GDPR / Data Protection training that gets your team CQC-ready
- CQC-aligned, mapped to the Care Certificate framework
- Completed in the hub in over 60 languages
- A certificate for every staff member, for your CQC evidence
- A wrong answer triggers a follow-up lesson, so gaps are closed
From £25.99 per staff member, one-off. No subscription needed.
Specialists in the technology behind it all
The same AI and technology behind the world's best products powers CareStream, so your team's gdpr / data protection training stays accurate, always up to date with the latest guidance, and is delivered in over 60 languages.
Understanding Personal Information and Lawful Basis
Personal information is any data that identifies a living person, such as names, addresses, health records, or photographs. Before we collect or use personal information, we must have a lawful basis. In care work, our lawful basis is usually that processing is necessary to provide care and treatment, or to comply with legal obligations. We must tell people why we collect their information and what we will do with it through privacy notices or letters.
What is personal information under GDPR?
The correct answer is “Any data that identifies a living individual, such as names, health records, or photographs”. In the full module, a wrong answer triggers a short follow-up lesson and a fresh question, so the gap is always closed before completion.
That is how the training works. Give your whole team the full GDPR / Data Protection module.
What This Training Covers
A clear, practical grounding in gdpr / data protection.
This training covers how we protect personal information at the care setting in line with GDPR and our Data Protection policies. You will learn about lawful processing, consent, data security, handling breaches, and responding to access requests. Understanding these rules protects residents, staff, and our service from harm and legal issues.
Learning Outcomes
By the end, your staff will be able to:
What Your Team Will Learn
A closer look at the gdpr / data protection module.
The module is built in short, practical sections. Each one teaches a part of the topic, then applies it to a real care scenario and checks understanding before moving on.
Understanding Personal Information and Lawful Basis
Personal information is any data that identifies a living person, such as names, addresses, health records, or photographs. Before we collect or use personal information, we must have a lawful basis. In care work, our lawful basis is usually that processing is necessary to provide care and treatment, or to comply with legal obligations. We must tell people why we collect their information and what we will do with it through privacy notices or letters.
Obtaining and Recording Consent
Sometimes we need specific consent to use personal information, especially for purposes beyond basic care provision, such as sharing photographs or providing information to researchers. Consent must be freely given, specific, informed, and clearly recorded. The person must understand what they are consenting to and be able to withdraw consent at any time. We follow our policy for obtaining consent and document it properly in care records.
Data Security and Confidentiality
We must keep all personal information secure and confidential. This means following our Computer Security and Confidentiality policies. Never leave computers unlocked or files open where others can see them. Do not share passwords or access codes. Only access information you need for your work. Never discuss resident information in public areas or with people who do not need to know. Lock paper records away when not in use.
Recognising and Reporting Data Breaches
A data breach happens when personal information is lost, accessed by unauthorized people, altered, or disclosed inappropriately. Examples include losing a memory stick with resident data, sending an email to the wrong person, or leaving files in a public area. If you suspect a breach, report it immediately to the manager. We must follow our Information Governance and Data Breach policy. Quick reporting allows us to limit harm and meet our legal duty to report serious breaches to the Information Commissioner's Office within 72 hours.
Data Protection Impact Assessments
A Data Protection Impact Assessment (DPIA) identifies and reduces privacy risks when we start new projects or change how we handle information. Our policy requires a DPIA when we collect new types of information, use information for new purposes, introduce new technology, or make decisions that significantly impact individuals. The flowchart in our policy helps determine if a DPIA is needed. The manager coordinates DPIAs, but all staff should recognize situations that might need one.
Access Requests and Records of Deceased Residents
Living individuals have the right to access their personal information. We must respond within one month. After a resident dies, we keep their records for at least three years. GDPR does not cover deceased people, but we treat their records with the same confidentiality as if they were alive. If someone requests access to a deceased resident's records, we consider it carefully on a need to know basis. Only those with a legitimate claim, such as executors or those with a claim arising from the death, may access information directly relevant to that claim. We may refuse unreasonable requests and can seek legal advice.
Key Points Covered
The things your team must remember.
- Always have a lawful basis for collecting and using personal information, usually to provide care or meet legal duties
- Obtain specific, informed consent when required and record it properly; people can withdraw consent at any time
- Keep all personal information secure: lock screens, secure files, never discuss residents in public areas
- Report any suspected data breach immediately to the manager, even if accidental
- Recognize when a Data Protection Impact Assessment is needed for new projects or technology
- Treat records of deceased residents with the same confidentiality as living people; refer access requests to the manager
Who and how often
GDPR / Data Protection is refreshed every year, for the staff in your care setting whose roles require it.
CQC and standards
Supports the training evidence CQC expects to see for a well-run, safe care setting.
How CareStream Delivers It
Not a slideshow once a year. Training that sticks.
CareStream delivers gdpr / data protection training in the hub your team already uses, grounded in best practice and your own policies, so it fits your care setting and not a generic template.
Teach, then assess
Short teaching sections and a real care scenario, then an assessment that checks understanding.
In any language
Staff complete it in over 60 languages, while your records stay in English.
Learn and retry
A wrong answer triggers a short follow-up lesson and a fresh question, so the gap is closed.
Renewals handled
Automatic reminders at 90, 30 and 7 days, with a live compliance dashboard.
How your team gets trained
From your dashboard to your team, in the CareStream hub.
Training is delivered in the hub each staff member logs into. You allocate the modules, they complete them in their own language, and you get the completion records and certificates for your CQC evidence, with any gaps closed by automatic follow up training.
- 01
Buy and allocate
Assign GDPR / Data Protection to each staff member in seconds. No course builder and no setup for each person.
- 02
They complete it in the hub
Staff work through the module on any device, in over 60 languages, teaching then checking understanding. A wrong answer sends a short follow up lesson.
- 03
You track it
See live completion status and a certificate for every person, ready as evidence for CQC.
Safeguarding Adults
GDPR / Data Protection
Moving & Handling of People
Infection Prevention & Control
In every language
Any step, in their language, in one tap.
Care teams are diverse and training should not leave anyone behind. On any lesson or question, a staff member taps the language button and the whole step flips into the language they think in. They understand it properly, and your records stay in English.
- One tap flips any lesson or question into their language, instantly.
- Over 60 languages, with no setup and no separate versions to manage.
- Completions and certificates stay in English for your CQC evidence.
Try the language button in the preview, or see every language
GDPR / Data Protection
Learning: what to read first
About 35 minThis training covers how we protect personal information at the care setting in line with GDPR and our Data Protection policies. You will learn about lawful processing, consent, data security, handling breaches, and responding to access requests. Understanding these rules protects residents, staff, and our service from harm and legal issues.
Built for real learning, not box ticking
Every CareStream course goes further than a lesson and a quiz. These features come as standard on every course, giving your staff a richer way to learn and giving you the evidence to prove it.
References and further reading
Every course is built on recognised UK guidance and cites its sources, from NICE and Skills for Care to the NHS and the legislation itself.
Key terms explained
A plain English glossary of the technical terms in each course. A simple way to support every learner, including staff with English as a second language.
Measured learning gain
A quick knowledge check before the lesson is compared with the final assessment, so every certificate comes with evidence of how much the course actually taught.
Reflective practice
After passing, staff record what they will do differently in their day to day work. Their reflection is saved to their training record and shown with their certificate.
A course summary to keep
A printable one page takeaway of the outcomes, key points and key terms. Perfect for staff files, supervision conversations and the staff room wall.
Observed competency checklist
A printable checklist for managers to confirm skills in practice, with a sign off section. It completes the picture beyond the knowledge assessment.
Wrong answers become lessons, not failures
Most e learning marks an answer wrong and moves on. CareStream does not. Every wrong answer triggers an automatic follow up loop that teaches the point again and rechecks it, so no knowledge gap is left behind.
Instant lesson and feedback
A wrong answer immediately opens a short lesson explaining the point, so the gap is closed there and then.
Targeted follow up question
A fresh question on the same point checks the lesson has landed. The loop repeats until it has.
Progress only when understood
Staff move on to the next module and their certificate once they genuinely know the answer, not just after one lucky guess.
Why choose CareStream?
Training built for the care sector, delivered the way busy teams actually learn.
Time to complete: ~35 min
FAQs
Frequently asked questions.
Related training modules
More mandatory and role-specific training CareStream delivers to your team, in the hub, in any language. Add any of these to your basket.
AnnualDocumentation and Record Keeping
This training covers how we keep accurate, secure records in our home, including our digital record keeping system. Good record keeping protects the people we support, helps us provide better care, and meets our legal duties under data protection law and CQC standards.
Bulk discounts from 10+ licences
AnnualCyber Security
This training covers how to protect our computer systems, data and the people we support from cyber threats. You will learn our security procedures, how to recognise risks like phishing and viruses, and your responsibilities under data protection law. Cyber security is everyone's responsibility and protects both our service users and our organisation.
Bulk discounts from 10+ licences
AnnualNational Data Opt-out
This training explains the National Data Opt-out system and how it affects the way we handle personal information about the people we support. You will learn what the opt-out means, how to check if someone has registered, and how to respect their choices when sharing information. This protects people's rights and keeps our service compliant with data protection law.
Bulk discounts from 10+ licences
AnnualGeneral Health & Safety Awareness
This annual refresher covers essential health and safety practices you use every day in our home. You will review how to prevent and respond to falls, manage food allergies safely, and maintain a safe environment for residents and staff. The training is based on our own policies and procedures.
Bulk discounts from 10+ licences
AnnualCOSHH (Control of Substances Hazardous to Health)
This training covers how to safely handle, store and dispose of hazardous substances in our home, including cleaning chemicals, medications and clinical waste. You will learn our procedures to protect yourself, residents and colleagues from harm. Understanding COSHH is essential for maintaining a safe environment every day.
Bulk discounts from 10+ licences
AnnualRIDDOR (Accident and Incident Reporting)
This module teaches you when and how to report accidents and incidents under RIDDOR (Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013). You will learn which events must be reported to the Health and Safety Executive, how to recognise reportable incidents in your daily work, and the correct procedures to follow at our home.
Bulk discounts from 10+ licences
Give your team gdpr / data protection training that actually sticks.
See how CareStream delivers your mandatory training in the hub, in any language.