An applicant should keep control of their application account, password, recovery details and verification codes. A support worker may assist with an agreed task, but should not become the account owner or make decisions on the applicant’s behalf. This is practical guidance rather than a universal credential-sharing rule stated by the cited sources.
What does keeping control involve?
The applicant should:
- retain control of account registration and recovery routes;
- provide only the information or access needed for the specific task;
- use a documented, secure access method where one is available;
- review and withdraw access when it is no longer needed; and
- retain the final decision about their application and education choices.
UKCISA’s student guide states that “where and what you study is your decision.” Assistance with an application should therefore not transfer decision-making authority to the person providing support.
How to check what access is necessary
Before sharing login details or personal information, the applicant should establish:
- who is the registered account holder;
- who else can view, use or submit information through the account;
- exactly what access the requested task requires;
- how the information will be sent and stored;
- whether access can be limited, reviewed or revoked; and
- what happens if the account becomes inaccessible or locked.
Do not assume that a convenient communication method is secure. If access is genuinely required, first check whether there is a documented account-sharing or delegated-access option. If there is not, ask for secure instructions before disclosing any credentials.
The Information Commissioner’s Office says personal data shared with another organisation should be limited to what is necessary and sent securely to the correct person. That supports sharing only what a particular task requires, rather than handing over unrestricted access.
What the applicant must still confirm
Neither cited source sets out a standard method for sharing passwords or verification codes, a required access period, or a universal account-recovery process. The sources also do not establish whether any particular support arrangement is secure.
Before granting access, the applicant should therefore check the applicable terms and account documentation, ask for any missing information in writing, and confirm how control will be returned once the task is complete. If those points are not addressed clearly, the arrangement should not be treated as settled or automatically acceptable.