Practical software guides
A logo, letterhead or familiar signature does not establish who sent a request. Before releasing customer or staff information, verify the requester through a channel you already trust and establish whether the requested disclosure is authorised.
A fictional request to work through
A message asks for all supplier bank details before the end of the day. Do not use the phone number in that message as the only verification step. Call an independently recorded contact, confirm the request and refer the scope to the person authorised to approve disclosure.
| Check | Evidence to retain |
|---|---|
| Requester identity | Independent callback or approved authentication result |
| Authority and purpose | Documented approval; legal review where required |
| Minimum scope | Specific fields and recipients, not an entire export |
| Delivery | Approved secure channel; no shared public attachment |
| Closure | What was sent, who approved and when access expires |
If the approver is unavailable, use the pre-agreed backup route or hold the release. Urgency does not create authority. Restrict the review log too: it should not become another copy of the sensitive material.
The CISA phishing guidance provides practical verification context. It is US security guidance, not Bahamian disclosure law. Have a qualified privacy/legal adviser determine the applicable basis, duties and retention period.