Sharing credentials securely: consent, purpose, and time limits

A reviewer may need a training certificate or qualification record for a clear reason, such as preparing for a site start. Forwarding an entire folder can reveal unrelated information and create more copies than the task needs. A useful sharing process starts by agreeing what the reviewer needs to see and how long access should remain available.

The ICO's data-minimisation guidance explains the importance of information being relevant to its purpose and limited to what is needed. For a worker preparing evidence, that is a practical reason to check the contents before sending a link. An expiry setting alone does not establish that every use of the information is appropriate.

Establish the request before you share

Ask the intended recipient which record or category they need and what they are checking. For example, a site contact may ask for a current qualification record and a certificate reference. That does not automatically mean they need unrelated identity documents, your CV or other personal files.

Explain what the link will show and agree a sensible access period. Use a known contact route when confirming an unexpected request, particularly where the request asks for more information than the original purpose suggests.

Understand MyWorkLife's category scope

MyWorkLife share links are created for a category, such as qualifications, documents or a CV. A qualification or document link includes the existing records in that selected category when the link is created. It is not a promise that only one named certificate has been selected.

Check the category contents before creating and sending the link. If that category contains information the recipient does not need, do not assume the link can be used as a way to share just one item. See how qualification records and evidence are organised, or contact support if the available scope does not fit the request.

The link is also not a frozen snapshot of every displayed value. Included records are read in their current state while the link is available. Later additions to the category are not automatically included: create a new link if those new records need to be shared.

Use expiry and revocation for future access

An expiry date sets the period during which access can remain available through that link. Revocation can stop future access earlier. Neither control recalls a file, screenshot or copy the recipient has already saved.

Treat the link itself as something to protect. It can be forwarded, so send it through the agreed route and avoid placing it in a public post or open group. A short access period can reduce unnecessary ongoing access, but the contents still need to be appropriate at the time you share them.

A practical check before sending

1. Confirm the intended recipient and the purpose of the request.
2. Review the records currently included in the selected category.
3. Check names, dates and certificate details against the evidence you hold.
4. Choose an expiry that gives the reviewer enough time for the stated task.
5. Explain any missing evidence or information that still needs confirmation.
6. Revoke the link when future access is no longer needed, while remembering that saved copies may remain.

This makes the review easier to understand. It also avoids promising that a recipient has seen a particular record merely because a link was created.

Keep evidence readiness separate from verification

Adding evidence to MyWorkLife can help you organise it and respond to a request. It does not automatically verify the issuer or establish that the qualification is accepted for a role or site. The receiving organisation still needs to make those checks.

For an upcoming start, use the skills passport preparation guide. If a record needs attention first, the expiry and evidence review guide helps separate document dates from the next action your team needs to take.