Information Governance Expectations Under CQC’s New Assessment Framework

December 16, 2025

Information governance sits at the intersection of safety, dignity and organisational oversight. Under the current CQC framework, inspectors increasingly test how providers protect, manage and govern personal data in real-world practice. This aligns closely with provider assurance requirements and governance and leadership expectations, where information handling is treated as a core indicator of service quality.

Operational assurance is often strengthened by using the adult social care CQC hub for governance oversight and inspection readiness, supporting providers to align information governance with inspection expectations.

Weak information governance undermines confidence in both care delivery and management control. Where records cannot be trusted, or access is poorly controlled, inspectors often question wider leadership effectiveness.

Why information governance matters to CQC

CQC views information governance as a core safety issue, not simply a compliance requirement. Poor data handling can directly affect people’s wellbeing, dignity and protection from harm.

Inspectors consider whether:

Personal data is kept confidential and handled respectfully
Records are only accessed by authorised and appropriate staff
Information is shared lawfully to support safe care
Leaders maintain oversight of data risks and controls

Failures in these areas expose people to harm and providers to regulatory challenge, particularly where confidentiality breaches intersect with safeguarding concerns.

Confidentiality and privacy in daily practice

CQC assesses confidentiality through observed practice as well as documentation. Inspectors are interested in how staff handle information in real situations, not just what policies state.

This includes:

Secure use of digital devices and logins
Maintaining privacy when accessing records in shared environments
Ensuring conversations about individuals are held appropriately
Preventing unauthorised viewing of screens or documents

Inspectors may speak directly to staff about how they protect information day to day. Inconsistent answers or unsafe practice often indicate wider governance weaknesses.

Role-based access and permissions

Inspectors expect providers to implement clear role-based access controls within digital systems. This ensures that staff only access information relevant to their responsibilities.

Good practice includes:

Limiting access to records based on role and need
Providing managers with oversight permissions for governance purposes
Ensuring sensitive information is restricted appropriately
Prompt removal of access when staff leave or change roles

Overly broad or poorly managed access is treated as a governance weakness and may raise safeguarding concerns where confidentiality is compromised.

Authentication and accountability

CQC inspectors increasingly focus on how providers ensure accountability within digital systems. This includes verifying who has accessed or changed information.

Inspectors expect:

Unique user logins for all staff
Strong password and authentication controls
Clear audit trails showing who made entries or changes
Processes for identifying and investigating inappropriate access

Shared logins or unclear attribution of records undermine accountability and reduce confidence in data integrity.

Data sharing and information flow

CQC assesses how providers share information with key partners to support safe and effective care. This includes collaboration with:

Health professionals and clinical teams
Commissioners and contract monitoring bodies
Local authority safeguarding teams

Providers must demonstrate that sharing is:

Timely and supports safe decision-making
Proportionate to the situation
Lawful and appropriately justified

Failure to share critical information can be as concerning as sharing too much. Inspectors expect balanced, well-judged decision-making.

Data breaches and incident management

Information governance is tested most clearly when things go wrong. CQC examines how providers respond to data breaches and incidents.

Inspectors look for:

Clear reporting processes for data incidents
Immediate actions to contain and mitigate harm
Investigation and root cause analysis
Learning and improvement following incidents

Repeated or poorly managed breaches often indicate systemic governance issues rather than isolated errors.

Governance oversight of information governance

CQC expects information governance to be visible within leadership and governance structures. This demonstrates that risks are understood and actively managed.

Evidence of oversight includes:

Named senior responsibility for data protection
Regular audits of information governance practice
Inclusion of data risks within organisational risk registers
Governance meetings reviewing incidents, trends and actions

Where oversight is absent or unclear, inspectors may conclude that providers lack control over critical systems.

Common inspection concerns

CQC frequently identifies recurring issues in information governance, including:

Overly broad access permissions
Shared or insecure login practices
Inconsistent understanding of confidentiality
Poor response to data breaches

These concerns often sit alongside wider governance weaknesses, reinforcing inspector concerns about leadership effectiveness.

Making information governance inspection-ready

Inspection-ready providers treat information governance as an integral part of safe care delivery. This means embedding good practice into everyday routines, not relying solely on policy compliance.

Strong providers ensure that:

Staff understand and apply confidentiality consistently
Access to information is controlled and auditable
Data sharing supports safe, coordinated care
Incidents are managed transparently with clear learning
Leadership maintains active oversight of data risks

This approach reassures inspectors that personal information is handled safely, respectfully and in a way that supports high-quality care.

Key takeaway

Information governance under the CQC framework is not a technical or administrative function. It is a core part of safe, dignified and well-led care. Providers that embed strong data protection practices into daily operations demonstrate control, accountability and respect for the people they support — all of which are central to positive inspection outcomes.