Data maps, ROPA, privacy information, and retention

Managers cannot govern data they cannot describe. A data map or record of processing activities (ROPA) shows what personal data the organisation holds, why it is held, where it is stored, who receives it, how long it is kept, and how it is protected.

In adult social care, data flows are often wider than expected. They may include care planning, eMAR, GP and pharmacy communication, hospital transfer information, incident reports, safeguarding referrals, complaints, CCTV, visitor logs, staff files, payroll, rotas, agency records, call-bell logs, door-entry systems, email, messaging, audits, surveys, funding assessments, and archived paper files.

What to map

• Purpose: direct care, employment, safeguarding, complaints, quality assurance, billing, legal claims, training, recruitment, payroll, CCTV, or regulatory reporting.
• Data subjects: residents, relatives, representatives, staff, applicants, agency workers, visitors, contractors, professionals, and complainants.
• Data types: identifiers, contact details, health and care data, financial data, ethnicity, religion, disability, images, voice, employment records, or criminal-record information.
• Systems and storage: electronic care records, paper files, shared drives, email, cloud platforms, mobile devices, archives, backups, and supplier systems.
• Recipients: GPs, hospitals, pharmacies, local authorities, ICBs, safeguarding teams, police, regulators, auditors, payroll providers, solicitors, insurers, and families where appropriate.
• Retention and disposal: how long information is kept, who authorises destruction, and how paper or digital data is securely disposed of.

Privacy information and no surprises

Residents, relatives, staff, and visitors should receive clear privacy information about how their data is used. The notice must match actual practice and be accessible. A privacy notice that differs from system behaviour, supplier arrangements, or sharing practices weakens trust and provides poor evidence of compliance.

Be transparent where people may not expect processing: CCTV, family update apps, electronic monitoring, AI-assisted documentation, staff monitoring, call recording, photography, remote support, or sharing for service planning and quality assurance.

Retention discipline

Keeping everything forever is not safer. Storage limitation requires that personal data is not kept longer than necessary. Retention decisions must reflect legal, regulatory, contractual, clinical, care, safeguarding, employment, insurance, and records-management requirements. Staff should follow the approved process for destroying, deleting, altering, or archiving records.

Records management across nations

If leaders cannot describe where personal data is, why it is held, who receives it, and when it is deleted, they cannot demonstrate accountability.