ircumstances in which adoption agencies must disclose information from the records, or have discretion to do so. Records must be retained for a minimum of 75 years from the date of the adoption order. 10.8. The adoption agency should keep its security arrangements under review. Any breach of the security of records are acted on promptly and security arrangements changed, if necessary, to prevent recurrence. All agency staff with responsibility for handling adoption case records should be clear as to their duty to safeguard the records at all times. 10.9. ISR 4.2 distinguishes between the provision of an intermediary service and an adoption agency’s function of disclosing information to adopted adults about their adoption, their family history and early life. Initially, most adopted people seek information about their adoption and reflect on this before deciding if they wish to go further and initiate a search for a birth relative. Where an adopted person is only seeking information about their adoption, they should apply to the adoption agency that holds the relevant case records about their adoption. The adoption agency has the discretion under regulation 15 of the 1983 Regulations to disclose the information it considers appropriate to the adopted person. The adoption agency’s function of providing access to the records it holds does not in itself constitute an intermediary service for the purposes of section 98 of the Act and the regulations. 10.10. Adoption records, like other records, are subject to the provisions of the Data Protection Act 1998, except in one respect. They are exempted from the subject access provisions of section 7 of that Act by virtue of the Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 (as amended by article 2 of the Ado