Data governance standards

Legal and regulatory obligations for all participants in the HMCTS API Marketplace.

These standards apply to all consumers and producers. They are based on UK GDPR, the Data Protection Act 2018 and the Government Security Classifications policy. Role-specific obligations are noted throughout.

Contents

---

1. Legal framework

All participants must comply with:

• UK GDPR and the Data Protection Act 2018: Personal data must be processed lawfully with a documented legal basis. Producers must record this in the API specification. Consumers must not use data beyond the stated purpose.
• Government Security Classifications policy: Official-Sensitive data requires enhanced controls. All APIs must declare their classification in the marketplace.
• Computer Misuse Act 1990: Unauthorised access is a criminal offence. Credentials must not be shared or misused.
• Freedom of Information Act 2000: Some API-accessible data may be subject to FOI requests. All participants should be aware of their obligations.
• Public Records Act 1958: Court records may carry public record obligations. Producers must check these before exposing court data through an API.

---

2. Data classification

Every API must declare a classification. Consumers must not downgrade data once received.

Obligations by classification

Classification	Eligible?	Producer obligations	Consumer obligations
Official	Yes	Standard data protection controls. Declare in the OpenAPI spec.	Handle per your organisation's information security policy.
Official-Sensitive	With conditions	Formal DSA required before any access is granted. Verify enhanced controls at the consumer.	Formal DSA required. Enhanced access controls and audit logging. Do not downgrade.
Secret / Top Secret	No	Not eligible for listing on the marketplace.	Not applicable.

---

3. Data sharing agreements

No personal data API may be accessed without a signed DPA or DSA in place.

Producers must

• Confirm a DPA or DSA is in place before approving access to any personal data API
• Record the legal basis for the data sharing arrangement
• Notify their DPO of any new data sharing arrangements

Consumers must

• Ensure their legal team has reviewed the arrangement before submitting a request
• Not use data beyond the stated purposes
• Report any change in use case to the API owner before proceeding

---

4. Data minimisation and retention

Producers must

• Expose only the minimum data fields necessary
• Review exposed fields when a consumer’s access is revoked
• Not expose internal identifiers or debug data in responses

Consumers must

• Only request access to fields actually needed
• Not cache responses beyond the time needed
• Define a retention period and delete data when no longer required

---

5. Access control and authentication

OAuth 2.0 with JWT bearer tokens is mandatory for all marketplace APIs.

All participants

• Scope tokens to the minimum permissions required
• Never share credentials between services, teams or individuals
• Report and revoke compromised credentials immediately

Consumers additionally

• Use separate credentials per consuming service
• Never hard-code tokens in source code
• Implement token rotation and expiry handling

Producers additionally

• Verify consumer identity before approving access
• Be able to revoke access immediately
• Maintain an audit log of access grants

---

6. Audit and monitoring

Producers must

• Log all API calls: timestamp, consumer ID, endpoint and response code
• Retain logs for a minimum of 12 months
• Make logs available to the marketplace or HMCTS security team on request

Consumers must not

• Attempt to circumvent rate limiting, access controls or monitoring
• Use the API to enumerate or harvest data beyond the stated use case

---

7. Data breaches and incident management

Any suspected breach must be reported to the HMCTS DPO within 72 hours, under UK GDPR Article 33.

All participants

• Do not conceal or delay breach notification
• Preserve logs and evidence for investigation

Producers additionally

• Maintain an incident response plan covering API-related breaches
• Notify affected consumers as part of incident response

Consumers additionally

• Have a process to notify end users if personal data is compromised

To report a breach, contact the marketplace team immediately.

---

8. Cross-border data transfers

• API responses must not be routed through or stored outside the UK or EEA without prior written DPO approval
• Cloud infrastructure processing API responses must be documented in your record of processing activities
• Transfers to third countries must comply with UK GDPR Chapter V

---

9. Accountability and governance roles

• Data controller: HMCTS — responsible for the lawfulness of processing across the marketplace.
• Data processor: Consumer organisations processing personal data on behalf of HMCTS.
• API owner (producer): Accountable for the accuracy, security and lawfulness of data exposed through their API.
• Marketplace team: Responsible for onboarding governance, standards enforcement and access audit.
• Data Protection Officer: Must be consulted on new data sharing arrangements, and notified of breaches within 72 hours.

---

10. Decommissioning and offboarding

Consumers must

• Revoke credentials and notify the API owner when decommissioning
• Delete all API-derived data, or return it to the data controller
• Provide a data deletion certificate on request

Producers must

• Give consumers at least 30 days’ notice before retiring an API
• Ensure all consumers have migrated before retirement
• Explicitly revoke all active credentials at retirement

Role-specific guidance

• Consumer guidance
• Producer standards