Data protection policy.

Blisscare Group is committed to protecting the privacy, dignity, confidentiality and rights of every individual whose personal information it collects, holds, uses, shares or otherwise processes. Information handled in health and social care, nursing, children’s services, safeguarding, recruitment and employment may be particularly sensitive. Inappropriate access or disclosure can expose individuals to harm, distress, discrimination or exploitation.

This policy establishes minimum standards for lawful, fair, transparent and secure processing. It supports compliance with the UK GDPR, Data Protection Act 2018, applicable provisions of the Data (Use and Access) Act 2025 as in force, confidentiality duties and relevant care, safeguarding and regulatory requirements.

• Protect the confidentiality, integrity and availability of personal information.
• Set procedures for collection, access, use, sharing, retention and deletion.
• Protect service users, children, families, staff, applicants, agency workers and other individuals.
• Prevent and respond to loss, unauthorised access, alteration and disclosure.
• Promote accountability, training, audit and continuous improvement.

This policy applies to each Blisscare Group legal entity that formally adopts it, including adult social care, home care, nursing, agency staffing, children’s services, family support, recruitment, training, finance, HR, quality assurance and business administration in England, Wales and Scotland.

Entities and trading names associated with the Group include Blisscare & NA UK LTD, Blisscare and Homes UK LTD, Blissafrican Group Services Ltd, Blisscare Solutions and Blisscare and Nursing Agency UK Midlands. The legal identity of the controller for each activity must be confirmed. Group membership alone does not make every company a joint controller.

The policy covers electronic and paper care files, staff records, emails, messaging, incident reports, health and medication records, CCTV, photographs, audio/video, websites, cloud systems, mobile devices and approved AI systems. It applies to employees, managers, agency workers, volunteers, students, contractors, consultants and authorised third parties.

Relevant requirements may include the UK GDPR; Data Protection Act 2018; Data (Use and Access) Act 2025, where in force; Human Rights Act 1998; common-law confidentiality; applicable children’s and adult safeguarding legislation; Mental Capacity Act 2005; Care Act 2014; Health and Social Care Act 2008 and associated regulations; applicable Welsh and Scottish requirements; employment law; regulatory standards; and commissioning contracts.

The Data Protection Lead must monitor relevant changes and recommend updates. Managers must apply the law and regulatory requirements relevant to the service and nation in which they operate.

Personal data

Information relating to an identified or identifiable living person.

Special category data

Data concerning health, ethnicity, religion or beliefs, political opinions, trade union membership, genetics, biometrics used for unique identification, sex life or sexual orientation.

Criminal offence data

Information about criminal convictions, offences, alleged offences and related security measures, subject to the legal definition.

Controller / processor

The controller determines the purposes and means of processing; a processor handles personal data on behalf of a controller.

Personal data breach

A security incident causing accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data.

DPIA

A Data Protection Impact Assessment evaluating privacy risks and safeguards for processing likely to result in high risk.

All processing must follow lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

Before processing personal data, the relevant legal entity must identify and document an appropriate Article 6 UK GDPR lawful basis, such as consent, contract, legal obligation, vital interests, public task where legally available, or legitimate interests where applicable and supported by an assessment.

For special category data, an additional applicable Article 9 condition must be identified. Criminal offence data must meet Article 10 UK GDPR and relevant Data Protection Act 2018 requirements. Where required, the entity must document a Schedule 1 condition and maintain an appropriate policy document.

Consent must be freely given, specific, informed and withdrawable where consent is relied upon. Consent is not automatically the correct basis for every care activity. Sensitive health, disability, medication, safeguarding, ethnicity, religion or criminal-offence information must receive enhanced protection and must not be disclosed to unauthorised people.

The relevant entity must provide accessible privacy information explaining, as applicable: controller identity and contact details; purposes and lawful bases; categories of data; recipients; retention periods or criteria; individual rights; the right to complain to the ICO; whether provision is required by law or contract; international transfers; and relevant automated decision-making. Where data is obtained indirectly, required information must be provided within the applicable statutory timeframe unless an exception applies. Notices should be accessible to children and people with communication needs.

Information may be shared with authorised healthcare professionals, social workers, local authorities, commissioners, regulators, emergency services and safeguarding partners where necessary and lawful. Before sharing, check recipient identity and authority; purpose and necessity; lawful basis and any additional condition; proportionality; whether the individual should be informed; and whether disclosure must be recorded. Contracts do not remove the need to comply with data protection law.

The Group must apply technical and organisational controls proportionate to the sensitivity and risks of information, including where appropriate:

• Individual user accounts, strong authentication and multi-factor authentication.
• Role-based access, least-privilege permissions and periodic access reviews.
• Encryption, secure backups, recovery arrangements and supported software updates.
• Anti-malware protection, automatic screen locking and physical access controls.
• Secure disposal, confidentiality agreements, staff training and audit logging.
• Due diligence, written processor contracts and supplier security checks.

Confidential records must not be stored on unauthorised personal devices, personal email accounts or unapproved cloud services. Lost devices, suspected account compromise and unauthorised access must be reported immediately.

Before sending information, verify recipients, attachments and distribution lists. Use approved channels and appropriate encryption or password protection. Do not forward confidential messages to personal accounts or post identifiable information in informal groups or social media. Telephone disclosures require reasonable verification of identity and authority.

Photographs, video, audio and CCTV must have a lawful purpose, appropriate privacy information, restricted access, secure storage, proportionate retention and controlled disclosure. Permission for publicity does not automatically authorise use for care documentation, training or safeguarding. CCTV must not be installed in areas where people reasonably expect privacy, such as toilets or changing rooms, except under a specifically lawful and exceptional arrangement that has been assessed and authorised.

Remote workers must prevent confidential information being viewed, overheard, lost or accessed by unauthorised people. Paper records must not be left unattended in vehicles or public places. Personal devices may be used for work only where expressly authorised and subject to security controls.

Staff must not enter identifiable service-user, child, employee or safeguarding information into public AI tools or unapproved automated services. Any approved AI use involving personal data must be assessed for lawful basis, confidentiality, security, accuracy, bias and human oversight. New technology and high-risk monitoring must undergo a DPIA where required.

Individuals may have rights to be informed, access, rectification, erasure, restriction, portability, objection, protections concerning certain automated decisions and withdrawal of consent where consent is the lawful basis. Rights are subject to applicable conditions, exemptions and restrictions.

Staff must forward requests promptly to the Data Protection Lead. Requests may be verbal or informal. Verify identity and authority where reasonably necessary. Respond without undue delay and normally within one month. Where legally permitted, an extension of up to two further months may be used for complex or numerous requests; inform the individual within the initial period and explain why.

Access requests require consideration of third-party confidentiality, safeguarding, legal restrictions and applicable exemptions. Erasure is not automatic where retention is required for legal, regulatory, safeguarding or legitimate care-record purposes. Decisions and reasons must be documented.

A DPIA must be completed before processing likely to result in high risk to individuals. Examples may include large-scale health or safeguarding data processing, large-scale systematic monitoring, extensive profiling, new technology affecting privacy, or new arrangements involving sensitive data about children or adults at risk. The assessment must describe processing, assess necessity and proportionality, identify risks and safeguards, and be reviewed by relevant managers and the Data Protection Lead. Where high residual risk remains, assess whether prior ICO consultation is required.

A breach may include sending records to the wrong recipient, losing a device or file, unauthorised access, a cyberattack, disclosure in a messaging group, or accidental publication or alteration of information.

The controller must notify the ICO without undue delay and, where feasible, within 72 hours of awareness where the breach is likely to result in a risk to individuals’ rights and freedoms, unless an applicable exception applies. Reasons for delay must be documented. Where a breach is likely to result in high risk, affected individuals must also be informed without undue delay unless a lawful exception applies. A processor must notify the relevant controller without undue delay under applicable law and contract. All breaches, including those not reported to the ICO, must be recorded.

The Group must maintain an approved retention schedule by record category, reflecting legal, regulatory, contractual, safeguarding and operational requirements. No single retention period applies to all care, children’s, employment, financial and safeguarding records.

Employee and personnel records

Blisscare Group retains employee personnel and employment records for three (3) years after the employee leaves their job role/employment ends. Access must be restricted to authorised personnel and the records must be securely destroyed or irreversibly anonymised at the end of this period, unless a documented legal, regulatory, safeguarding, litigation, investigation or other lawful requirement justifies longer retention. Any extension must be recorded, proportionate and reviewed periodically.

Information must not be retained indefinitely without justification. At the end of the applicable period, records must be securely destroyed or irreversibly anonymised unless a lawful preservation requirement applies. Litigation, investigations and safeguarding matters may require a documented hold. Paper records must use approved confidential-waste disposal; electronic records must be securely deleted where practicable.

Sponsored worker records — Home Office sponsor duties

Retain required sponsorship records throughout the sponsorship period and for at least one year after sponsorship ends, unless a Home Office compliance officer has examined and approved the records sooner. Blisscare Group’s policy is to retain employee and personnel records for three (3) years after the employee leaves their job role/employment ends; therefore, relevant sponsored-worker employment records should follow that three-year period, unless a longer legal or regulatory requirement applies. Documents submitted with the sponsor licence application must be kept for as long as the organisation holds the sponsor licence. Keep required records accessible in paper or electronic form for inspection, and check the current Home Office sponsor guidance and Appendix D before disposal.

Personal data must not be transferred outside the UK without prior assessment and authorisation. The relevant entity must determine whether the transfer is restricted and establish an appropriate legal mechanism, such as applicable adequacy regulations or approved safeguards, including any required transfer risk assessment and supplementary measures.

Data protection complaints must be recorded, investigated impartially and answered within the applicable timeframe. Individuals must be told about relevant outcomes, corrective action and their right to complain to the ICO. No person may suffer retaliation for raising a genuine concern.

Staff must complete induction and periodic refresher training. Role-specific training must be provided to people handling sensitive records, rights requests, safeguarding information, IT systems or breaches. The Group must audit access, notices, lawful bases, retention, breaches, training, processor contracts and DPIAs. Findings must have owners and completion dates.

Non-compliance may lead to supervision, retraining, access restrictions, disciplinary action or termination of engagement, depending on circumstances. Serious conduct may also have civil, regulatory or criminal consequences.

This policy is designated as an approved organisational policy for adoption by the relevant Blisscare Group entity, subject to the entity’s governance arrangements. Dr Justice Ujoumunna is the designated Data Protection Lead and Registered Manager. The Group must ensure each legal entity adopting this policy maintains accurate controller details, privacy notices, retention arrangements and regulatory records.

Approved by

Dr Justice Ujoumunna

Position

Registered Manager / Data Protection Lead — Blisscare Group

Approval record

17/10/2022 (enter/sign the original approval record where required by governance procedures)

First prepared / approval record date

17/10/2022

Next review date

17 October 2027 (annual review thereafter)

Before accessing information

Check you are authorised and need it for your role.

Before sharing

Verify the recipient, purpose, lawful justification and amount of information.

Before emailing

Check the address, attachments and all recipients.

When recording care

Be accurate, factual, professional and timely.

When safeguarding arises

Follow the safeguarding procedure and share necessary information lawfully.

When a breach occurs

Report immediately; do not wait to decide whether it is serious.

When a person requests records

Refer the request promptly to the Data Protection Lead.

When using AI

Never enter identifiable or confidential data into an unapproved tool.

When unsure

Protect the information and seek advice from your manager or Data Protection Lead.

• Date/time discovered
• Person reporting and service/department
• Relevant legal entity
• Description of incident and date/time occurred
• Types of information affected
• Number/categories of individuals affected
• Whether children or adults at risk are affected
• Whether health, safeguarding, financial or criminal-offence data is involved
• Recipient / unauthorised person, if known
• Immediate containment action
• Systems, records or devices involved
• Potential impact on individuals
• Manager and Data Protection Lead notified (date/time)
• ICO notification assessment and decision
• Decision on informing affected individuals
• Other regulatory or contractual notifications
• Corrective action and lessons learned
• Authorised reviewer and closure date

• Reference number
• Date received
• Requester and relevant legal entity
• Type of request
• Identity / authority verification
• Response deadline
• Systems and departments searched
• Third-party or safeguarding considerations
• Decision and reasons
• Response date
• Extension or exemption relied upon
• Complaint / appeal details
• Closure date

• ICO — Guide to data protectionhttps://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/
• ICO — Special category datahttps://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/
• ICO — Personal data breach reportinghttps://ico.org.uk/pdb
• Data Protection Act 2018https://www.legislation.gov.uk/ukpga/2018/12/contents

CONTROLLED POLICY NOTE: This document records version 0.5, first prepared 17/10/2022, with an annual review cycle and next review due 17/10/2027. Dr Justice Ujoumunna is the designated Data Protection Lead. Confirm that the legal identity of each adopting controller and its ICO registration details remain accurate, and review applicable guidance at each annual review.