Confidentiality and Access to Testing Material
GSQA-DAT-002
File classification
Classify complete originals, translations, authentication, application authority, public extracts, internal findings and formal decisions by provenance, version and case. Use in review does not authorise publication. A report’s private original and public copy have different access scopes. A file name or URL does not replace classification and permissions.
Upload and storage
Upload confirmation corresponds to the stored file, digest, owning account and matter. Formal submission retains its snapshot; later drafts do not overwrite submitted versions. Access to private files checks identity and case permission, not merely knowledge of a URL or identifier. Unreadable, mislinked or incomplete material is handled as a specific issue.
Personnel access
Intake, review, decision, reconsideration and publication access necessary material according to assignments. A person with unresolved relevant interests does not participate in the case. Access does not continue under earlier permissions after a role or task ends. Necessary access and material-action records are retained without putting complete private reports, passwords or access credentials into public logs.
Incident handling
Suspected disclosure, misdelivery or unauthorised access leads first to relevant access restriction and evidence preservation, then examination of files, parties, scope and impact. Measures may include correction, permission changes, communication and legally required notices. An incident report is not an established finding of liability, and handling must not unnecessarily redistribute complete sensitive material.
Review purposes and further use
Non-public material serves its application, maintenance, dispute or other explained necessary purpose. Permission to review is not a right to sell reports, use them for unrelated publicity or reuse them at will. Another purpose requires its own lawful basis and necessary authority; an account or submission is not an unlimited-use licence.
Verification with issuers
Report, signature, qualification and authentication checks use independently verifiable channels and necessary facts. Provide only files or fields needed to identify the matter, recording the body, question and response. This does not authorise distribution of complete files to unrelated parties, and an applicant-supplied contact is not the sole proof of authenticity.
Members and account handover
Members act only within granted roles; membership does not establish rights over brands, reports or disclosure. Departures, ended agency, compromised accounts and representation disputes should be raised through the account route for permission checks. Handover preserves necessary history; one person’s departure is not an instruction to erase every case.
Preparing public copies
Public copies follow GSQA-EVD-005 rights and scope checks, with necessary redaction while preserving substantive evidence. Internal opinions, complete authentication chains and unauthorised annexes are not automatically public because they were uploaded together. Preparation, translation and replacement link to the actual version and confirmation without bypassing private-file controls.
Service providers and minimum access
Operation, storage and necessary support may involve corresponding providers within their functions and permissions. Cloud use does not make material public to all third parties, and confidentiality does not remove lawful requirements. Recipients and cross-border matters follow the privacy policy and applicable requirements.
Retention, withdrawal and deletion
Account closure, application withdrawal, publication-permission withdrawal and personal-data deletion have different effects. Maintenance, evidence and dispute material follows its purpose; deletion or de-identification is considered against the request and relevant basis. Taking down a public copy does not establish deletion of all private records and backups, and complete erasure must not be claimed before it is performed.
Handling confidentiality concerns
Identify the case or file, issue, discovery time and necessary evidence through privacy, complaints or account routes. Do not expose another person’s credentials or complete confidential material to demonstrate a concern. Handling checks permissions and facts before explaining measures and disclosable outcomes; a challenge to a formal decision uses reconsideration separately.