Data Protection policy

1. Policy Statement

Rachel’s Respite and Support is committed to protecting the personal and sensitive information of our service users, staff,

families, and third parties in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data

Protection Act 2018.As a care provider, we recognize the importance of confidentiality and the legal and ethical responsibility

to handle personal data appropriately—especially sensitive health and care-related information.

2. Purpose

This policy sets out how we collect, use, store, and protect personal data in our care setting. It is designed to:

• Protect the rights and privacy of individuals
• Comply with regulatory standards, including CQC's Key Lines of Enquiry (KLOEs)
• Prevent data breaches, misuse, or loss of personal data

3. Scope

This policy applies to:

• All staff (including carers, nurses, managers, admin staff, and volunteers)
• All personal data handled, whether relating to service users, employees, or others
• All forms of data—paper, electronic, verbal, photographic, etc.

4. Types of Personal Data We Process

We may collect and process the following types of data:

For Service Users:

• Name, address, date of birth, next of kin
• Health and medical history
• Care plans and risk assessments
• Medication records
• Safeguarding information

For Staff:

• Contact details and emergency contacts
• DBS checks and right-to-work documents
• Training and supervision records
• Health and safety information

5. Lawful Bases for Processing

We process personal data under the following legal bases:

• Consent – where explicit consent has been provided
• Legal obligation – to comply with care regulations and employment law
• Vital interests – to protect someone's life or wellbeing
• Public task – as part of providing regulated care
• Legitimate interests – where appropriate and balanced with individual rights

6. Confidentiality & Access

• All staff are bound by confidentiality agreements and must complete data protection training.
• Access to personal information is limited to staff who need it to perform their role.
• Service users and employees have the right to access their personal data upon request.

7. Data Sharing

We will only share personal data when necessary and appropriate, such as:

• With GPs, hospitals, and health professionals involved in care
• With CQC or other regulators for inspection or safeguarding purposes
• With legal representatives or the police, where required by law

We always ensure:

• Data sharing is lawful and proportionate
• Data sharing agreements or contracts are in place with third parties

8. Data Security Measures

We take appropriate steps to secure personal data, including:

• Locked cabinets and restricted areas for physical files
• Password protection and encryption for digital records
• Regular audits and updates of IT systems
• Staff training on safe handling and reporting of data

9. Data Retention

We retain data only for as long as necessary:

• Service user records – typically kept for 8 years after end of care (or as advised by NHS and CQC)
• Employee records – kept for 6 years after employment ends
• Records are securely deleted or destroyed when no longer required.

10. Data Breaches

Any breach or suspected breach of data security must be reported immediately to the Registered Manager or

Data Protection Officer (DPO). We will:

• Investigate all incidents promptly
• Report serious breaches to the Information Commissioner's Office (ICO) within 72 hours, if required
• Notify affected individuals when appropriate

11. Individual Rights

Under data protection law, individuals have the right to:

• Access their data (Subject Access Request)
• Request rectification of inaccurate data
• Request erasure (in some cases)
• Restrict or object to processing
• Data portability (for electronic data)

12. Responsibilities

• Registered Manager: Ensures overall compliance and staff awareness
• Data Protection Officer (if applicable): Oversees policy and handles requests
• All Staff: Must understand and follow this policy; complete mandatory training

13. Training

All staff will receive induction and annual training on:

• GDPR and data protection basics
• Handling sensitive care data
• Confidentiality and secure communication
• Recognizing and reporting data breaches

14. Policy Review

This policy will be reviewed annually or sooner if:

• Laws or guidance change
• New risks are identified
• Significant incidents occur