Data Protection and GDPR PolicyA Data Protection and GDPR Policy written for your service
- Written for your organisation, not a template with your logo on it
- Read and approved by a person before it carries your name
- Verified against all 40 required elements of the legislation below
- Kept updated when the law changes, so it never quietly goes stale
No subscription needed. First year of updates included, £12 a year after that.
One-off, first year of updates included. Delivered within 2 working days of your details. Also in the Statutory Starter Pack, 20 policies for £495.
Trusted by UK care providers
Let's build your Data Protection and GDPR Policy
Answer 9 quick questions, about three minutes, and we'll write this policy for your service, in your name, with your people. You can skip anything and add it later.
Asked once, reused for every policy you buy
That's everything we need
0 of 9 answered. You can add the rest at any point before we write it.
- Registered company name
- Trading name (if different)
- Service address
- CQC provider ID
- CQC location ID
- Registered manager
- Nominated individual
- ICO registration number
- Data protection officer (if appointed)
Your answers are saved on this device and carried into your order.
Built from the law, checked against the law
The legislation, CQC standards and guidance we analyse to write it.
Your Data Protection and GDPR Policy is structured from these regulations, then verified against every required element of each one before a person signs it off. If the law changes, your policy is updated and you are told what changed and why.
Data Protection Act 2018
- Policy document identifying the specific lawful basis (legal condition) used for processing different categories of personal data, including health and social care condition for care records, employment condition for DBS checks and payroll, and substantial public interest condition for safeguarding referrals
- Appropriate policy document(s) required under Schedule 1 Part 2 for each substantial public interest condition relied upon (as required by Article 9(2)(g) and which the ICO may request to inspect)
- Privacy notice written in plain language that residents can read and in an accessible format, explaining how personal data is used
- Procedure for responding to subject access requests within one calendar month from receipt, free of charge, including process for redacting third-party information (residents, relatives, staff) that appears on shared pages in care records
- Staff training and written warning that accessing resident files without legitimate work purpose, photographing care plans, or similar unauthorised processing constitutes a personal criminal offence under section 170 of the Act
- Data breach notification procedure requiring reporting to the ICO within 72 hours of the organisation becoming aware (not when manager is informed) of breaches such as lost handover sheets, misdirected emails, stolen devices, or ransomware incidents
The Caldicott Principles
- States that personal information may only be used or shared where there is a clear, justified and lawful purpose
- Requires that information is only accessed or shared when absolutely necessary and proportionate to the purpose
- Requires use of the minimum amount of personal information necessary for the stated purpose
- Restricts access to confidential information on a strict need-to-know basis according to staff role and responsibilities
- Establishes accountability mechanisms for how personal information is handled and by whom
- Requires all staff to be trained to understand their confidentiality responsibilities and how to apply the Caldicott Principles
UK General Data Protection Regulation (UK GDPR)
- Identifies lawful basis for processing under Article 6 (legitimate interests or public task) and Article 9(2)(h) condition (health and social care provision) for resident personal and health data
- Includes or references an appropriate policy document as required by Schedule 1 of the Data Protection Act 2018 for processing special category data
- Specifies that information sharing for direct care, safeguarding, or vital interests is permitted and lawful, and that GDPR does not prevent such sharing
- Defines unauthorised access to records (including looking up records without legitimate reason) as a criminal offence under section 170 of the Data Protection Act 2018
- States that falsifying, altering or retrospectively amending care records is a criminal offence under section 173 of the Data Protection Act 2018
- Establishes 72-hour breach notification timeline from awareness of breach and designate who can initiate breach reporting outside normal office hours when registered manager is unavailable
Written for your service
What we ask you, so none of it is assumed.
Most policy packs are one document sold to everyone with a find and replace on the home name. Your Data Protection and GDPR Policy is written from the legislation above and from your answers to the questions below. Where you have told us something, it says so. Where you have not, it sets out what must happen rather than claiming you already do it.
Your registered name, address, CQC numbers and who holds the key roles. About three minutes. Nothing else is asked before you buy.
Asked once in your own account and used across every policy you own, so a second policy never asks you the same thing twice.
Why it matters. A policy that claims you assess your premises annually, when you never have, is not a harmless overstatement. It is a signed statement handed to your inspector. We would rather write what you must do than guess what you already do.
How it is made
From your details to a policy you can stand behind.
The short questions above: who you are, your CQC registration, and the people this policy names.
One section per required element of the legislation, in your name, with your people.
Automated checks against every required element, then a person reads it before it ships.
When legislation changes, your policy is updated and you are told what changed and why.
Common questions
What you are actually buying.
What exactly do I receive?
A complete Data Protection and GDPR Policy written for your organisation, in your dashboard and as a print-ready PDF on your own letterhead. It names your service, your registration details and your leads, because you gave us them.
Is this a template?
No. Each policy is written for the organisation buying it, structured from the legislation itself, verified against 40 required regulatory elements, and read by a person before it carries your name.
How quickly will I get it?
Within 2 working days of you completing the short questions above. Most arrive sooner.
What happens when the law changes?
We monitor UK care legislation continuously. When something affecting this policy changes, your copy is updated and you are told what changed and why. The first year of updates is included, then £12 a year per policy.
Can I edit the policy myself?
No, and deliberately so: we stand behind every word we approve. If something needs changing, tell us and we amend and re-verify it, so it always remains a document we can both defend to an inspector.
What if I need more than one policy?
Most services do. The Statutory Starter Pack covers the twenty policies every CQC-registered service is expected to hold for £495, and the Complete Policy Library covers all 66.
Why CareStream
Policies written the way an inspector expects to read them.
Before you buy
What the document actually looks like.
Every section it contains, and a page of the real thing. We show the structure and the personalisation rather than the wording, because the wording is what you are paying us to write for your service.
Contents of your Data Protection and GDPR Policy
- Purpose and scopewho it covers
- Legal and regulatory frameworkcited in full
- Definitions used in this policy
- Roles and responsibilitiesyour people, named
- Procedure, step by step
- Recording, reporting and escalation
- Training and competency
- Monitoring, audit and review
- Related policies and documents
- Version control and approvalsigned and dated
Section 4 · Roles and responsibilities
Who is accountable, by name
Overall accountability for this policy rests with your registered manager, supported by your nominated individual. Day to day responsibility sits with your named lead, who is the first point of contact for staff at your service address.
The remaining wording is written for the organisation buying it, so it is not shown here.
“The inspector asked for evidence and I had it on screen before she finished the sentence.”
Registered Manager · 48-bed nursing home, West SussexRelated policies
More policies your service may need.
More statutory and operational policies CareStream writes for your service, personalised, human-reviewed and kept updated, exactly like this one.
Safeguarding Adults Policy
Recognising, responding to and reporting abuse and neglect, aligned to the Care Act 2014 and your local authority procedures.
Medicines Management Policy
Ordering, storage, administration, recording and disposal of medicines, including errors and self-administration.
Mental Capacity and DoLS Policy
Capacity assessment, best-interests decisions and deprivation of liberty safeguards under the MCA 2005.
Health and Safety Policy
Your general statement, organisation and arrangements under the Health and Safety at Work etc. Act 1974.
Infection Prevention and Control Policy
IPC arrangements aligned to the Code of Practice, including audit and cleaning schedules.
Fire Safety Policy
Prevention, detection, evacuation (including PEEPs) and staff responsibilities under the Fire Safety Order 2005.
Compared
The four ways care services get a policy.
We have compared what each approach does rather than naming competitors, because products change and the comparison should still be true next year.
| CareStream | A policy pack | A consultant | A free template | |
|---|---|---|---|---|
| Questions asked at the point of purchase, so it is personalised rather than blank | ||||
| Written for your service, naming your manager and your leads | ||||
| Structured from the regulations, every required element checked before it is sent | ||||
| A branded companion document setting out the law it was written against | ||||
| Read and approved by a person before it carries your name | ||||
| Prints on your own letterhead with a sign-off and version block | ||||
| Named role holders update everywhere when the person changes | ||||
| Kept current when the law changes, and you are told what changed | ||||
| Turnaround stated before you buy | ||||
| Your staff can ask it questions in their own language | ||||
| What it costs | £39 to £79 per policy, one-off | £250 to £995 for the pack | A day rate, typically £400 upwards | Nothing |
Prices are the published rates of the common alternatives as at September 2026, for comparison only.
Training
Owning the policy is half of it
An inspector asks whether your staff understood it, not whether you hold it. Ninety eight modules written and kept current by us, to the same regulations, from £25.99 per staff member with no subscription.
