_version_current.html.erb +++ b/app/views/mou_signatures/_mou_version_current.html.erb @@ -277,8 +277,8 @@

  • - The online forms are unauthenticated and could be completed by anyone. You are responsible for including identification and - authentication mechanisms within your downstream processes if these are required. + The online forms do not verify a person’s identity, including where they sign in, and could be completed by anyone. You are + responsible for including identification and authentication mechanisms within your downstream processes if these are required.

    • From fee2463448c7da72ddacfd5ca613fa1647e86754 Mon Sep 17 00:00:00 2001 From: Sean Rankine Date: Thu, 29 Oct 2026 16:24:54 +0000 Subject: [PATCH 2/3] Include saved answers in the MOU definition of Form Filler Personal Data The definition only covered answers from submitted forms. When people save their progress, GOV.UK Forms holds their answers before the form is submitted, along with the data that links those answers to the person who saved them. Both need to be covered so that GDS's role as Data Processor for that data is clear. --- app/views/mou_signatures/_mou_version_current.html.erb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/app/views/mou_signatures/_mou_version_current.html.erb b/app/views/mou_signatures/_mou_version_current.html.erb index 5fbc18e19..0518e651e 100644 --- a/app/views/mou_signatures/_mou_version_current.html.erb +++ b/app/views/mou_signatures/_mou_version_current.html.erb @@ -856,7 +856,8 @@

    GOV.UK Forms Filler Personal Data means all personal data transferred when members of the public or businesses fill out - and submit a form built by the GOV.UK Forms service, and transferred to your organisation to process. + a form built using GOV.UK Forms, whether or not the form is submitted, and any personal data used to link saved answers to the person who + saved them.

    GOV.UK Forms Filler Technical Data means all technical device data, such as IP address, web browsers and operating From e36ae7bd0b354d8c6a63920f2acbd732a48f51f3 Mon Sep 17 00:00:00 2001 From: Sean Rankine Date: Thu, 29 Oct 2026 16:25:04 +0000 Subject: [PATCH 3/3] Add retention period for saved answers to the MOU Annex C said answers are deleted 20 hours after a session becomes inactive, which isn't true for people who save their progress. Saved answers are now kept for 30 days from the last save, so the MOU needs to say how long that data is held and when it's deleted. --- app/views/mou_signatures/_mou_version_current.html.erb | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/app/views/mou_signatures/_mou_version_current.html.erb b/app/views/mou_signatures/_mou_version_current.html.erb index 0518e651e..f66e1fdd2 100644 --- a/app/views/mou_signatures/_mou_version_current.html.erb +++ b/app/views/mou_signatures/_mou_version_current.html.erb @@ -972,7 +972,13 @@

    Form submissions, including Form Filler Personal Data, are retained during the user’s active session. These sessions automatically expire - and are permanently deleted after 20 hours of inactivity. + and are permanently deleted after 20 hours of inactivity, unless the form filler has saved their progress. +

    +

    + Where a form allows people to save their progress and return later, saved answers, including Form Filler Personal Data, are kept for 30 + days from the last time the form filler saved them. Saving again restarts this period. If the form filler does not save their answers + again within this period, their saved answers are permanently deleted. If they submit the form, their answers are treated as a completed + form submission and kept as set out below.

    Data from completed form submissions, including Form Filler Personal Data, are kept for 30 days. This is in case of any technical problems