Documentation and Data Privacy

Accurate, complete, and securely stored records are essential. Limit access to those with a legitimate need to know, and apply role-based access controls. Use clear, consistent terminology to describe events and actions taken.

Data minimization is key. Collect only information necessary for the investigation, redact unrelated personal data when possible, and avoid exposing others' data beyond what is required to resolve the issue.

Respect privacy across identities. Special attention is needed for LGBTQ+ employees, people with disabilities, and caregivers to ensure information is used appropriately and protected from misuse. Ensure accessible formats for reporting and documentation when requested.

Retention and destruction should follow defined timelines and secure disposal methods. Align with legal requirements and internal policy. Share information with external partners only with approved approvals and consent.

Disclosures to external parties should be limited, with anonymized summaries used where possible. Maintain a clear audit trail that protects privacy while enabling accountability.