Professional Ethics, Confidentiality and Compliance
This domain tests the duties that attach to handling other people's information: confidentiality, data protection principles, conflict-of-interest management, and knowing when disclosure is required rather than merely tempting.
Core rules
- Confidentiality is a duty owed to the organisation and its clients; it survives the end of employment and applies to gossip, screens and paper as much as to databases.
- Data protection principles: lawful, fair and transparent processing; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability.
- Verify identity before disclosing anything. If a caller cannot be verified, offer a call-back to the number already on file - never to a number they supply.
- Disclosure may be required by law (court order, statutory duty), permitted with valid consent, or justified to protect someone from serious harm; each case is documented and escalated to the nominated contact.
- Declare conflicts of interest and step back from the decision. Record gifts and hospitality against the policy threshold.
Worked example
A caller asks, 'Is Mr Adeyemi a client of yours?' Reasoning: confirming or denying membership is itself a disclosure. Reply that you cannot discuss individual circumstances, take the caller's details, verify against records, and either route the query to the nominated contact or return the call using the number on file.
Traps that cost marks
- Saying 'I'll just check if he's in', which confirms the person's presence.
- Sharing client information freely between internal colleagues who have no need to know.
- Using personal email or messaging apps for client records.