Data Protection & Confidentiality Policy

What's inside

This policy is fully drafted and structured, ready to brand and complete for your service. It covers:

• 1. Purpose
• 2. Scope
• 3. Policy statement
• 4. Definitions
• 5. Legal and regulatory framework
• 6. Data protection principles
• 7. Lawful bases for processing
• 8. The common law duty of confidentiality and the Caldicott Principles
• 9. Individuals' rights
• 10. Consent and transparency
• 11. Data protection by design and by default
• 12. Information security
• 13. Data sharing and processors
• 14. Personal data breaches
• 15. Roles and responsibilities
• 16. Training
• 17. Monitoring, audit and compliance
• 18. Related documents
• 19. Document control and review
• 20. Disclaimer

Legislation & standards it maps to

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Data (Use and Access) Act 2025
• Common Law Duty of Confidentiality
• Caldicott Principles (UK Caldicott Guardian Council)
• Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Regulation 17 (Good governance)
• Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR)
• Data Security and Protection Toolkit (DSPT)
• Information Commissioner's Office - Guide to the UK GDPR
• Human Rights Act 1998 (Article 8)

Who it applies to

All staff, locums, students, volunteers, contractors and data processors acting on behalf of [Organisation Name].

How it works

1. Buy securely with Stripe - instant, no VAT, no account needed.
2. Download your editable Word file from the link we email you straight away.
3. Complete the placeholders for your service, then have it approved before use.
4. Add the optional updates subscription and we keep it current as guidance changes.