Law Enforcement Request and Personal Data Audit Procedure

1. Purpose

This procedure applies when a police officer, regulator, court officer, national security organ, prosecutor, or other public authority requests personal data held in TourIQ. The objective is to comply with lawful requests while protecting data subjects and preserving evidence integrity.

2. Intake form

3. Validation checklist

• Require written authority unless there is an immediate lawful emergency.
• Validate the officer and agency using official contact channels, not only the contact details in the request.
• Confirm whether the request is required by written law, court order, warrant, summons, preservation order, or other lawful authority.
• Escalate to management and counsel where the request is broad, sensitive, urgent, cross-border, or unclear.
• Do not disclose passwords, secret keys, unrelated customer data, or data outside the lawful scope.

4. Personal data audit map

Search only the systems and time period relevant to the lawful request.

5. Disclosure control

1. Place a legal hold on relevant records before exporting.
2. Export only the records authorized by the request.
3. Redact unrelated third-party data unless disclosure is legally required.
4. Generate a file hash or checksum where possible.
5. Use encrypted delivery or official secure handover.
6. Record recipient identity and acknowledgement.
7. Do not notify the data subject if notification is prohibited or would prejudice a lawful investigation; seek legal advice before notifying.

6. Chain of custody