Template D: Process according to data protection principles Principle for each activity Issues to consider Confirm date considered Lawfully All your processing is lawful – Template C Fairly and transparent A fair processing notice is provided to data subjects, as appropriate and we will consider objections to any processing – Template G Adequate, relevant and limited for the purposes Personal data available only to those who need to see it for the work they do. For appropriate processing, the data subject’s name is generally redacted (pseudonymised data is processed). Accurate/up to date Records are accurate and, if relevant, up to date. Processes in place to amend in response to a patient rights request. Form in which identification kept for no longer than necessary Psedonymisation/redaction of personal details, has been considered, as appropriate. Security An appropriate person has provided assurances that your computer, IT and web-based systems are secure. Steps have been taken to check that personal data is not accessible to unauthorised persons
Annex A: Suggested Data Retention Policy Please note: Where the reason for keeping is “Legal”, the retention period is definitive. The remainder are taken from Scottish Government Records Management policies and other documents which outline best practice. Organisations may choose to keep documents for less or more time than is recommended, but are advised to weigh up the needs for retention against the risk of destruction before doing so, taking into account the rights of the data subject under the GDPR. Record Reason for keeping Minimum retention period Comments Dispensing PMR Legal 10 years after the death of the patient Backup to archives likely Private Prescriptions Legal 2 years The Human Medicines Regulations 2012 (regulation 253 (5)) POM Register Legal 2 years from last entry The Human Medicines Regulations 2012 (regulation 253 (5)) POM-V and POM-VPS records of receipt and supply Legal At least 5 years Veterinary medicines regulations 2009 (SI 2297). Must keep all documents relating to the transaction. Specific requirements for what information must be included.
Patient authorisations for managed repeat systems Audit Six months after the last prescription is collected. This is a minimum and individual businesses may choose to retain for longer Pharmaceutical Services PCR records Legal As per PMR records: 10 years after the death of the patient PGD records Legal Minimum 7 years – refer to individual PGDs as these may state longer retention periods which would supersede the Pharm. Services legislation. Pharmaceutical Services Regulations 2009 Sexual Health Services Audit For adults aged 18 and over: 10 yrs For a child: until the 25th birthday or 10 yrs (whichever is longer) Best practice – local PGDs may differ. Stoma Customisation records Audit 1 year after collection Clinical Interventions Minor interventions Best Practice Review at 2 years Major interventions Audit For 10 years after the death of the patient Should be recorded directly on PMR Controlled Drug Records CD Registers Legal 2 years from date of last entry but if it contains records of destruction of CDs (including patient returns and out of date stock) then keep for 7 years Misuse of Drugs regulations 2001 CD requisitions etc. Legal 2 years Misuse of Drugs regulations 2001
PAYE records Audit 6 years Wages/Salary records Audit 10 years Disciplinary: written warnings Audit 12 months This will vary by organisation. Terms stated are NHS Scotland standard periods. Disciplinary: Letter of dismissal Audit 10 years Contractors may wish to seek legal advice on a case-by-case basis Disciplinary: Records of actions taken Audit 6 years after leaving employment Recruitment documents e.g. CVs Audit 1 year after the completion of the recruitment exercise Operations Responsible Pharmacist Log Legal 5 years minimum Can be hard copy or electronic Indemnity certificates Audit 6 years after the indemnity has lapsed Clinical Governance Patient Complaints without Litigation (Adult) Audit 7 years Patient Complaints without Litigation (Child) Audit Until child is 16 or 7 years, whichever is later. Patient complaints with legal action (Adult) Audit 7 years after case is settled or dropped Contractors may wish to seek legal advice on a case-by-case basis.
Patient complaints with legal action (Child) Audit Until child is 18 or 7 years after case is settled or dropped, whichever is later. Contractors may wish to seek legal advice on a case-by-case basis. Duty of Candour records Audit 30 years Contractors may wish to seek legal advice on a case-by-case basis. Staff competency/training records Reference Two years beyond termination of employment Best practice, keep in secure personal portfolio Clinical Audit Reference 5 years Patient Surveys Reference Review need to retain after 6 months Are these required once desired information has been gathered and used? Health and Safety Asbestos Register Audit Permanent COSHH (Control of substances hazardous to health) documentation Audit 10 years Accident and Incident forms Audit 10 years If legal action is taken, contractors may wish to take legal advice on retention period RIDDOR (Reporting of Injuries, Diseases and Dangerous Occurrences Regulations) reports including accident register Audit 10 years If legal action is taken, contractors may wish to take legal advice on retention period