Sample policy · GP

Patient data and information governance policy (gp)

1. Purpose

This policy sets out how the Practice governs patient data, record access, Caldicott decision-making, data-breach response, subject access requests and learning from information-governance incidents.

It reflects the higher risk in primary care because GP records contain dense longitudinal clinical and personal information.

2. Sources to verify before adoption

3. Scope

This policy applies to:

It applies to all staff, GP partners, locums, contractors, trainees and suppliers who handle patient data for the Practice.

4. Lawful basis and Caldicott process

The Practice keeps a lawful-basis record for each main category of patient-data processing.

4.1 Lawful basis register

The lawful-basis register records:

The Practice verifies each entry against current UK GDPR, Data Protection Act 2018 and ICO source material before adoption.

4.2 Caldicott Guardian role

The Practice identifies the person or role responsible for Caldicott decisions.

The Caldicott Guardian or equivalent senior information-governance lead:

The Practice verifies whether a formal Caldicott Guardian appointment is required for its service type and contract position.

4.3 Access to records

Staff access patient records only where there is a work-related reason.

The Practice:

Staff do not access their own record, family records or records of people they know unless there is a clear and recorded work reason approved by the Practice.

5. Data-breach decision tree

The Practice records every suspected personal data breach and assesses it promptly.

The decision tree covers:

For ICO notification, the Practice checks the current ICO wording. The exact ICO phrase "within 72 hours" is load-bearing and must not be restated from memory without checking the source.

6. Email, subject access and patient communication

The Practice treats misdirected email or message incidents as potential data breaches.

Staff:

The Practice handles subject access requests through the current ICO and local Practice process. Staff log the request, verify identity, check exemptions or third-party information where relevant and record the response decision.

The Practice does not use this policy to restate statutory response deadlines. Staff check the current ICO source before recording a deadline.

7. Responsibilities

8. Recording requirements

The Practice keeps the following records:

Records are kept securely and access is limited to staff who need them for care, governance or legal compliance.

9. Audit cadence

The Practice uses the following Verivius default audit rhythm unless current source material requires more frequent review:

Audit findings are recorded as improvement actions with an owner and review date.

10. Version control and review date

The Practice keeps a controlled copy of this policy. The footer or document-control table records:

11. Related records

Review cadence: annual or on regulatory change, whichever sooner. Owner: Registered Manager.

Related Verivius content

Want help adapting this to your service?

A Verivius consultant can read your adapted policy against the live regulation and your service shape. The work fits inside a Mock Inspection engagement or a shorter consulting brief. A 20-minute conversation is the fastest way to find out whether the fit is right.

Book a 20-minute design-partner conversation

50% off for 12 months. Mock Inspection at the design-partner rate.

Last reviewed 21 May 2026