Industry Best Practice Guide: Schedule 2, Part 1 Paragraph 2 Completing RAD 2:

1. Industry Best Practice Guide:Schedule 2, Part 1 Paragraph 2Completing RAD 2: Step by Step Guide This document is to be used as a guidance on how to complete Form RAD2. The purpose of this document is to clarify what information is required, why that information is required and why the form is formatted in the way it is. Completing RAD 2: Version 2 14/05/2018

2. RAD 2: Completing page 1 What to enter: Responding organisation’s contact name, and reference. Why required: For ease of identifying which claims/policy the request relates to. What to enter: Date responding organisation is responding to the request. Why required: For comparison against the date of the relevant request to illustrate how long a response has taken. What to enter: The date on which the Form RAD1 being responded to was completed. Why required: For ease of confirming which claims the request relates to.

3. RAD 2: Completing page 1 What to enter: Name and address of the responding organisation. Why required: To verify where the information being shared has originated from. What to enter: Name and job title of the person who is making the response on behalf of the responding organisation. Why required: To verify where the information being shared has originated from. What to enter: Telephone number and email address of the person who is making the response on behalf of the responding organisation. Why required: To allow for verification of where the information has originated from, and to allow ease of follow up if required. What to enter: Mark the appropriate box depending on whether information can be shared in full, in part or not at all. Follow this up in the text box with reasons why that data cannot be shared. Why required: Where information cannot be shared, it is an important part of this Best Practice Guidance to provide clarification as to why this is the case, rather than ignore the request, even if the exemption set out in Section 29(3) of the DPA may never apply to the requested information.

4. RAD 2: Completing page 2 What to enter: Detail the information that can be shared. Where an attachment is provided in the email response, please detail the name of that attachment. Why required: To provide the information requested. Naming any attachment ensures that data included in the response is referred to. What to enter: Mark the box if, given the information requested, the responding organisation has suspicions that require it to send a Form RAD1 to the requesting organisation. If this box is marked, a full Form RAD1 should be completed and sent to the requesting organisation with the RAD2 response. Why required: Reciprocal requests can be of use to the responding organisation. Reflecting that a reciprocal request is also being made will help tie up the two requests.

5. RAD 2: Completing pages 2 and 3 What to enter: The date of the Form RAD1, which is being responded to. Why required: To confirm that the data shared relates to the relevant request made and the relevant Form RAD1 submitted on the date entered. This is to ensure clarity in respect of the sharing of data and the relevant request made. What to enter: Name and organisation of requesting organisation and date of this e-signature. Why required: The responder, by inputting their name and details, is declaring they are acting in accordance with the DPA. What to enter: Name and organisation of any second signature required to authorise release of the data and date of this e-signature Why required: This Best Practice Guidance does not require a second signature, but this has been included in the Form RAD2 template as some organisations have indicated they may require this to comply with their internal procedures.