I'm not going to comply. I've sighted this as my reason.
I accept that they need to check the integrity of the data. However, I feel that a request such as this should be in writing so as to create a paper chain showing that a disk in the post was
- absolutely necessary given the risk to my business of the possible bad publicity if it goes astray
- done with adequate encryption
These issues are on-going.
I need to find myself a good IT aware lawyer, as soon as possible, to help me get these guys on the right track.