An outsourced report writer may receive a property address, client details, inspection notes, photographs and documents in a single handover. Some of that material is necessary to prepare the draft. Some may be present only because it was captured in an email chain, photographed in the property or carried across from an administrative file.
A secure workflow starts before upload. The surveying practice needs to know what it is sharing, why the writer needs it, how access will be controlled and what should happen when the drafting instruction is complete.
Map the material before choosing the transfer method
List the records used in the drafting process: the instruction sheet, template, notes, photographs, property documents and any separate client concerns. Identify where personal information appears. It may sit in obvious fields such as names and contact details, but also in family photographs, vehicle registrations, correspondence and filenames.
This is not a reason to strip out evidence needed for an accurate draft. It is a reason to distinguish necessary inspection material from information that has no drafting purpose.
Share what the writer needs, not the whole case file
The ICO’s current data minimisation guidance says personal data should be adequate, relevant and limited to what is necessary for the specified purpose. In practical terms, an outsourced drafting pack should not automatically include every email, identity document or administrative attachment held for the instruction.
Check whether a client’s telephone number, payment record or unrelated correspondence helps the writer prepare the report. Remove duplicated files and superseded versions. Where a photograph contains incidental personal information that adds nothing to the finding, consider whether a different image or proportionate redaction can preserve the inspection evidence.
Establish the data roles and written terms
Do not assume the parties’ data-protection roles from the label “outsourced writer”. Establish who decides the purposes and means of each processing activity. Where a controller appoints a processor to handle personal data on its behalf, the ICO states that a written contract or other legal act is required.
The ICO’s controller–processor contract guidance lists matters including the subject and duration of processing, its nature and purpose, the types of personal data, confidentiality, security, sub-processors, assistance with rights and breaches, and return or deletion at the end of the arrangement.
Check the agreement against the actual workflow. If another platform or person will handle the pack, understand their role and whether the necessary authorisation and terms are in place. The Survey Edit’s business-to-business terms require the appropriate data-processing agreement before processing personal data on a practice’s behalf.
Use a controlled transfer route
The ICO advises using encrypted communications when transmitting personal information, where available. Its encryption and data-transfer guidance also explains that encryption in transit does not by itself control how information is stored after arrival.
Use a route appropriate to the risk and volume of the material. Confirm the recipient, restrict access to the people working on the instruction and avoid an unrestricted public link. Where the system supports it, use named access, strong authentication, an expiry date and an audit trail. Agree how revised files will be identified so the secure folder does not become a collection of indistinguishable drafts.
| Control | Question for the practice |
|---|---|
| Purpose | Does each file support preparation, review or administration of this draft? |
| Access | Who can open the pack, and is access limited to those who need it? |
| Transfer | Is the chosen route protected appropriately, and has the recipient been verified? |
| Versions | Can the writer and surveyor identify the current notes, template and returned draft? |
| Retention | What is kept, returned or deleted when the instruction and any agreed revision period end? |
| Incident route | Who must be told promptly if material is sent to the wrong recipient, lost or accessed unexpectedly? |
Agree retention rather than leaving files indefinitely
There is no universal data-protection retention period for every drafting pack. The ICO’s current storage limitation guidance says organisations must be able to justify how long they keep personal data and should erase or anonymise it when it is no longer needed.
The practice and writer should therefore agree what happens to working copies, returned drafts, back-ups and access permissions at the end of the instruction. That decision should fit the purposes of the processing, the contract, applicable professional requirements and the practice’s own documented retention approach. Seek specialist advice where the position is unclear.
Keep security separate from professional approval
A well-controlled transfer does not confirm that the report is technically correct. The writer still relies on the surveyor’s supplied evidence and instructions. The inspecting surveyor reviews the returned draft against the inspection record, resolves queries, makes amendments and approves the exact version issued to the client.
The Survey Edit provides outsourced RICS Level 2 report drafting support using the practice’s notes, photographs, template and instructions. If you want to discuss the proposed handover route and service scope before sending live material, send us an enquiry.
This article provides general workflow information, not legal advice. Practices should assess their own data-protection, contractual, professional and insurance obligations.
You inspect. We write.