CuraFlow DC-G04CQCSection G · Information Governance and Records
Subject Access Requests policy
For CQC-registered domiciliary care services · version 1.0 · last reviewed 1 June 2026
Anyone whose personal data you hold can ask for a copy of it. This walks through recognising and logging a subject access request, verifying identity, the one-month timescale with its extensions and the Data (Use and Access) Act stop-the-clock provision, redacting third-party information, exemptions, and responding to the person.
What this policy covers
- What a subject access request is and who can make one
- Recognising and logging a request
- Verifying identity
- Timescales — one month, extensions and the duaa ‘stop the clock’
- Finding and compiling the information
- Third-party information and redaction
- Exemptions and refusing a request
- Responding to the person
- Requests by representatives or for people who lack capacity
- Data protection / caldicott lead
- Annex a — subject access request — step-by-step procedure
- Annex b — subject access request log and tracker
Regulations and guidance it supports
Supports the fundamental standards at Regulations 17 and 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014.
- Data Protection Act 2018
- Data (Use and Access) Act 2025
Common questions
- Is the subject access requests policy CQC-aligned?
- Yes. It is written and reviewed by practising UK compliance consultants against current CQC expectations, and supports the fundamental standards at Regulations 17 and 20. It is a controlled starting-point document that you adapt to your own service — you remain the accountable provider.
- Can I download and edit this policy?
- Yes. It downloads as Word (.docx) or PDF with your company name, registered manager, CQC ID and address already filled in on the cover page and throughout the document. The Word version is fully editable.
- Can I buy this policy on its own?
- Policies are sold as a complete library rather than individually, because CQC expects a coherent set that cross-references properly — a single policy in isolation creates gaps. The domiciliary care library contains 141 policies and can be bought outright as a one-off purchase and kept permanently.
- How often is it reviewed?
- The library is re-reviewed every six months and after any material regulatory change. This policy was last reviewed 1 June 2026, and is at version 1.0. Updates reach you automatically, so downloads always reflect the current version.