What should be recorded if a passcode is supplied?¶

If a passcode is supplied, the record should preserve both the information and the circumstances in which it was obtained.

Evidential caution: that writing down the code alone is enough. Later interpretation may depend on who supplied it, whether it worked, whether it was voluntary and what happened when it was used.

What this means¶

Where the passcode was supplied under pressure, authority or compulsion, record that accurately rather than implying informal consent.

What to check or do next¶

• Record the date, time, location and identity of the person who provided the passcode.
• Record who requested it, the exact wording of the request and any legal, policy or consent basis relied upon.
• Note whether the person entered the code themselves, spoke it aloud, wrote it down or provided it through another method.
• Record whether the code worked, how many attempts were made and what screen or device state followed.
• Do not make unnecessary test entries. Failed attempts may trigger lockouts, delays or data-protection features.
• Preserve the passcode securely and restrict access to those who need it. Do not include it casually in general notes, messages or documents that may be widely shared.
• Record whether the passcode unlocks the whole device, a work profile, an application, a SIM or another protected area.
• If the person provides several possible codes, document each separately and do not guess beyond the justified process.
• If the device was already unlocked, record why the code was requested and whether using it changed the state.