Information governance is the set of processes, policies and standards used to manage information securely, confidentially and in line with legal requirements. In health and social care, it covers how personal and sensitive information is collected, stored, shared, protected and disposed of appropriately.

There is no single named law requiring “information governance training” specifically, but employers must comply with UK GDPR and the Data Protection Act 2018, and CQC expects providers to evidence that staff understand data protection and confidentiality under Regulation 17: Good Governance.

GDPR (General Data Protection Regulation) sets rules for how personal data must be collected, stored and used. In the UK, it operates alongside the Data Protection Act 2018 as “UK GDPR,” requiring health and social care providers to handle personal and sensitive information lawfully, securely and confidentially.

The Caldicott Principles are eight standards issued by the National Data Guardian for Health and Social Care that guide the appropriate use and sharing of confidential patient information. They help staff decide when accessing or sharing identifiable information is justified and how to protect confidentiality.

Suspected data breaches should be reported immediately using your organisation's internal procedure, usually to a manager or data protection lead. Notifiable breaches must be reported to the Information Commissioner's Office within 72 hours of discovery, in line with UK GDPR requirements.

Personal information identifies an individual, such as their name, address or date of birth. Sensitive information includes special category data like health records, ethnicity or religious beliefs, which needs extra protection under UK GDPR due to the potential harm if misused.

Accurate record keeping supports safe, consistent care, evidences the decisions made, and helps meet CQC's Regulation 17: Good Governance requirements. Good records should be factual, timely, securely stored, and only accessed by people who are authorised to do so.

Yes. Anyone who handles personal or confidential information, including administrative staff, receptionists and managers, benefits from understanding information governance, confidentiality and data protection responsibilities, alongside care and clinical staff who support people directly.

Yes. The course is fully responsive and can be completed on desktop, tablet or mobile — study at your own pace, whenever it suits you.

The course is self-paced and designed to fit around your schedule, with a typical completion time of around 3.5 hours across all ten modules. You can complete it in one sitting or work through it in stages, whichever suits you best.