{{org_field_logo}}

{{org_field_name}}

Registration Number: {{org_field_registration_no}}

---

National Data Opt-Out Policy

1. Purpose

The purpose of this policy is to ensure that {{org_field_name}} fully complies with the National Data Opt-Out Programme, which gives individuals the right to opt out of their confidential patient information being used for research and planning purposes. This policy aligns with the requirements set by NHS Digital, the Care Quality Commission (CQC), and the Data Protection Act 2018.

As a supported living provider, {{org_field_name}} is committed to respecting the choices of our service users while ensuring that we meet our legal obligations under the General Data Protection Regulation (GDPR) and the Health and Social Care Act 2008. This policy outlines how we manage the opt-out process efficiently, ensuring that service users’ rights are upheld without compromising the quality of care provided.

2. Scope

This policy applies to all staff, service users, and stakeholders involved in the management, processing, or sharing of confidential service user information within {{org_field_name}}. It covers the use of data for purposes beyond individual care, specifically for research and planning, ensuring that service users can make informed decisions regarding their personal information.

The policy applies across all settings, including digital systems, paper records, and any third-party platforms used to process service user data.

3. Policy Statement

{{org_field_name}} recognises the importance of protecting service users’ confidential information and their right to decide how their data is used beyond direct care. We are committed to ensuring that:

• Service users are fully informed about the National Data Opt-Out.
• Their choices are respected and accurately recorded.
• Staff are trained to manage opt-out requests efficiently.
• Data sharing practices align with legal and ethical standards.

This policy ensures that no service user experiences discrimination, reduced access to services, or compromised care due to their decision to opt out.

4. Implementation and Responsibilities

4.1 Leadership and Governance

The Registered Manager ({{org_field_registered_manager_first_name}} {{org_field_registered_manager_last_name}}) and Data Protection Officer (DPO) ({{org_field_data_protection_officer_first_name}} {{org_field_data_protection_officer_last_name}}) are responsible for ensuring the effective implementation of the National Data Opt-Out Policy. This includes:

• Regularly reviewing systems and practices to ensure compliance with national standards.
• Providing staff with up-to-date training on data protection and opt-out procedures.
• Monitoring adherence to the policy and addressing any breaches promptly.

This approach aligns with CQC’s Good Governance Regulation 17, ensuring that data management systems operate effectively.

4.2 Staff Responsibilities

All staff members are responsible for understanding and implementing the National Data Opt-Out process. This includes:

• Providing clear, accessible information to service users about their opt-out rights.
• Respecting and documenting any opt-out decisions without judgment or bias.
• Ensuring that service users who opt out continue to receive high-quality, person-centred care in line with CQC Regulation 9.

Staff must escalate any uncertainties or issues regarding data opt-outs to the Registered Manager or DPO immediately.

4.3 Service User Awareness and Choice

To support informed decision-making, {{org_field_name}} ensures that all service users are made aware of the National Data Opt-Out at the point of initial assessment and during regular care reviews. This is achieved by:

• Providing easy-to-understand leaflets, verbal explanations, and visual aids.
• Offering support from advocates or family members if the service user has communication difficulties.
• Ensuring that Mental Capacity Act principles are applied when assessing a service user’s ability to make decisions regarding data opt-out.

If a service user chooses to opt out, staff will explain the implications clearly, including what types of data sharing are affected and what remains unaffected, such as information sharing for direct care purposes.

5. Managing Opt-Out Requests Efficiently

{{org_field_name}} has established a clear, user-friendly process for managing opt-out requests, ensuring efficiency and accuracy at all stages:

1. Recording Opt-Out Preferences:
   • Service users can opt out by informing any staff member, who will escalate the request to the DPO.
   • The DPO will verify the request, ensuring that the service user understands the implications and has the capacity to make the decision.
2. Updating Records:
   • The service user’s care record will be updated promptly to reflect the opt-out status.
   • The opt-out preference will be flagged in digital systems and care plans, ensuring that all relevant staff are aware.
3. Data Processing and Sharing:
   • All data-sharing activities are screened against the NHS Digital’s National Data Opt-Out system, ensuring that opt-out preferences are respected when confidential information is used for research or planning.
   • Data shared for direct care purposes remains unaffected by the opt-out.
4. Third-Party Compliance:
   • Any third-party organisations, including partner agencies and contractors, must demonstrate compliance with the National Data Opt-Out before accessing service user information.
5. Audit and Monitoring:
   • Regular audits are conducted to ensure that opt-out preferences are consistently respected.
   • Any discrepancies are addressed immediately, and staff involved are retrained as necessary.

6. Safeguarding and Exceptional Circumstances

In rare cases where data sharing is necessary to protect an individual from harm or abuse, the opt-out may not apply. This aligns with safeguarding requirements under CQC Regulation 13. In such cases:

• The DPO will assess the situation, ensuring that data sharing is proportionate and lawful.
• The service user (or their advocate) will be informed of the decision unless doing so would increase the risk of harm.

7. Training and Awareness

All staff at {{org_field_name}} receive comprehensive training on the National Data Opt-Out, ensuring they can:

• Explain the opt-out process clearly to service users and families.
• Respect and document opt-out decisions accurately.
• Recognise when opt-out preferences may not apply due to safeguarding concerns.

Training is reviewed annually and updated to reflect changes in legislation or CQC guidance.

8. Communication and Accessibility

To ensure accessibility for all service users:

• Information about the National Data Opt-Out is available in multiple formats, including easy-read, large print, and digital versions.
• Translators or advocates are provided where necessary to support understanding and decision-making.
• Staff are trained to deliver information in a sensitive, person-centred manner.

9. Monitoring and Continuous Improvement

{{org_field_name}} is committed to continuous improvement in managing the National Data Opt-Out. This is achieved through:

• Regular audits to ensure that opt-out preferences are respected across all data-sharing activities.
• Feedback from service users, families, and staff to identify areas for improvement.
• Incident reporting and root cause analysis if any breaches occur.

Findings from audits and feedback are reported to senior leadership and used to inform staff training and policy updates.

10. Related Policies

This policy works alongside the following policies:

• Confidentiality and Data Protection (GDPR) Policy.
• Person-Centred Care Policy.
• Safeguarding Adults from Abuse and Improper Treatment Policy.
• Good Governance Policy.
• Duty of Candour Policy.
• Mental Capacity and Deprivation of Liberty Safeguards Policy.

11. Policy Review

This policy will be reviewed annually or earlier if there are changes to legislation, CQC guidance, or NHS Digital requirements. The Registered Manager and DPO are responsible for ensuring the policy remains current and effective.

---

Responsible Person: {{org_field_registered_manager_first_name}} {{org_field_registered_manager_last_name}}
Reviewed on: {{last_update_date}}
Next Review Date: {{next_review_date}}
Copyright © {{current_year}} – {{org_field_name}}. All rights reserved.