Retention and Disposal Schedule

Transcription

1 Retention and Disposal Schedule Date this version was published: 25 May 2018 Next review date: 25 May 2019

2 Introduction CQC keeps to meet current and future business needs and comply with statutory, legal and corporate governance practice requirements. By maintaining a retention and disposal schedule we can ensure that the of is documented, understood and implemented. The Retention and Disposal Schedule is a list of the business held by CQC, including examples, and the period at which each type of record will be reviewed for destruction. It should be noted that the Schedule focuses on managing content and not the format in which the record is held, for example, how long we keep an will be dictated by its content rather than the fact it is an . The Schedule is divided into 19 series', plus a list of that are common to all areas. The Schedule is reviewed annually as part of CQC's information asset review. Under the General Protection Regulation (GDPR) we must keep of our of personal data and special category personal data. The Schedule forms part of these. Using the Retention and Disposal Schedule The Retention and Disposal Schedule contains ten pieces of information about each record type: Records series- identifies the business function that the relate to. Number- is the unique identifier for the record or group of held. Title- summaries the name of the record or group of. Examples- provides an indicator of the types of included, where applicable (although it is not an exhaustive list) Retention is the period of time at which the will be reviewed and either be destroyed or the retention period extended. An extension to the normal retention period may be required when enforcement, an Inquiry or other relevant activity is in progress. Where an Inquiry (including public Inquiries) is taking place CQC may be required to suspend the destruction of some or all of the held. Confidential - this identifies whether the were obtained by the Commission on terms or in circumstances requiring it to be held in confidence. and that: relates to and identifies an individual. As defined in the Health and Social Care Act 2008 The following information relates to the requirements of the General Protection Regulation (GDPR). Full details of the requirements under the Regulations can be found at: the Commissioner's website data identifies whether the include information that can identify a living individual. Examples of : Names, addresses, personal s, bank details, contact information, personnel files personal data identifies the purposes for which CQC collects, holds, uses and stores personal information category personal data - identifies whether the include specific types of information, Examples include racial or ethnic origin, political opinions, religious beliefs, trade union membership, sexual and criminal offences. special category personal data identifies the purposes for which CQC collects, holds, uses and stores special personal information Glossary of terms ASC - Adult Social Care CEO - Chief Executive Officer CRM - Customer Relationship (System) EDHR - Equality, Diversity & Human Rights IRMER - Ionising Radiation Medical Exposure Regulations KLOE - Key Line of Enquiry MHA - Mental Health Act PMS - Primary Medical Services SOAD- Second Opinion Appointed Doctor SpA - ist Advisor

3 Record series Common, relations Contents Coverage and examples Assets common to all directorates Minutes, policy, expenses etc. Employee data, including sickness absence, training, DBS checks, disciplinary proceedings, personal performance monitoring, medical and workplace, recruitment processes, Pay roll, Negotiations with Unions, staff surveys, briefings, newsletters, etc. Budget setting and monitoring, monthly reports to committees, invoices, bank statements, payroll, pensions etc Procurement Tendering, contracting and purchasing etc. PAT testing, building, Health & Safety risk assessments, waste etc. Business plans, strategies, performance monitoring, Business continuity plans, Projects, risk, Internal Audit etc Governance Private office correspondence, MP questions, Statutory Committee meetings, secretariat, complaints, etc. contact Recordings of telephone conversations at NCSC, general enquiries, incoming scanned mail, statistics, etc Publications and Press releases, public consultation, stakeholder communications, etc. engagement 009. ICT Systems documentation, etc and Intelligence reporting Intelligent monitoring reports, used to create intelligence reports, notifications, etc. Retention schedule, Governance and Security, etc Legal Legal files and advice Provider & Monitoring and financial details of specific Adult Social Care providers, etc. Market Register of providers and supporting documents, etc. gathered and written during an inspection to inform a judgement, Inspector notes, evidence gathered from providers, etc Policy and Provider handbooks, Inspection guidance, Key Line of Enquiry, etc Enforcement Notices, review meetings, etc Healthwatch England Assets unique to HWE- see website 019. National Guardian's Office Assets unique to NGO- for other assets, e.g. employee, finance see relevant series.

4 Common retention C.01 Staff contact details People finder, base of staff name, office address and photograph. Whilst employed by CQC None identified Contract or Consent No Not applicable Common retention C.02 Staffing structures Organisation charts Whilst relevant None identified, where names included Common retention C.03 Internal performance monitoring information, measurements scorecard. 2 years None identified Official Authority No Not applicable Common retention C.04 Team meetings Minutes, agendas 2 years None identified Common retention C.05 Team strategy Final Retain permanently Common retention C.06 Draft team strategy Draft, or development 6 months Common retention C.07 Blank- no asset assigned Common retention C.08 Policy Internal policy Retain permanently Common retention C.09 External meetings Agendas, minutes, papers, plan 2 years None identified Contract or Official Authority Not routinely Not applicable Common retention C.10 Staff Performance Staff performance information and annual personal development reviews and reports Retain whilst employed. Plus 2 years Contract Employment rights and Assessment of working capacity None identified Common retention C.11 Staff annual leave 2 years after action completed Common retention C.12 Internal Query log Internal team queries and responses provided to CQC 3 years None identified Public interest task No Not applicable staff Common retention C.13 External Query log External team queries and responses provided e.g. to member of public, providers etc.. Common retention C.14 Directorate, team away days- Internal Minutes, Internal presentation Retain whilst useful None identified internal Common retention C.15 Expenses Receipts, expense claim forms 3 years after end of financial year Common retention C.16 Notes and or recordings taken at Notes and or recordings taken at meetings that will be Destroy once official (in some Various - depends depending Various - depends on meetings used to create an official record electronic (Usually Word) cases) on purpose of on content purpose of meeting version is agreed meeting Common retention C.17 Guidance Process and guidance to support policy 1 year after superseded Common retention C.18 Questionnaires Non statutory surveys and feedback, e.g. Internal Destroy once analysis is (in some Consent No Not applicable survey complete cases) Common retention C.19 Questionnaires analysis Non statutory surveys and feedback, e.g. Internal Retain until report completed survey Common retention C.20 Standard operating procedures including process maps Retain permanently (all versions) Common retention C.21 Internal audit reports and working 5 years papers 1.1 Staff absence Absence Fit note, Sickness and Maternity absence, Retain whilst employed plus Contract Employment Rights, relations etc.. 7 years 1.2 Medical/Self certificates Medical/Self Certificates unrelated to industrial injury 4 years Contract Employment Rights, relations, relations, relations, relations, relations 1.3 Staff annual leave 2 years after action completed 1.4 Disclosure and Barring service checks (DBS) 1.5 Employment /Employee file / P file Recruitment (successful candidate),termination of employment, retirement. 1.6 Disciplinary Records Disciplinary, letters, evidence, capability, first and final warning Retain whilst employed plus 7 years Retain whilst employed plus 7 years No Contract Not applicable Not applicable Contract Employment Rights Contract Employment Rights 2 years after warning expires Contract Employment Rights

5 , relations, relations, relations 1.7 Disclosure/conflict of interest forms, 1.8 Pension estimates Requests from employees & other departments and the information provided 1.9 Pension scheme financial transactions (Local Government Pension Scheme only) Paperwork required to inform non-nhs pension providers of pension details 2 years Contract Employment Rights 1 year Contract Employment Rights 7 years Contract Employment Rights, relations, relations, relations, relations, relations, relations, relations, relations, relations, relations, relations, relations, relations, relations, relations 1.10 ESR - Electronic Staff Record, data for reporting Diversity data, age, ethnicity, gender, sexual orientation, name Staff Performance Staff performance information and annual personal development reviews and reports Retain permanently Contract Employment Rights Retain whilst employed + 2 years 1.12 Staff training and development All Training courses attended Retain whilst employed + 2 years 1.13 Individual Business case for attending Training & meetings to agree/reject Retain for length of training plus + 1 year Contract Employment Rights. & Assessment of working capacity 1.14 Training course content Content and material After course is superseded None identified Contract Employment Rights 1.15 Event planning Organisation and planning of the leadership team, group events and training Employee Recognition awards. Employee/team recognition awards Duration of scheme plus 2 years 1.17 Employee Recognition awards, statistics. 3 years after event None identified Public interest task No Not applicable None identified where it identifies a member of staff Statistics regarding number of awards given etc.. Retain permanently None identified where it identifies a member of staff Contract Contract where it identifies a member of staff where it identifies a member of staff Employment Rights Employment Rights 1.18 Surveys - staff. Retain permanently Anonymised Contract Employment Rights 1.19 Health & safety accident reporting MOVED to 004 land & property 1.20 Stress risk assessment, enabling plans & reasonable adjustments 1.21 Work station/driving at work training and risk assessments MOVED to 004 land & property MOVED to 004 land & property 1.22 ist advisors, SPAs, Please see 1.5 for details 1.23 Payroll data reports on monthly basis 7 years after action completed Recruitment (unsuccessful) Applications, assessment, feedback. 2 years after recruitment finalised Contract, Employment Rights Contract Employment Rights

6 , relations, relations, relations, relations, relations, relations, relations 1.25 Recruitment Process Adverts 2 years after recruitment finalised 1.26 Industrial relations- major Agreements, awards, negotiations, disputes Retain permanently None identified Contract Employment Rights 1.27 Industrial relations- minor Routine and daily industrial relations, Regular Committee meeting, minutes, agendas & actions 2 years after administrative use is concluded 1.28 Diversity reports Anonymised reporting on staff diversity MI Retain permanently anonymised No Not applicable No Not applicable 1.29 Warrant cards Inspectors joiners, role change and leavers process Destroyed at end of role as Inspector 1.30 Pension guidance provided by external pension providers None identified Official Authority No Not applicable Procedures relevant provider and legislation Retain permanently 1.31 Occupational Health Staff Occupational Health Reports 7 years Contract Working Capacity 2.1 Payroll Payroll data 7 years for original documentation, 2 years for copy for analysis 2.2 Budget Budget data - Monthly budgets, forecasts, estimates and plans. 3 years from finance year end - where it relates to salary information - where it relates to salary information 2.3 Budget Budget data - Negotiating on budgets- DELETED - covered elsewhere (2.2) 2.4 Tax Value Added Tax (VAT) Returns - VAT and 7 years No No Not applicable No Not applicable returns 2.5 Bank Bank statements 7 years No No Not applicable No Not applicable 2.6 Bank Company credit card transactions - Payment, statements and receipts 7 years No No Not applicable No Not applicable 2.7 Accounts Financial accounts -Working papers for the production 7 years Salary of the financial accounts. details 2.8 Accounts Financial external audit - External Audit reports Retain permanently Salary accounts/procedures details 2.9 Accounts Financial reports - Working papers for the production of Retain permanently Salary the reports to budget holders details 2.10 Accounts Annual accounts - Final Retain permanently Disclosure Legal obligation No Not applicable notes on remuneratio n and pensions for Board and ET 2.11 Cash Books Accounts minor - Pass books, paying in slips, cheques, 2 years from completion of No No Not applicable No Not applicable counterfoils, cancelled/discharged cheques, travelling audit 2.12 Expenditure Bills receipts and cleared cheques 7 years from financial year end 2.13 Fixed Assets Asset Register and Related Workings 7 years from financial year end No No Not applicable No Not applicable No No Not applicable No Not applicable

7 2.14 Cash Books Petty cash returns and supporting vouchers - accounts 2 years from end of financial of petty cash expenditure year 2.15 Cash Books Cash books and sheets 7 years Salary details 2.16 Expenditure Creditor payments 7 years following end of year to which they relate No No Not applicable No Not applicable No No Not applicable No Not applicable 2.17 Supplier New supplier form, supplier bank details 2 years 2.18 Debtors' Debtors' 7 years from financial year end but maintained until cleared Official Authority No Not applicable 2.19 Tax Tax forms 7 years. Retained for Legal obligation No Not applicable which rationale in business terms provided destroy at 15 years Expenditure Cost control ledger analysis 7 years No No Not applicable No Not applicable 2.21 Expenditure Invoices - Capital, revenue, rate and rent invoices and supporting estimates. 7 years No No Not applicable No Not applicable 2.22 Expenditure Estimates - including supporting calculations and Deleted 2017/18 statistics - DELETED -Covered elsewhere 2.23 Payroll Expenses claims and scanned receipts 3 years 2.24 Income Funding data 7 years No No Not applicable No Not applicable 2.25 Ledger Ledgers 7 years Salary details 2.26 Audit Audit reports, Value for Money reports 2 years No No Not applicable No Not applicable 2.27 Audit Audit - Original documents 2 years No No Not applicable No Not applicable 2.28 Ledger General ledger Inc. Accounting Structure, Profit/Cost Centres, Budgets, Accounting Entries Retain permanently Salary details 2.29 Procurement Purchase orders - Supporting documentation 2 years following completion No No Not applicable No Not applicable of relate contract 2.30 Bank Company & procurement cards 2 years from end of financial year No No Not applicable No Not applicable 2.31 Ledger Reconciliations -Ledger, Bank and expenses 7 years No No Not applicable No Not applicable reconciliation 2.32 Income Provider fees payments and refunds Retain permanently Legal obligation No Not applicable 2.33 Supplier DELETED Covered by Procurement Supplier Supplier payments Retain permanently 2.35 Project Records Project that pick up associated finances -E.g., 7 years No No Not applicable No Not applicable Finance, Procurement contracts, 2.36 Payroll SOAD Payments Retain permanently 2.37 Costing Costing information of CQC's regulatory activity 5 years No No Not applicable No Not applicable 2.38 Payroll Hard copy expense receipts that have been scanned and stored in line with Travel & Expense policy (Dec 2016). Retain hard copy until payment is received. Salary and expenses paid details

8 003. Procurement 3.1 Signed contract Under Seal- 12 years from expiration of agreement 003. Procurement 3.2 Signed contract - Standard - 6 years after date of expiration of contract 003. Procurement 3.3 Initial Proposal Expression of Interest - from date of award of contract 003. Procurement 3.4 Initial Proposal Draft Specification - - from date of award of contract 003. Procurement 3.5 Initial Proposal Agreed Specification 003. Procurement 3.6 Initial Proposal Evaluation Criteria - - from date of award of contract 003. Procurement 3.7 Initial Proposal Invitation to Tender 003. Procurement 3.8 Tendering Unsuccessful tender documents - from date of award of contract 003. Procurement 3.9 Tendering Successful tender documents 003. Procurement 3.10 Tendering Interview panel - report and notes of proceedings -- from date of award of contract 003. Procurement 3.11 Tendering Contract Award Letter - - from date of award of contract 12 years from expiration of agreement 6 years after date of expiration of contract 3 years from date of award of contract 3 years from date of award of contract, where, where, where, where 6 years, where 6 years from date of award of contract, where 6 years, where 3 years from date of award of contract, where 6 years, where 3 years from date of award of contract 3 years from date of award of contract, where, where 003. Procurement 3.12 Tendering Signed contract (hardcopy) 6 years from end of contract, where 003. Procurement 3.13 Contract Operation and Monitoring (MI from contractors) from date of expiration of contract 6 years from date of expiration of contract None identified, where

9 003. Procurement 3.14 Contract Operation and Monitoring (Schedules of Works) from date of expiration of contract 003. Procurement 3.15 Contract Operation and Monitoring (Surveys and inspection equipment and supplies) from date of expiration of contract 6 years from date of expiration of contract 6 years from date of last paper, where, where 003. Procurement 3.16 Second review Contract Operation and Monitoring (Surveys and inspection buildings) from date of expiration of contract Second Review, where 003. Procurement 3.17 Contract Operation and Monitoring (Records and Complaints) from date of expiration of contract 003. Procurement 3.18 Contract Operation and Monitoring (Disputes and Overpayment) from date of expiration of contract 003. Procurement 3.19 Contract Operation and Monitoring (Final Accounts) from date of expiration of contract 6 years from date of expiration of contract 6 years from date of expiration of contract, where, where 6 years from end of contract None identified, where 003. Procurement 3.20 Contract operation and monitoring Second review None identified, where 003. Procurement 3.21 Amendments to Contracts (Changes to Requirements) after date of expiration of contract (note 12 years if a deed (executed under seal)) 003. Procurement 3.22 Amendments to Contracts (Forms of Variation - CCNs, VEATS) after date of expiration of contract (note this will be 12 years if a deed) 6 years or 12 if deed, where 6 years or 12 if deed, where 003. Procurement 3.23 Amendments to Contracts (Extensions to contract) - from new expiry date of contract (note this will be 12 years if it is a deed) 6 years or 12 if deed, where 003. Procurement 3.24 Approved supplier lists 11 years, where 003. Procurement 3.25 Process of agreeing terms between organisations. NB this does not include contractual agreements Concordat 6 years after agreement expires or is terminated None identified, where

10 003. Procurement 3.26 Supplier Supplier contact details - Vendor Details ( moved from Finance 2.33) 003. Procurement 3.27 Evaluation In accordance with Regulation 84 (7)(8) and (9) Public Contracts Regulations 2015 Retain permanently, where 4 years, where 4.1 Occupancy Seating & floor plans, Retain until superseded 4.2 Asset inventory and status Register of property and equipment owned 2 years after administrative use is concluded 4.3 Plant, asset & equipment & Equipment inspection reports Service, plant files. e.g. boilers, lifts ex PAT testing Lifetime of building, pass originals to new building owner. Keep copy for 3 years 4.4 Building and engineering work Surveys, site plans, bills of quantities, Lifetime of building, pass originals to new building owner. Keep copy for 3 years 4.5 Unsuccessful proposals for Projects abandoned due to lack of funds/approval, Disposed of when closed buildings and engineering work and related correspondence 4.6 Waste Delivery, recycling and consignment notes, 1 years (incl food waste) sustainability 4.7 Deliveries Delivery notes for goods received, recorded delivery mail. 4.8 Risk assessments Fire & general risk assessments, Buildings, Health & Safety. 4.9 Electrical Appliance Equipment testing 1 year following the end of the financial year they relate to Lifetime of building, pass originals to new building owner. Keep copy for 3 years Lifetime of building, pass originals to new building owner. Keep copy for 3 years 4.10 Property reports Annual building reports, Lifetime of building 4.11 Property acquisition (financial lease or purchase) Lifetime of property or building plus 12 years 4.12 Property disposal s (sale or write off) Legal correspondence the sale, particulars of sale, Board of survey 15 years after all obligations/ entitlements concluded 4.13 Property deeds Lifetime of occupancy plus 1 year 4.14 Asbestos testing - responsibility of building owner retain for 20 year period following exit of building. HSE duty to manage asbestos

11 4.15 Business continuity and recovery Emergency Plans Retain permanently Consent No Not applicable 4.16 Business continuity testing Report on business continuity and recovery plan testing Retain permanently 4.17 Health & Safety Accident Reporting Stress risk assessment, enabling plans & reasonable adjustments Staff accident, near miss and incident summaries. Retain permanently Legal obligation Employment rights of the CQC or an employee Retain permanently Legal obligation Employment rights of the CQC or an employee 4.19 Work station/driving at work training and risk assessments Individual training and risk assessments completed Retain whilst employed plus 7 years Legal obligation Employment rights of the CQC or an employee 4.20 Car Parking allocation Records vehicles allocated parking bays Retain for duration of allocated parking slot Public interest task Employment rights of employee 4.21 Inspector risk assessment Retain assessment whilst employed plus 7 years should remain in master system, not Cygnum Legal obligation No Not applicable 5.1 Corporate plans e.g. business plans Retain permanently None identified Official Authority & Public interest task(pay) No Not applicable 5.2 Directorate plans Retain permanently None identified Official Authority No Not applicable 5.3 Corporate risk register Strategic risk register and directorate risk registers Retain as published (strategic) retain 2 years (directorate) None identified Official Authority No Not applicable 5.4 used to support creation of 2 years after publication None identified Official Authority No Not applicable plans 5.5 Internal Audit reports Moved to Common Assets series 5.6 Internal Audit working papers Moved to Common Assets series 5.7 Internal quality assurance Internal performance monitoring and quality assurance information, measurements scorecard, assurance frameworks 2 years None identified Official Authority No Not applicable 5.8 Project - Outputs Future decisions and knowledge, lessons learnt, Functional designs, User requirements, user stories 2 years from completion of project (is 5 years in ICT) None identified Official Authority No Not applicable 5.9 Project - delivery Project initiation, feasibility studies, risks, project and communications plans resource, day to day activities 2 years from completion of project (is 5 years in ICT) None identified Official Authority No Not applicable 5.10 Project working papers- minutes, agendas, etc.. Draft reports and correspondence 2 years from completion of project None identified Official Authority No Not applicable 5.11 Provider risk register 2 years None identified Official Authority Health or Social Care Treatment, Ensure higher standards of, Establishment, exercise or defence of legal claims 5.12 Provider risk- monthly reports Monthly risk meetings 2 years None identified Official Authority Health or Social Care Treatment, Ensure higher standards of, Establishment, exercise or defence of legal claims

12 5.13 Statistics on queries and responses to external/members of public 5 years None identified Legal obligation No Not applicable 5.14 Inspector workload monitoring Timesheets, activity recording, scheduling 5 years Official Authority No Not applicable 006. Governance 6.1 Memorandum of Understanding Agreements with other organisations on working (MOU) together Governance 6.2 Transition Transition information - communication, 2 years following creation of new organisation/ restructure Retain permanently None identified Official authority No Not applicable 006. Governance 6.3 Staff events & away days- internal Internal Minutes, Internal presentation Retain permanently None identified Official authority No Not applicable 006. Governance 6.4 Briefings to the board For meetings on issues, breaking news, informing in Retain permanently None identified Official authority No Not applicable advance, and visits 006. Governance 6.5 Speeches and presentations at Notes and PowerPoint presentation, Conference Retain. Whilst CEO and conferences organisation & speaking events. Chair in post + 1 year 006. Governance 6.6 Chair & Executive letters 7 year (3 month for hard None identified Official authority No Not applicable copy) 006. Governance 6.7 Private Office Correspondence Record/log of the correspondence Retain permanently None identified Official authority No Not applicable base 006. Governance 6.8 Annual archive of Private Office Archive of the record/log of the correspondence 8 years None identified Official authority No Not applicable Correspondence base 006. Governance 6.9 Administration for Visits by Chair visits to services and 2 years None identified Official authority No Not applicable & CEO organisation, schedule, agenda of meetings, arrangements 006. Governance 6.10 Nominations for honours Correspondence from Department of Health, Citations, nominations 2 years None identified Public interest task No Not applicable 006. Governance 6.11 Contact details for Chair and CEO Contact details for Chair and CEO Retain permanently None identified Official authority No Not applicable 006. Governance 6.12 Healthwatch service level Governance documentation Life of Healthwatch None identified Official authority No Not applicable agreements and governance framework 006. Governance 6.13 Committee and Authority Audit/private Board, governance structure, operating Retain permanently None identified Official authority No Not applicable submissions committee, regulation etc Governance 6.14 Public Board papers Retain permanently None identified Official authority No Not applicable 006. Governance 6.15 Executive team meetings Agendas, minutes, papers, forward plan Retain permanently None identified Official authority No Not applicable 006. Governance 6.16 Complaints related information Corporate and Ombudsman cases, general correspondence 3 years (until resolution plus time for leave to appeal if appropriate) CPI Official authority No Not applicable Retain permanently CPI Official authority Health Care Standards 006. Governance 6.17 Complaints final response Review letters (summary of complaint and CQC's response) 006. Governance 6.18 Complaints statistics Number of complaints 5 years 006. Governance 6.19 Complaints full case record 5 years after last activity CPI Official authority Health Care Standards 006. Governance 6.20 Queries Responses to queries passed to the complaint team 3 years CPI Official authority Health Care Standards 006. Governance 6.21 Final case report and supporting evidence 6 months after final outcome letter issued unless there is an appeal Governance 6.22 External reviewers report 6 months after final outcome letter issued unless there is an appeal Governance 6.23 Submission and outcome Ratings review submission from provider and our Master record to be stored outcome letter with related 006. Governance 6.24 Feedback for lessons learnt (links to 6.23) 6 months after final outcome letter issued unless there is an appeal. Depending on the case can contain CPI Official authority Health Care Standards None identified Official authority Health Care Standards None identified Official authority Health Care Standards None identified Official authority Health Care Standards

13 7.1 Corporate Complaints Moved- see series 6 incorporated into assets 7.2 Corporate Complaints statistics Moved- see series 6 incorporated into assets 7.3 Request for General enquiries from public and others. 6 months Depending on the enquiry can contain CPI 7.4 Hard copy scanned material (excluding registration and criminal evidence) 7.5 Hard copy scanned materialregistration 7.6 of concern - Photographs/ images 7.7 of concern - Complaint, safeguarding For registration see 7.5 and for Criminal evidence see Enforcement IAR 2 months to allow for quality assurance checks Official authority No Not applicable Official authority Ensuring high standard of 3 months to allow for quality assurance checks Official authority No Not applicable 1 week after scan Official authority Ensuring high standard of DELETED - reference was to a tool rather than an asset 7.8 Performance information Reports, 2 years 7.9 Dashboards Reports - e.g., registration activity, numbers of notification 7.10 Quality and Performance Staff performance against quality standards and tools workload 7.11 Share your experience Service users, patients and public comments on of concern services, On going live data 2 years Store with related for same time period Official authority (dependant on subject matter raised) Ensuring high standard of 7.12 Staffing trackers - another common tool used by teams. DELETED - covered in Common assets C Telephone recordings - going 6 months Official authority Ensuring high standard of external 7.14 Telephone recordings ( incoming 6 months Official authority Ensuring high standard of in to 0300) 7.15 security breaches 1 year No No Not applicable No Not applicable 7.16 Hard copy scanned material (civil enforcement) 3 months to allow for quality assurance checks - followed by checks with legal Official authority Ensuring high standard of 7.17 Hard copy scanned material (criminal enforcement) 6 months to allow for quality assurance checks - followed by checks with legal Official authority Ensuring high standard of 008. Publications 008. Publications 008. Publications 008. Publications 008. Publications 7.18 Post logs e.g. VIP post logs 1 year Official authority Ensuring high standard of 7.19 Training recordings specific to 6 months redacted Official authority Ensuring high standard of NCSC coaching 8.1 Engagement activity reports Evaluation reports, information on tweets, web visits 1 year None identified Public interest task No Not applicable etc. Press cuttings 8.2 Image library Collection of photos Retain as long as image has CPI Not Not applicable Not applicable Not applicable purpose applicable 8.3 Model release forms Completed model release forms for 3rd party events Retain as long as image has None identified Public interest task Not applicable Not applicable purpose 8.4 Share your experience Retention period will depend None identified Official authority No Not applicable on content 8.5 Media and journalist contact lists Press release administration Retain until superseded None identified Public interest task No Not applicable and stakeholder lists

14 008. Publications 8.6 Incident reports for media responses provided by inspectors 3 years None identified Public interest task No Not applicable 008. Publications 8.7 Press Release- drafts 6 months after release None identified Public interest task No Not applicable 008. Publications 8.8 Press Release - final Retain permanently None identified Public interest task No Not applicable 008. Publications 8.9 User and public involvement Correspondence, minutes, agendas. Including listening 2 years None identified Public interest task No Not applicable administration documentation events 008. Publications 8.10 Public and user consultation, e.g. Papers minutes, documents, 2 years from close of None identified Public interest task No Not applicable Market research. consultation 008. Publications 8.11 Working papers, evidence used 1 year None identified Public interest task No Not applicable towards reports 008. Publications 8.12 Publications (e.g. Annual reports State of, Annual report, Inspection reports Retain permanently None identified Official authority No Not applicable and Inspection reports) 008. Publications 8.13 Website testing- usability reports 1 year following go live from external provider 008. Publications 8.14 Digital signatures Collection of signatures Retain whilst employed None identified Public interest task No Not applicable 008. Publications 8.15 Intranet news 1 year None identified Public interest task No Not applicable 008. Publications 8.16 Social Media As per related None identified Public interest task No Not applicable 008. Publications 8.17 Public and user consultation, e.g. Outcome of the public consultation Retain permanently None identified Public interest task No Not applicable Market research ICT 9.1 IT asset register Records of License & keys, Inventory of hardware, Retain permanently None identified 009. ICT 9.2 System documentation Manuals guides, build documentation, configuration 3 years after None identified documents decommissioning 009. ICT 9.3 Specific correspondence relating to provision of service/contract Deleted - covered in series 3 Procurement assets Not applicable 009. ICT 9.4 Correspondence re internal 5 years None identified Projects 009. ICT 9.5 IT disaster recovery plan Plans for recovery of IT systems Retain until superseded None identified 009. ICT 9.6 Performance information Feedback on systems, monthly information from Deleted after analysis providers 009. ICT 9.7 System changes -enhancements Updated frequently None identified Project 009. ICT 9.8 Helpdesk calls - provider record Log of helpdesk calls Retain permanently None identified 009. ICT 9.9 System & user acceptance testing Process and results- Projects 5 years None identified 009. ICT 9.10 Integration, penetration and performance testing End of service /decommission plus 2 years None identified 009. ICT 9.11 Home Worker Print and Broadband log ICT 9.12 Architecture Catalogues, Matrices and Diagrams 010. and 10.1 source and Indicator Lists - Thematic reviews Diagrams and descriptions of CQC s technical components and processes. Retain whilst employed None identified Retain permanently 3 years 010. and 10.2 Risk Profiling & Scoring and sample selection- Thematic Review 3 years

15 010. and 010. and 10.3 Agreed sample selection for Thematic Reviews (not including profiles or scores) 10.4 profiles Thematic Used for Inspection field work. Specific to theme, e.g. Diabetes, of end of life. Agreed by the board. Published on the website. Retain permanently 3 years from publication of national reports 010. and 10.5 Qualitative Analysis Report for Independent Voice project Secondary analysis of qualitative data, 3 years from publication of national reports 010. and 10.6 Qualitative development reports' Analytical reports from qualitative development projects exploring the content and potential of qualitative data' Retain permanently 010. and 10.7 Analysis for National Reports E.g., State of Care 3 years from publication of national reports 010. and 10.8 Inspectors Evidence Template (completed) For National Report, (Thematic's) e.g. State of Diabetes Care. 3 years from publication of national reports Should not include CPI No Not applicable No Not applicable 010. and 10.9 collected for Thematic Reviews 3 years from publication of national reports Should not include CPI No Not applicable No Not applicable 010. and model Model is a blueprint describing the data used by an organisation, and the way it is structured Retain permanently 010. and Draft model 1 year 010. and Provider profile scores, for reports and relevant data extracted Legacy provider profiles scores Retain permanently 010. and 010. and 010. and 010. and request (non NHS) Quarterly data request for indicators from the Independent Health providers (non NHS) Controlled drugs dataset Monthly dataset that feeds in to the Controlled drugs Published Accountable Officer Register. For details of register and report please see Inspections series contact lists Monthly download of regulatory contact roles from CRM Published Health and Social Care register 3 years 3 years None identified Official Authority No Not applicable 1 year None identified Official Authority No Not applicable Published version 010. and 010. and 010. and 010. and Warehouse content - Raw data Statistics and reporting for our core functions with providers Including, Registration, Notifications, Inspections all activity. Raw Retain permanently Official Authority Standards of quality and safety of health and social Static cut of raw data from Warehouse Retain permanently Official Authority Standards of quality and safety of health and social MI products dashboards in CRM Retain until superseded Official Authority Standards of quality and safety of health and social CRILL published data Retain permanently

16 010. and 010. and Query trackers Queries, answered questions, 5 years None identified Official Authority Standards of quality and safety of health and social National groups papers Minutes, agendas of CQC run meetings, or externally 2 years None identified Official Authority No Not applicable hosted 010. and sharing agreements 6 years from end of agreement None identified Official authority No Not applicable 010. and 010. and 010. and 010. and External data received as part of an Sharing agreement 6 years unless retention period is specified in the terms of the agreement for Risk profiling Retain permanently Low numbers of anonymised data in some cases Analysis reports - internal 3 years May contain CPI, in some cases Internal Indicator development and coding Official authority health Official authority No Not applicable Official authority If detailed analysis, health information Ensuring high standards Indicator construction, methodology, Retain permanently 010. and 010. and Published Intelligence/Insight Monitoring Methodology Correspondence with providers Letters/ s regarding data, e.g. outliers, GP intelligent monitoring Retain permanently 3 years None identified Official authority No Not applicable 010. and packs/intelligence packs report snapshot Completed templates, Final and draft versions 12 months after publication of the Inspection report, unless enforcement or appeal/rating review is likely May contain CPI, in some cases Official authority If detailed analysis, health information Ensuring high standards 010. and Provider Return/ Collection ASC- 3 years, GPs -5 years, Hospitals- retain May contain CPI, in some cases Official authority No Not applicable 010. and 010. and List of information sent in by Trust or Provider Evidence log for each hospital inspection,(asc & PMS held by inspectors) 6 months after inspection report published unless enforcement or appeal/rating review is likely Ratings results 6 months after inspection report published unless enforcement or appeal/rating review is likely 010. and Results/summary of Quality assurance of Intelligence products Retain while system/product is in use 010. and Survey reports on National & local level results Published reports Retain permanently 010. and Survey methodology Published report of official and national statistics Retain permanently

17 010. and Survey data (as per and above) collected in line with the code of practice for official statistics. Retain permanently 010. and Survey queries (external) as per above Survey specific queries, content, results of survey, or sampling material 3 years after publication of survey None identified Public Interest task No Not applicable 010. and Evidence of the Quality assurance process Retain while product is still in use None identified Official authority No Not applicable 010. and Call for evidence for Thematic 1 year from publication of national reports. May contain CPI Consent No Not applicable 010. and Qualitative risk briefings 3 years None identified Official authority No Not applicable 11.1 Archived document collections Accession registers, transmittal lists, reports, Archiving Retain until superseded None identified Official authority No Not applicable stored off-site spreadsheet, closure of accounts 11.2 Disposal certificates 7 years None identified Official authority No Not applicable 11.3 Asset Register - full version Retention periods for Assets Retain permanently None identified 11.4 Scanning manual Describes process for scanning to BS10008 Retain permanently standard 11.5 Register of security groups of access to Retain permanently 11.6 Internal Query log 3 years None identified Public interest task No Not applicable 11.7 Asset Register - Retain permanently published version 11.8 Web forms - development Retained while needed 11.9 Web forms - responses 3 months Official authority, Contract High standards of health, Employee rights Governance & Security Policy Code of practice on Confidential personal information Retain permanently Retain permanently Code of practice on CPI consultation responses 2 years or the life of the code None identified, where it Legal obligation No Not applicable whichever is longest identifies an individual Statistical data of requests 5 years Legal obligation, where provided Substantial public interest Freedom of & Protection access requests FOI request response 5 years FOI and DPA request document and correspondence Publications scheme and List of information that CQC routinely publishes on its associated guides- model from Website Commissioners Office (ICO) Privacy impact assessments & technical risk assessments 3 years after last activity Legal obligation, where provided Substantial public interest Retain permanently Keep in line with associated, e.g. Project

18 11.18 Caldicott approval forms E.g., Change to using patient info Keep in line with associated, e.g. Project None identified for name of requester Public interest task No Not applicable Archive of Internal audit Previous process, working documents, final reports 5 years Security Incidents Log 5 years Security Incidents reports Retain permanently None identified Official authority No Not applicable Freedom of Act 2000 Policy (FOIA) and Protection Act 1998 (DPA) procedures & guidance 3 years Register of Asset Ongoing None identified Owners, Managers, and Administrators (Knowledge Champions) Fraud cases tracker spreadsheet 6 years Legal obligation Establishment, exercise or defence of legal claims Freedom of Act 2000 Deleted- duplicate of asset Policy (FOIA) and Protection Act 1998 (DPA) procedures & guidance Permanent transfers of / Retain permanently collections of Transfers/sharing of / Retain until returned collections of Appraisal of for Retain permanently permanent preservation 012. Legal 12.1 Litigation, Prosecutions, and Inquests papers. Evidence, such as correspondence with providers, inspection reports, handwritten notes or copied extracts, court/ tribunal papers, case files and correspondence Legal 12.2 Legal advice to CQC staff Internal work for CQC, board queries, e.g. Enforcement, Policy teams, Procurement contracts, Human Resources, Disclosure Barring Services, Ratings challenges 13.1 Provider financial Finance and loss reports 7 years from receipt of information 7 years after last action - redacted for court purposes Official authority Health standards 7 years after last action None identified Official authority Health standards Official authority No Not applicable 13.2 Minutes of engagement meetings 7 years Official authority No Not applicable 13.3 Financial Templates & Reports 7 years Official authority No Not applicable 13.4 Reports from accountants 7 years Official authority No Not applicable 13.5 Details of group structures and under takings 13.6 Criteria of Market Oversight and list of providers in Market Oversight General description setting out regulations and the guidance for Providers is published on the Internet. Plus the list of Providers Retained permanently Official authority No Not applicable Retained permanently None identified Not applicable Not applicable Not applicable Not applicable

19 13.7 General correspondence DELETED 13.8 Provider 'Brand Profile' Detailed quality profile of brand and update of engagement activity Official Notes of engagement meetings 7 years No Official authority No Not applicable 7 years Official authority No Not applicable Monthly Bulletin 2 years Official authority No Not applicable Risk Register Retained permanently Official authority No Not applicable Risk Rating Report Retained permanently Official authority No Not applicable Regional Risk Panel reports DELETED - duplicate see Registration Portfolio list with allocated Relationship Leads and Strategic Leads Retained permanently No Official authority No Not applicable Quarterly Risk Report Highlights brands of concern and actions being taken 2 years Official authority No Not applicable Provider queries, feedback and concerns 3 years Official authority No Not applicable Provider strategic documents 2 years Official authority No Not applicable Criteria Methodology Retained permanently None identified Not applicable Evidence to support reports/formal response to queries Reports/formal response to queries Not applicable Not applicable Not applicable Surveys, analysis etc... 3 years Official authority No Not applicable 7 years None identified Not applicable Reports Published reports on particular topics. Retained permanently None identified Not applicable Briefing Analysis 14.1 Registration Application & Recommendation report 14.2 Notice of Decision to register with agreed conditions 14.3 Notice of Proposal to refuse or register with conditions which are not agreed. Detailed intelligence for every brand record. See IAR series 10 Intelligence Application form, Assessment & recommendation report, includes the minor amendment form. See IAR series 10 Intelligence Not applicable Not applicable Not applicable Not applicable Not applicable Not applicable 7 years after deregistration Legal obligation where relevant 7 years after deregistration None identified Official authority 7 years after refusal or 7 None identified Official authority years after deregistration

20 14.4 Statement of purpose 7 years after deregistration or 3 years after updated 14.5 Disclosure and Barring DBS Successful and unsuccessful applications 6 months after final registration decision/notice of decision 14.6 Disclosure and barring - unsuccessful DELETED - combined with Registration correspondence (outbound) 6 months after final decision - (including appeals, tribunal etc.) Please see IAR series 10 for more detail. Official authority where relevant Official authority where relevant 14.8 Register of providers is in series See series 10 Includes the content of the Registration 10 Certificate Internal Meetings, Relating to registration process 2 years Withdrawn/refused applications, including the application form and supporting documents 2 years after final decision ( including appeals, tribunal etc.) Official authority where relevant Site visit notes - handwritten 6 months after decision for registration or published for Inspection unless enforcement or appeal is likely MRR Review Record MRM Review Meeting- Registration Site Visit Record and Fit person notes Registration supporting documents Deleted 2018/19 Financial information, forecast, business plan, references, training, policies and procedures, Representations received Provider representations refusal or conditions for registration. Official authority where relevant Retain whilst registered Official authority where relevant Retain whilst registered Legal obligation where relevant 6 months after final decision Legal obligation Possible in - (including appeals, tribunal references etc.) 6 months from the date of the Commission's decision re the representations or the first tier tribunal Official authority where relevant Safeguarding unregistered received and following action 3 years Official authority where providers relevant Financial Viability 7 years Official authority No Not applicable Registration Insight Report 6 months after final (registration) decision MRM Review see Enforcement IAR series 0.17 Please see Enforcement IAR Meeting- Unregistered series 0.17 Enforcement. Unregistered provider, See series 0.17 See Enforcement IAR series monitoring, 0.17 Registration Notifications see Inspection series 15 See Inspection IAR IAR series 15 Risk register See Org series 5 (5.11) see Org IAR series 5 (5.11) Official authority No Other