This article outlines the protocol for accessing a staff member's email account. In alignment with our commitment to privacy and the Privacy and Personal Information Protection Act 1998 (NSW),  access to email accounts is controlled to ensure access is only granted to ensure business continuity or to address legitimate operational requirements.

1. Primary Method: Self-Delegation (Preferred)

The most efficient way to grant access is for the staff member to action it themselves before their absence. This requires no IT intervention or executive approval.

• When to use: Planned leave, handover of duties, or collaborative projects.

• How to action: Please refer to our internal guide: Set Out of Office and Delegate Access to Your Mailbox.

• Benefit: The staff member maintains control over who sees their emails and for how long.

2. Secondary Method: Managed Access (UAM Request)

Step-by-Step Submission via UAM

1. Access UAM: Open the User Access Manager from your Google Dashboard
2. Navigate to Approvals: Select 'Approvals' from the left-hand menu
3. Create New Request: Click the 'Add' button in the top right corner
4. Assign Request: Assign the request to the relevant person, normally the Privacy Officer (CEO) and/or their delegate
5. Select Request Type: Choose 'User Specific'
   
6. Related User: Select the staff member whose mailbox needs to be accessed (the user to which the change will apply)
   
7. Request Category: Select 'Access to Another Users Mailbox' from the dropdown menu
   
8. Provide Rationale: Enter a detailed explanation as to the changes required and the reasons why to enable the Executive team enough information to make an informed decision. Include:
   
1. The specific reason for the staff member's unavailability.
   
2. The business tasks or information required from the inbox
   
9. Save: Select 'Save' in the top right-hand corner

3. Approval and Implementation

Once the request is submitted, it follows a strict security and notification workflow:

• Executive Assessment: The Privacy Officer (CEO) or their delegate will review the rationale against privacy standards

• IT Action: If approved, the IT Department is automatically notified and the access will be updated

Security & Notification: To facilitate this access, the IT Helpdesk must change the user's password. The account owner will be aware that their account has been accessed because their existing password will no longer work. 

---

4. Approver's Checklist (UAM Guide)

The Privacy Officer (CEO) or delegate should verify the following before approving:

• Legitimacy: Is there a documented business need that cannot wait until the staff member returns?

• Permission: Has an attempt been made to contact the staff member for voluntary delegation?

• Accountability: Does the UAM record clearly show who is requesting the access and why?