{{org_field_logo}}

{{org_field_name}}

Registration Number: {{org_field_registration_no}}

---

Confidential Information for Research and Planning Policy

1. Purpose

The purpose of this policy is to ensure that confidential and personal information relating to individuals receiving domiciliary support is used and disclosed lawfully, fairly, securely and transparently, including where information is requested or proposed to be used for research, service planning, audit, commissioning or other purposes beyond the individual’s direct care and support.

Our service operates in Wales. The NHS National Data Opt-Out is an NHS England policy and does not generally apply to health or care information generated or processed in Wales. It applies principally to confidential patient information arising from health and adult social care provided in England and used or disclosed for purposes beyond individual care.

Where the service receives, controls or is asked to disclose information originating from health or adult social care provided in England, the service will establish whether the NHS National Data Opt-Out applies to the particular information and proposed use or disclosure before that information is processed for purposes beyond individual care.

The organisation processes personal information in accordance with applicable data protection and social care legislation, including:

• the UK General Data Protection Regulation;
• the Data Protection Act 2018, as amended;
• the Data (Use and Access) Act 2025;
• the Regulation and Inspection of Social Care (Wales) Act 2016;
• the Regulated Services (Service Providers and Responsible Individuals) (Wales) Regulations 2017, as amended;
• the common law duty of confidentiality, where applicable; and
• applicable statutory guidance issued by the Welsh Ministers.

The service will:

• protect the privacy, dignity and confidentiality of individuals;
• ensure that personal and special category information is only processed where there is an appropriate lawful basis and, where required, an additional condition for processing special category information;
• ensure that confidential information is not disclosed for research or planning purposes unless there is lawful authority for the disclosure;
• recognise and apply the NHS National Data Opt-Out only where it is applicable to information originating from health or adult social care provided in England;
• provide individuals with appropriate information about how their personal information is used and shared; and
• maintain appropriate technical and organisational measures to protect personal information.

2. Scope

This policy applies to:

• all individuals receiving care and support from the domiciliary support service;
• all employees, workers, agency staff and volunteers who access or process personal information;
• the service provider, Responsible Individual, Registered Manager and other persons with information governance responsibilities;
• contractors and processors handling personal information on behalf of the service; and
• personal and special category information processed by or on behalf of the service.

For information generated through health or adult social care provided in Wales, the NHS National Data Opt-Out does not apply.

Where information originates from health or adult social care provided in England, or the service is involved in an England-based health or adult social care data flow, the organisation must establish whether the NHS National Data Opt-Out applies before using or disclosing confidential patient information for purposes beyond individual care.

This policy covers:

• confidentiality;
• lawful processing of personal and special category information;
• sharing information for research, planning and other purposes beyond direct care and support;
• the limited circumstances in which the NHS National Data Opt-Out may apply;
• information security; and
• staff responsibilities when handling confidential information.

3. National Data Opt-Out and Welsh Domiciliary Support Services

3.1 General Position

The NHS National Data Opt-Out is an NHS England policy. It gives eligible individuals the opportunity to prevent confidential patient information arising from health and adult social care provided in England from being used or disclosed for purposes beyond individual care where the National Data Opt-Out applies.

The National Data Opt-Out does not generally apply to information about health or care that is generated or processed in Wales.

The service must therefore not present the NHS National Data Opt-Out as a general opt-out right applying to information generated through this domiciliary support service in Wales.

3.2 When the National Data Opt-Out May Be Relevant

The National Data Opt-Out may be relevant where the service processes confidential patient information originating from health or adult social care provided in England.

Before such information is used or disclosed for a purpose beyond individual care, the person responsible for the disclosure must establish:

• where the information originated;
• the purpose for which it will be used or disclosed;
• whether the information constitutes confidential patient information;
• whether the National Data Opt-Out applies to the proposed use or disclosure;
• whether an exemption applies; and
• whether there is an appropriate lawful basis and, where relevant, special category condition and lawful authority under the common law duty of confidentiality.

Advice must be obtained from the organisation’s Data Protection Officer or Information Governance Lead where applicability is unclear.

3.3 Information Outside the National Data Opt-Out

The National Data Opt-Out does not apply merely because information concerns an individual’s health or care.

In particular, it does not generally apply to:

• information generated or processed through care provided in Wales;
• information used or shared for the direct care and support of an individual;
• appropriately anonymised information where the individual is no longer identifiable; or
• information which must be disclosed because of a legal requirement.

Any disclosure must nevertheless comply with applicable data protection legislation, confidentiality requirements and other legal obligations.

4. Individual Choices and Information Sharing

4.1 Informing Individuals

Individuals must be provided with clear, accessible and transparent information explaining how the service uses and shares their personal information.

Information must be provided in a language, style, presentation and format appropriate to the individual’s communication needs and level of understanding.

Individuals must be informed that the NHS National Data Opt-Out is not a general Welsh domiciliary support opt-out.

Where the National Data Opt-Out is relevant because information originates from health or adult social care provided in England, the individual may be signposted to the official NHS England information about the National Data Opt-Out.

4.2 Requests Not to Share Information

If an individual asks the service not to share their information, the request must be recorded and considered appropriately.

Staff must not promise that information will never be shared. There may be circumstances in which information can or must lawfully be disclosed without consent, including safeguarding, legal requirements or other situations where another lawful basis applies.

Where an individual’s request cannot be followed, the reason must be documented and, where appropriate and lawful, explained to the individual.

Where the request concerns the NHS National Data Opt-Out, staff must establish whether the information and proposed processing fall within the scope of the National Data Opt-Out before taking further action.

4.3 National Data Opt-Out Preferences

The service will not create or maintain a local National Data Opt-Out status for every individual receiving domiciliary support in Wales.

Where the National Data Opt-Out applies to an England-originating data flow, the organisation must follow the current NHS England requirements for applying the individual’s National Data Opt-Out preference at the appropriate point before the relevant information is used or disclosed for purposes beyond individual care.

Staff must not assume that an individual’s general preference about information sharing is equivalent to a National Data Opt-Out, or that a National Data Opt-Out prevents information being used or shared for the individual’s direct care.

5. Legal Responsibilities and Information Sharing

5.1 Legal Requirements

The organisation must process personal information in accordance with applicable legislation and regulatory requirements, including:

• the UK General Data Protection Regulation;
• the Data Protection Act 2018, as amended;
• the Data (Use and Access) Act 2025;
• the Regulation and Inspection of Social Care (Wales) Act 2016;
• the Regulated Services (Service Providers and Responsible Individuals) (Wales) Regulations 2017, as amended; and
• the common law duty of confidentiality, where applicable.

The organisation must also have regard to relevant statutory guidance and applicable information governance guidance.

Personal information must be:

• processed lawfully, fairly and transparently;
• collected for specified, explicit and legitimate purposes;
• adequate, relevant and limited to what is necessary;
• accurate and kept up to date where necessary;
• retained only for as long as required by applicable legal and regulatory requirements;
• protected by appropriate technical and organisational security measures; and
• processed in a manner which respects the individual’s rights.

Health information is special category personal data. Processing such information requires both an appropriate lawful basis under Article 6 of the UK GDPR and an applicable condition under Article 9, unless the UK GDPR provides otherwise.

Consent must not automatically be treated as the lawful basis for every use or disclosure of information. The appropriate lawful basis and, where relevant, special category condition must be identified according to the circumstances.

5.2 Requests for Information from External Organisations

Where an external organisation requests identifiable or confidential information about an individual, the service must establish before disclosure:

• the identity and authority of the person or organisation making the request;
• the purpose of the request;
• whether disclosure is necessary and proportionate;
• the applicable lawful basis under the UK GDPR;
• the applicable Article 9 condition where special category information is involved;
• whether the common law duty of confidentiality applies and, if so, whether there is consent or another lawful justification for disclosure;
• whether any statutory restriction or requirement applies; and
• where information originates from health or adult social care provided in England and the proposed use is beyond individual care, whether the NHS National Data Opt-Out applies.

Only the minimum information necessary for the lawful purpose must be disclosed.

The decision, lawful basis and information disclosed must be appropriately documented.

Where staff are uncertain whether information may lawfully be disclosed, they must refer the matter to the Registered Manager, Data Protection Officer or Information Governance Lead before disclosure, unless an urgent disclosure is necessary to protect a person from serious harm or to comply with an immediate legal requirement.

6. Data Security and Confidentiality

6.1 Secure Storage and Processing

Personal information must be protected by appropriate technical and organisational measures proportionate to the risks associated with the processing.

The organisation will ensure that:

• electronic records are protected against unauthorised access, loss, alteration or disclosure;
• access to personal information is restricted to authorised persons according to their role;
• appropriate authentication, password and access-control arrangements are used;
• confidential information is transmitted securely;
• paper records are stored securely and protected from unauthorised access;
• personal information is disposed of securely when lawful retention requirements have expired;
• records relating to individuals are accurate and kept up to date;
• appropriate arrangements are maintained to ensure records remain secure if the service closes; and
• records are retained for the periods required by applicable legislation and regulatory requirements.

Records relating to adults receiving a regulated service must be retained for at least three years from the date of the last entry where Regulation 59 of the Regulated Services (Service Providers and Responsible Individuals) (Wales) Regulations 2017 applies.

6.2 Staff Responsibilities

All staff must:

• maintain the confidentiality of information obtained through their work;
• access personal information only where necessary for their role;
• follow the organisation’s data protection, confidentiality, information security and records-management procedures;
• share information only where there is an appropriate and lawful reason to do so;
• verify the identity and authority of recipients before disclosing confidential information;
• promptly report actual or suspected personal data breaches in accordance with the organisation’s data-breach procedure; and
• co-operate with investigations and corrective action arising from information governance incidents.

Any deliberate, reckless or unauthorised access, use or disclosure of personal information may result in action under the organisation’s disciplinary procedures and, where appropriate, referral to a regulatory or statutory body.

7. Staff Training and Awareness

The service provider must ensure that staff are provided with information and training appropriate to their role concerning confidentiality, data protection and record keeping.

Training must ensure that staff understand:

• their duty to maintain confidentiality;
• the principles governing lawful processing of personal information;
• the additional protection applying to health and other special category information;
• when information may lawfully be shared without consent;
• information security and personal data breach reporting requirements;
• the individual’s rights concerning their personal information;
• the organisation’s relevant policies and procedures; and
• that the NHS National Data Opt-Out is an England-specific policy and must only be applied where its scope requirements are met.

Staff knowledge and compliance with relevant policies must be monitored through induction, supervision, appraisal, audit or other appropriate governance arrangements.

8. Monitoring and Regulatory Compliance

The Registered Manager and Responsible Individual must ensure that appropriate systems are in place to monitor compliance with this policy and applicable information governance requirements.

Monitoring arrangements must include, where relevant:

• audits of access to, storage of and disclosure of personal information;
• review of information governance incidents and personal data breaches;
• review of staff compliance with confidentiality and record-keeping requirements;
• confirmation that records are accurate, secure and retained in accordance with legal requirements;
• review of information-sharing arrangements with processors and other organisations;
• monitoring that staff have received appropriate training; and
• review of this policy when relevant legislation, regulatory requirements or statutory guidance changes.

The Responsible Individual must ensure that suitable arrangements are in place for policies and procedures to be kept up to date in accordance with the requirements applying to the regulated service.

9. Related Policies

This policy must be read alongside, where applicable:

• Confidentiality and Data Protection (GDPR) Policy (DCW34);
• Service User Consent Policy (DCW32);
• Whistleblowing (Speaking Up) Policy (DCW29);
• Risk Management and Assessment Policy (DCW18);
• Safeguarding Adults from Abuse and Improper Treatment Policy (DCW13);
• Records Management and Retention Policy;
• Information Security Policy;
• Personal Data Breach Procedure; and
• Complaints Policy.

Where any of the policies listed above are incorporated within another organisational policy rather than maintained as separate documents, the corresponding organisational procedure applies.

10. Policy Review

This policy must be kept up to date and reviewed whenever there is a relevant change in legislation, regulatory requirements, statutory guidance, NHS England National Data Opt-Out requirements or the nature of the service’s information-processing activities.

A formal review will also be undertaken at least annually in accordance with the organisation’s policy review arrangements.

The Responsible Individual must ensure that suitable arrangements are in place for the service provider’s policies and procedures to remain current, and the Registered Manager is responsible for implementing this policy within the day-to-day operation of the service.

---

Responsible Person: {{org_field_registered_manager_first_name}} {{org_field_registered_manager_last_name}}
Reviewed on: {{last_update_date}}
Next Review Date: {{next_review_date}}
Copyright © {{current_year}} – {{org_field_name}}. All rights reserved.