Let customers complete a task without another chase.

An adviser working with two customer organisations needs two clearly separated workspaces. The same email address may be authorised to help both customers, but that does not give either customer access to the other's documents. This hypothetical case is a useful starting point for a New Zealand organisation assessing a portal.

Separate the person from each membership

The adviser has a personal account and a separately approved relationship with each customer. When selecting a workspace, they should recognise which organisation's records they are viewing and which actions that membership permits. Staff privileges are a different arrangement again; they should not be granted simply because someone advises a customer.

Consider a contact leaving one customer while continuing to advise the other. Removing that membership should end the relevant access without deleting the person's legitimate work elsewhere. The customer needs an agreed way to appoint a replacement contact and recover access through an authorised process.

Make document approval explicit

A named reviewer can receive a document for one customer, request a correction and approve the revised version. Downloading it is a separate action from approving it. The staff view should show the current document and any outstanding decision so that a portal does not become another place to retype updates.

Check whether a portal earns its place

For occasional exchanges, an appropriate secure document service may be enough. A custom workspace is worth assessing when recurring tasks, memberships and approvals need a connected experience. Use invented records during that assessment.

The organisation should review personal-information access, providers and overseas arrangements before live records are shared. The Privacy Commissioner's principle 12 information can inform that discussion; a portal design alone does not establish compliance. Talk through the customer task →