Protecting applicant documents in a shared admissions workflow

In a hypothetical admissions review, the inbox contains a passport scan, school reports, a medical note and a bank statement. Three reviewers download copies to compare applications. One file is corrected, but the old version remains in an email thread and influences the decision. The problem is not simply that the folder lacked a privacy notice. The workflow has lost control of its copies and versions.

Treat applicant documents as a lifecycle: request, intake, review, correction and closure. Each stage should have a purpose, an owner and a manageable access boundary.

Challenge the request before protecting the upload

Ask which decision requires each document and which parts of it are relevant. An institution may need evidence of eligibility without needing every unrelated page in a bundle. Where a document is genuinely required, explain the purpose and acceptable form clearly enough that applicants do not guess and overshare.

As of 22 October 2026, the relevant substantive DPDP duties are scheduled for 13 May 2027 under the commencement notification. The future section 8 framework and rule 6 will be relevant to accountability and safeguards. Where child data is involved, assess section 9 and the relevant rule 10 process rather than treating the upload link as a complete permission mechanism.

These are readiness steps. Specific institutions and document categories may also face existing requirements that need separate assessment.

Give intake one controlled route

Choose an approved submission location and assign an application reference. Use that reference in routine internal discussion where it is sufficient, instead of repeatedly including the person’s full identity details and attachments.

Clarify what happens when an applicant sends a document through an unexpected channel. Staff need a way to move it into the controlled process, restrict or remove unnecessary working copies as appropriate, and explain the intended route. Without that instruction, every exception can create a new unofficial archive.

Check the permissions on the intake location. A folder can be visible to too many people even when its link is not public. Test whether a reviewer can access applications outside their assignment and whether a former reviewer still has access.

A hypothetical scholarship review

A college reviews scholarship applications. The finance reviewer needs relevant income evidence; the academic reviewer needs academic records. The original shared folder gives both reviewers every file, including unrelated supporting material.

The college creates role-appropriate views and records which documents support each decision. When an applicant corrects a report, the intake owner marks the earlier version as superseded and alerts the affected reviewer. The reviewer confirms which version informed the assessment.

This supports the future section 8(3) requirement concerning completeness, accuracy and consistency where data is likely to be used for a decision affecting the individual or disclosed to another fiduciary. It does not mean every stored item must be continuously guaranteed correct regardless of its use; the decision context matters.

Control reviewer working copies

Ask whether reviewers need downloads, printed copies or email attachments, and what happens to each after the review. Prefer a controlled view where it meets the task. If a working copy is necessary, define where it may be held, who can see it and how its disposition will be confirmed.

Avoid putting sensitive detail into a broad scoring spreadsheet merely because the source document is restricted. A short decision-relevant summary may be enough. Check whether comments identify other people, disclose unnecessary circumstances or reproduce an entire private narrative.

Keep review access time-bound and assign somebody to remove it. A folder created for one admissions round should not quietly remain available to a changing group of staff for years.

Close successful and unsuccessful applications deliberately

When a student joins, identify which records the delivery or administration team needs. Do not copy the whole admissions folder by default. When an application ends without enrolment, assess what must remain, for which purpose and under which retention requirement.

The future section 8(7) erasure framework must be read with applicable legal retention, including rule 8(3) and the Seventh Schedule. Avoid a promise of immediate deletion that conflicts with those requirements. Equally, a legitimate retained record should not remain open to unrelated active uses.

The recurring failure is protecting the intake portal while ignoring the files that leave it. Test one hypothetical application through correction and closure. If the team cannot identify the authoritative version and its remaining copies, improve that route before expanding the next intake.