Define the release decision
An applicant has a recommender draft, a final signed file and downloads from an application portal. Only the authorized final version should enter the private archive.
Identify the authoritative letter, its intended college or application service, and every temporary copy before encryption.
Run the control sequence
- 01Name the application cycle, recommender, intended recipient and accountable archive owner.
- 02Distinguish draft, final, signed and portal-submitted copies without opening material the applicant is not entitled to inspect.
- 03Record file name, date, size and source while keeping letter text out of the inventory.
- 04Separate applicant documents from confidential recommender material and provider credentials.
- 05Confirm which copy may be retained after submission and which must be removed.
Preserve enough evidence
Record the dataset identifier, application cycle, source device or system, export date, manifest, responsible custodian, authorized recommenders, key location, encryption environment, recovery result, retention rule and next review date. Do not put passwords, recovery secrets or unnecessary applicant values in the decision record.
Keep the manifest, custodian, approved recipient, key-separation decision, restore result and retention owner together without copying applicant values into the record.
Keep surrounding controls visible
Encryption does not create a right to inspect a confidential recommendation, validate authorship or override a FERPA waiver or provider rule.
Field conditions can create extra copies on tablets, laptops, removable media, synchronization folders and recipient devices. The archive owner must address those copies separately and verify the current software release before relying on product behavior.
Questions to ask
Should the access credential travel with the dataset?
Only when the approved research purpose requires linkage and the responsible owner has authorized the same recipient. Separation is a core risk control.
Does encryption make an export anonymous?
No. Encryption restricts file access; it does not remove identifiers or eliminate reidentification risk after decryption.
Primary references
References support specific controls and do not imply endorsement.