ComplyChat guides · 76 guides
Guides for care providers
A CQC-registered provider is held to the fundamental standards, and Regulation 17 asks for an accurate, complete and contemporaneous record for every person it supports. These guides take the regulations, the notifications, the safeguarding duties and the data protection rules in turn, quote the official wording, and say what record CQC would expect to see. They cover care homes, home care and supported living.
Where to start
- CQC regulations: the fundamental standards and registration rulesThe CQC regulations explained: the fundamental standards in Regulations 9 to 20A, the registration rules, which breaches are offences, and the quality statements.
- CQC record keeping requirements: what Regulation 17 actually asks forWhat Regulation 17 requires of CQC-registered providers' records: which to keep, what contemporaneous means, how long to keep them and how CQC assesses it.
- CQC notifications: what to report, how quickly, and which formWhat a registered provider must notify CQC of: deaths, serious injuries, abuse, police incidents, DoLS outcomes, absences and changes, with deadlines and forms.
- What policies does a care home need? The list, by regulationThe policies and procedures a care home in England needs, each tied to the CQC regulation or other law that requires it, and why a complete list is not compliance.
- Regulation 17 good governance: systems, audit and board oversightRegulation 17 for care providers: the six limbs of good governance, audit that drives improvement, feedback, board oversight, and how CQC assesses it.
- Care home staff WhatsApp groups: confidentiality and the recordThe rules a care home staff WhatsApp group meets: confidentiality, residents' health data on personal phones, Regulation 17 records, and what a staff policy should say.
Governance and the board
- Guide · Governance
Minute taking: what to record and what to leave out
What belongs in meeting minutes and what does not, who should take them, a reusable structure, and why the minute book no longer sees every decision.
- Guide · Care and CQC
Registered manager responsibilities: what Regulation 7 requires, what you are accountable for, and the records that prove it
The registered manager's role under the Health and Social Care Act 2008: who must have one, the four limbs of Regulation 7 (character, qualifications and competence, health, the Schedule 3 information), the offences a registered person can be prosecuted for, absence and leaving, and the evidence an inspector reads to see whether the service is well led.
- Guide · Care and CQC
Regulation 17 good governance: systems, audit and board oversight
Regulation 17 for care providers: the six limbs of good governance, audit that drives improvement, feedback, board oversight, and how CQC assesses it.
- Guide · Governance
Grievance procedure: the Acas Code steps and what to record
A grievance procedure under the Acas Code: what a grievance is, the steps, the meeting, accompaniment, the outcome and appeal, what to record, and tribunal time limits.
- Guide · Governance
Risk register: what it records and what the regulators expect
What a risk register is, what it should include, how likelihood and impact scoring works, and what CC26, the Academy Trust Handbook and CQC expect of boards.
Work conversations on personal phones
- Guide · Data protection
Is WhatsApp GDPR compliant for work?
The three different things called WhatsApp, the five duties that are hard to meet whichever you mean, whether an employer can require its use, and what metadata Meta receives.
- Guide · Data protection
Subject access requests and WhatsApp messages
What an employer must disclose, what may be withheld or redacted, how tribunals treat them, and what to do when the messages cannot be produced at all.
- Guide · Work messaging
Work messages on personal phones: what the organisation is responsible for, what it can and cannot see, and what the policy has to say
Work messages on staff’s own phones in a school, charity or care service: why the organisation is the controller of what its staff hold there, what the ICO says about personal devices and subject access requests, the limits on looking at a worker’s own phone, what the Cabinet Office’s rules for WhatsApp and private email say a workplace policy should copy, and the record that never reaches the organisation.
- Guide · Work messaging
WhatsApp messages as evidence: tribunals, inspections and regulators, and the organisation that cannot produce them
WhatsApp and text messages as evidence for an organisation in the UK: how a message becomes a document in an employment tribunal, an inspection or a regulator’s inquiry, what the Civil Evidence Act says about copies and business records, the duty to disclose messages that harm your case, screenshots against exports and what authenticity turns on, subject access requests, and the position of the organisation that cannot produce the messages at all.
- Guide · Work messaging
Personal mobile phone policy for staff: what it must cover in a school, a charity or a care service
A personal mobile phone policy for staff in a school, charity or care service: the rules that make one necessary (KCSIE’s staff behaviour policy, the ICO’s guidance on personal devices and on checking workers’ communications, CQC’s records duty), the difference between a pupils’ phone policy and a staff one, the eight things the policy has to cover, what it cannot lawfully do, and the record the policy has to create.
- Guide · Work messaging
Staff messaging policy: what it must say about channels, records, hours and personal phones
A staff messaging policy for a school, charity or care service: the channels that are permitted for which work and the ones that are not, the record every message about a person or a decision has to reach, the Cabinet Office’s rules for WhatsApp, private email and SMS as the published model, hours and expectations, what the organisation may and may not look at under the ICO’s guidance, and the paragraph most policies leave out.
- Guide · Data protection
WhatsApp retention policy: what you can keep and what to write
A retention policy for work messages on WhatsApp: what the app keeps, disappearing messages, backups, leavers' phones, holds, and the rows a UK retention schedule needs.
- Guide · Work messaging
WhatsApp messages in a disciplinary hearing: using them fairly
Using WhatsApp messages in an internal disciplinary under the Acas Code: how they reach the employer, Article 8 and privacy, authenticity, and the employee's own copies.
- Guide · Adult social care
Care home staff WhatsApp groups: confidentiality and the record
The rules a care home staff WhatsApp group meets: confidentiality, residents' health data on personal phones, Regulation 17 records, and what a staff policy should say.
- Guide · Work messaging
Teams chat retention policy: what Microsoft 365 keeps and deletes
How Microsoft Purview retention policies work for Teams chats and channel messages, what they include and exclude, how deletion really runs, and who is outside them.
- Guide · Governance
Acceptable use policy for staff: schools, charities and care
A staff acceptable use policy for IT, devices and messaging in schools, charities and care: what KCSIE 2026 requires, what to cover, personal devices, and enforcement.
- Guide · Work messaging
WhatsApp group admin responsibilities when the group is for work
What a WhatsApp group admin can and cannot do, and what the admin of a staff, volunteer or parent group answers for: data protection, safeguarding, records.
- Guide · Work messaging
Right to disconnect policy: the UK legal position and what to write
The UK has no statutory right to disconnect. What the law does require for messages after work hours, and how to write a voluntary out-of-hours policy.
- Guide · Data protection
WhatsApp Advanced Chat Privacy: what it blocks in a work group
What WhatsApp’s Advanced Chat Privacy and its replacement, Restricted chat, block and allow, and what that means for a work group’s requests and evidence.
- Guide · Data protection
Bring your own device policy: security and UK GDPR for work data
A BYOD policy for staff using their own phones, tablets and laptops for work data: the ICO’s view, NCSC controls, Cyber Essentials scope, privacy and leavers.
Safeguarding and raising concerns
- Guide · Adult safeguarding
Safeguarding in care homes: the six principles and the five Rs
What safeguarding means under the Care Act 2014, the six principles, the five Rs, examples of safeguarding issues, and when a concern must reach CQC and the local authority.
- Guide · Care and CQC
Incident reporting in care homes: what to record, who to tell, and the record that shows you decided correctly
Accident and incident reporting for care homes and other adult social care services in England: the internal record Regulation 17 requires, which incidents must be notified to CQC, which are reportable to the HSE under RIDDOR, when the local authority safeguarding team and the duty of candour are engaged, and the one incident record that shows every decision.
- Guide · Safeguarding
Safeguarding training records: what schools, charities and care providers must keep, and what an inspector asks to see
Safeguarding training records for schools, charities and adult social care in England: who has to be trained and how often under KCSIE 2026, the Charity Commission’s guidance and CQC Regulation 18, what a training record has to show, what Ofsted and CQC actually ask for, how long to keep it, and the update that is delivered as a message and never reaches the file.
- Guide · Governance
Whistleblowing policy: what it must include
Which disclosures the Public Interest Disclosure Act protects, who is covered, what detriment means, and the confidentiality you cannot honestly promise.
- Guide · Safeguarding
Making a MASH referral: what to record before, during and after
A concern followed from the first note to the outcome: thresholds, consent and the new information sharing duty, the one-working-day and 45-day timescales, and the record at each stage.
- Guide · Safeguarding
Safeguarding concern form: what to record and where it goes next
What a safeguarding concern form should record for a child or an adult at risk, how to write it, what the council's adult form asks, and where it goes next.
- Guide · Safeguarding
Information sharing between agencies: the duty, tests and record
How safeguarding information is shared between agencies under the section 16LA duty from 30 September 2026 and Working Together 2026, and what to record.
- Guide · Charities
Lone working policy: what the law requires and what it should say
A lone working policy for charities and care services: the HSE duty, the risk assessment, restrictions, check-ins and escalation, and the record that shows they work.
- Guide · Care and CQC
Duty of candour in the NHS and care: Regulation 20, step by step
The statutory duty of candour for NHS bodies and every CQC-registered care provider: what counts as a notifiable safety incident, the steps, the apology and the record.
- Guide · Care and CQC
CQC notification of death for care homes and home care services
When a death must be notified to CQC, which form to use, how quickly, what the form asks, deaths under a DoLS authorisation, and the record behind the notification.
- Guide · Care and CQC
DoLS record keeping: authorisations, reviews and the 2026 ruling
The records a care home or hospital must keep under the Deprivation of Liberty Safeguards: requests, authorisations, conditions, reviews and CQC notifications.
- Guide · Adult social care
Mental capacity assessment records: what the MCA 2005 expects
What a mental capacity assessment record must show under the Mental Capacity Act 2005: the decision, support given, the two-stage test and the best interests decision.
- Guide · Care and CQC
Section 42 enquiry: what it is and what a care provider must record
What a Care Act section 42 enquiry is, when the duty arises, when a care provider is asked to carry it out, and the records the provider must keep and produce.
- Guide · Adult social care
Care home safeguarding policy
How Regulation 13 and the Care Act shape a care home safeguarding policy: responsibilities, referral routes, recording and oversight.
- Guide · Safeguarding records
Safeguarding chronology
What belongs in a safeguarding chronology, how to record significant events, who maintains it and how it supports assessment and file transfer.
- Guide · Care and CQC
Supervision records in care: what to keep, how often, who sees it
What a supervision record in adult social care should contain, how often CQC expects supervision, how long to keep the notes and what care workers can see.
- Guide · Safeguarding records
Contemporaneous notes: what they are and how to write one
What a contemporaneous note is, why courts, tribunals and regulators give it weight, and how to write one: date, time, exact words, facts, no later edits.
- Guide · Safeguarding
Types of abuse in safeguarding: the statutory definitions
The types of abuse as England's statutory guidance defines them for children and adults, the difference between signs and proof, what to record and who to tell.
- Guide · Adult social care
Code of conduct for care workers: the seven standards in practice
The Skills for Care and Skills for Health Code of Conduct for care workers in England: the seven standards, sign-up, supervision, breaches and records.
- Guide · Adult social care
Care home missing person policy: search, police report and CQC
What a care home missing person policy must cover in England: the first search, when to call the police, the CQC notification, safeguarding and the record.
Records and data protection
- Guide · Data protection
Data retention policy: UK requirements and how to write one
What UK GDPR storage limitation actually requires, how to build a retention schedule, where the seven-year rule really comes from, and how deletion is proved.
- Guide · Care
CQC record keeping requirements: what Regulation 17 asks for
Which records Regulation 17 requires, what accurate, complete and contemporaneous means, how long to keep them, and how the single assessment framework tests it.
- Guide · Care and CQC
CQC notifications: what you must report, how quickly, and what to record
Every statutory notification under the 2009 Registration Regulations: deaths, serious injuries, abuse, police incidents, events that stop the service, DoLS outcomes, absences and changes, the timescales, the forms, and the incident record an inspector reads them against.
- Guide · Data protection
DBS record keeping: what to keep, for how long, and what never to copy
What the DBS code of practice lets you record, the single central record's checklist, the six-month rule for copies and the places a certificate must never appear.
- Guide · Data protection
Subject access request policy: how to respond, and the exemptions
What a subject access request policy should say, how to respond on time, the exemptions, and the 2025 Act changes to searches and the clock.
- Guide · Data protection
Right to erasure under UK GDPR: when it applies, how to respond
The right to erasure under UK GDPR Article 17: the grounds, the exceptions for legal obligations, safeguarding and care records, and the one-month clock.
- Guide · Data protection
How long to keep employee records in the UK: statutory periods
How long UK employers must keep employee records: PAYE, minimum wage, holiday, right to work, pensions and accidents, with safeguarding periods for schools and care.
- Guide · Data protection
Care home data protection policy: DSPT, Caldicott and breaches
What a care home data protection policy must cover: health data under UK GDPR, the Caldicott principles, the Data Security and Protection Toolkit and breaches.
- Guide · Care and CQC
CQC regulations: the fundamental standards and registration rules
The CQC regulations explained: the fundamental standards in Regulations 9 to 20A, the registration rules, which breaches are offences, and the quality statements.
- Guide · Care and CQC
What policies does a care home need? The list, by regulation
The policies and procedures a care home in England needs, each tied to the CQC regulation or other law that requires it, and why a complete list is not compliance.
- Guide · Work messaging
Message archiving for compliance in schools, charities and care
Why organisations archive work messages – access requests, FOI, safeguarding, disputes – capture after the fact or at source, and Microsoft 365 retention.
- Guide · Adult social care
Care home daily records
What Regulation 17 requires of daily care notes, with practical examples, handover records, access, retention and decisions made between shifts.
- Guide · Adult social care
CQC evidence categories and quality statements
CQC’s six evidence categories, quality statements and rating rules, with practical records for care providers and a note on framework changes.
- Guide · Adult social care
Record keeping in domiciliary care and supported living
Records for home care and supported living: visit notes, medicines, access, missed visits, retention and keeping home and office records aligned.
- Guide · Data protection
Confidentiality policy: what to include and when to share
What a confidentiality policy must cover for a care provider or charity: the common law duty, UK GDPR, Caldicott, and when confidentiality can be broken.
- Guide · Care and CQC
MAR chart: what a medication administration record must show
What a MAR chart is, what it must record, who signs it and when, how PRN and refused doses are recorded, and how long CQC says to keep it.
- Guide · Data protection
Data breach log: what to record for every breach, reported or not
The breach log UK GDPR Article 33(5) requires for every personal data breach: the ICO’s template fields, near misses, charity and care reporting, and retention.
- Guide · Data protection
Record of processing activities: what Article 30 requires you to keep
What a record of processing activities must contain under Article 30 UK GDPR, who must keep one, the fewer-than-250-employees exception and how to build it.
- Guide · Data protection
Data protection training for staff: what to cover and what to record
Data protection training for staff in schools, charities and care: what UK GDPR and the ICO expect, who needs it, how often, and the training record to keep.
- Guide · Care and CQC
Domiciliary care policies: what a home care service needs and why
The policies a CQC-registered home care or supported living service needs, from CQC's registration list and the 2014 Regulations, with what home care adds.
- Guide · Care and CQC
CQC statement of purpose: what to include and when to update it
What a CQC statement of purpose must contain under Regulation 12 and Schedule 3, how to keep it current, and how to tell CQC of a revision within 28 days.
- Guide · Care and CQC
CQC Regulation 9: person-centred care and the evidence behind it
Regulation 9 person-centred care quoted in full: assessment with the person, care built around their preferences, involvement, consent and what CQC looks for.
- Guide · Adult social care
Care plan reviews in care homes: what to record when a plan changes
When a care home should review a care plan, who takes part, and what the review record should show: the trigger, the resident’s views, changes and the new plan.
- Guide · Care and CQC
Mock CQC inspection: how to run one that tests the real evidence
How to run a mock CQC inspection of a care home or home care service: scope, evidence requests, observation, interviews, a checklist, scoring, action plan.
- Guide · Care and CQC
Care home quality assurance: an audit calendar and checklist
A practical quality assurance programme for a care home under Regulation 17: the audit calendar, what each audit checks, the action log and provider oversight.
- Guide · Care and CQC
RIDDOR in care homes: what is reportable, and what goes to CQC
Which care home accidents are reportable under RIDDOR 2013, for residents and for staff, the 10 and 15-day deadlines, the record to keep and where CQC fits.
- Guide · Care and CQC
Care records retention: how long a care provider keeps each record
How long to keep care records in England: the 8-year minimum for adult social care records, staff, complaints and incident periods, and recording destruction.
- Guide · Care and CQC
Care home training matrix: topics, refresher periods and the record
What a care home training matrix should show CQC: Regulation 18, the Care Certificate, Oliver McGowan training, refresher periods and how long to keep it.
- Guide · Care and CQC
Care home complaints procedure: Regulation 16 and the complaints log
What a care home complaints procedure and policy must do under CQC Regulation 16, the complaints log to keep, timescales, and the route to the Ombudsman.
Choosing a tool
- Guide · Choosing
Messaging app with an audit trail: what to look for
What an audit trail means in messaging, why end-to-end encrypted consumer apps cannot provide one, the questions to ask a supplier, and where the record should live.
- Guide · Choosing
Choosing a work messaging app
What Slack, Teams and Google Chat actually differ on, what happens when the people you need have no work account, and what a free plan does to your message history.
- Guide · Care
Staff communication apps for care homes
Care management systems, family apps and staff messaging are three different purchases. What each does, why care teams end up on personal phones, and how to choose.
- Guide · Choosing
A GDPR compliant messaging app: what "compliant" has to mean for a UK organisation
No app is compliant on its own: the Article 28 contract, encryption and what it does not do, restricted transfers, the Article 30 record, subject access, retention and the 72 hour breach clock, and the questions to put to any vendor.
- Guide · Work messaging
Encrypted messaging for business in the UK: what it leaves open
What end-to-end encryption protects, what it leaves open, what the NCSC asks of a work messaging app, and the trade-off with keeping and producing a record.
- Guide · Work messaging
Secure messaging for social workers: standards and the record
Secure messaging for social workers in England: what Social Work England's standards and online guidance expect, how messages fit case recording, and what to look for.
- Guide · Care and CQC
Home care communication app: what to require before you choose
What a home care provider should require of a messaging app for lone care workers: records under Regulation 17, UK GDPR, the DSPT and lone working.
Guides for other organisations
Why we write these
We sell a channel your organisation owns, on the record from the first message, filing into your own Microsoft 365. That is a narrow product, and it only makes sense against a duty you already carry. So we write the duties up honestly, cite the regulator rather than ourselves, and say plainly where our product is not the answer.
Every guide is a summary and none of them is legal advice. Where a decision turns on the detail, take proper advice.
How it works · Why us · Pricing · FAQ · Open a channel yourself