Access to Records & Files Policy Suite (UK GDPR Art 15 | CQC Reg 17 | SAR Log | 5 Operational Forms)

Complete CQC-compliant Access to Records and Files documentation suite, built by a practising Registered Manager operating a CQC Good-rated community care service with ISO 9001 and ISO 45001 certification.

What’s included — 4 documents, 5 forms

✔ Policy Template (ARF1) — comprehensive records governance policy covering the lawful basis for processing service user personal data, Subject Access Request procedure under UK GDPR Article 15, Data Controller accountability, records retention and secure disposal, third-party information redaction under Article 15(4), principle of least privilege for staff access, ICO breach notification within 72 hours, Data Protection Impact Assessment triggers, and quarterly access permissions governance. Fully white-label and editable. Version 3.0.

✔ Excel Forms Workbook (ARF2) — 5 operational forms across 6 tabs (1 Contents index + 5 forms), each in a dedicated worksheet, cross-referenced within the policy body:

1. Subject Access Request (SAR) Log (Form 1) — statutory tracking of all UK GDPR Article 15 requests with 1-calendar-month response deadline, exemption determination, and 6-year closure retention
2. Record Access Request (Form 2) — staff and professional authorisation framework for accessing service user records with Data Controller approval gate
3. Third-Party Information Review Checklist (Form 3) — UK GDPR Article 15(4) redaction decisions protecting third-party rights in SAR responses
4. Access Decision Record (Form 4) — formal documentation of access approval or denial with statutory reasoning and audit trail
5. Quarterly Access Permissions Review (Form 5) — governance audit applying the principle of least privilege to electronic record access, evidencing systematic oversight under CQC Regulation 17

✔ Individual Word Forms (ARF3) — all 5 forms above as standalone, print-ready Word documents in fill-in format. Each form is self-contained with instructions and clearly labelled for day-one deployment.

✔ Master Implementation Checklist (ARF5) — comprehensive 4-phase implementation checklist covering policy tailoring, forms setup, staff training, and governance readiness. RAG-rated priority coding throughout (MUST / SHOULD / GOOD PRACTICE). Designed to be completed before going live and retained as CQC inspection evidence.

Regulatory coverage

• UK GDPR Article 15 — Right of access by the data subject, statutory 1 calendar month response timeframe, right to a copy of personal data, right to information on purposes, recipients, retention, and data subject rights
• UK GDPR Article 15(4) — Third-party rights protection and redaction duty when providing data subject access
• Data Protection Act 2018 — Lawful basis for processing, ICO registration, Data Controller obligations, breach notification within 72 hours
• CQC Regulation 17 — Good governance (records management, audit trail, governance oversight) — primary CQC regulation, fully mapped throughout
• CQC Single Assessment Framework — aligned to Well-Led (W5 Governance, Management and Sustainability) quality statement for records governance evidence
• Care Act 2014 — Information sharing duties, safeguarding data handling under Section 42, and the well-being principle
• ICO Guidance — Subject Access Code of Practice, accountability principles, and Data Protection Impact Assessment guidance
• Human Rights Act 1998 Article 8 — Right to respect for private and family life, informing records access and disclosure decisions
• Equality Act 2010 — Reasonable adjustments for data subjects requesting access to records in accessible formats

For all community services

Domiciliary care · Live-in care · Extra care housing · Supported living · Outreach · Day services · Reablement

Buy once — yours permanently

£74.99 one-time purchase. No subscription required. No renewal fees. Purchase once and deploy across your organisation.

Licence scope

This suite is licensed for use by the purchasing legal entity and any subsidiary undertakings registered under the same parent company at Companies House. The suite may be white-labelled with your organisational branding, customised to reflect your operational context, and deployed across your registered service types. The suite may not be resold, sublicensed, published to third-party platforms, or shared with providers outside your organisational group.

Why this suite

• Written by a practising Registered Manager operating a CQC Good-rated community care service with ISO 9001 and ISO 45001 certification
• UK GDPR Article 15 compliance is a statutory right and non-compliance can trigger ICO enforcement action, monetary penalty notices, and reputational damage — this suite provides the complete evidence trail for every SAR received
• 1 calendar month statutory response timeframe embedded into the SAR Log (Form 1) with extension criteria under Article 12(3) fully documented
• Third-Party Information Review Checklist (Form 3) — structured Article 15(4) redaction framework protecting the rights and freedoms of family members, staff, and professionals named in service user records
• Access Decision Record (Form 4) — formal Data Controller approval or denial documentation with statutory reasoning, exemptions cited, and data subject notification pathway
• Quarterly Access Permissions Review (Form 5) — systematic application of the principle of least privilege to electronic records access, evidencing ongoing CQC Regulation 17 governance and SAF W5 (Governance, Management and Sustainability) compliance
• ICO breach notification protocol embedded — 72-hour reporting framework with Data Controller accountability and data subject notification triggers
• Data Protection Impact Assessment triggers identified for high-risk processing activities in line with ICO accountability principles
• RAG-coded implementation checklist — priority MUST, SHOULD, and GOOD PRACTICE items so you know exactly what is mandatory for CQC compliance and what is quality enhancement
• Records retention schedule aligned to CQC guidance, Care Act 2014 information duties, and statutory limitation periods

File formats: 3 × Word (.docx) · 1 × Excel (.xlsx)

Delivered by: Care Franchising Compliance, a trading style of Care Franchising Limited (registered in England and Wales, Company No. 16271445).