How should information requests be handled when a third party is involved?

• A. Obtain consent or legal authority to share information; ensure privacy and data protection
• B. Share information with the third party regardless of consent
• C. Ignore the request
• D. Delay indefinitely

Answer: (A)

When a third party is involved, information requests should be handled by obtaining consent or legal authority to share, while safeguarding privacy and data protection. This means verifying who is requesting the information, confirming the exact purpose, and ensuring you have explicit consent or a valid legal basis (such as a statutory power or court order) to disclose data. You should limit the information to what is necessary for that purpose and use secure methods to transfer it, keeping records of what was shared and with whom. Sharing without consent or proper authority breaches privacy protections and can create legal risk, while ignoring or delaying the request would fail to meet required duties and hinder the investigation or compliance process.