Data Protection Impact Assessment

The platform processes financial records relating to adults who receive care, some of whom may lack capacity to manage their own money. Although the data is financial rather than clinical, it concerns vulnerable individuals and is used to evidence safeguarding practice. A DPIA was therefore carried out voluntarily, applying the Article 35 criteria and the ICO's screening list, rather than waiting for a strict legal trigger.

Screening outcome: processing involves vulnerable data subjects and financial data at scale across multiple provider organisations. A full assessment was appropriate.

Nature. Care providers record deposits, purchases, cash handed to a service user, and petty-cash movements against individual service-user ledgers and care-unit cash floats. Staff attach receipt images, capture signatures, run reconciliation and reporting, and exchange notes in a communication log.

Scope. Personal data processed: service-user name and internal reference, date of birth, keyworker, next-of-kin contact details, capacity flag and authority basis, care-related notes entered by the provider, balances and transaction history, receipt images, and signature images. Staff data processed: name, work email, role, group assignments, and full activity history.

Context. Users are care staff, managers, administrators and data protection officers within a single provider organisation. Service users do not have accounts. Data is entered on shared devices in care settings as well as on desktops.

Purposes. Accurate stewardship of service-user money, prevention and detection of financial abuse, evidence for CQC inspection and internal audit, and administration of the provider's subscription.

Lawful basis (Controller). Providers typically rely on legitimate interests or legal obligation for financial record-keeping, and on substantial public interest — safeguarding of individuals at risk — where special category or vulnerability-related information is involved. The Controller determines and documents its own basis; CareLedgerPro acts only on documented instructions.

Data minimisation. Only the fields needed to operate a money ledger are mandatory. Care notes, next-of-kin details and date of birth are optional. The platform does not collect clinical records, medication data, or care plans.

Proportionality. The alternative — paper cash books and unindexed receipt folders — offers no access control, no audit trail and no reliable reconciliation. Digital processing with role-scoped access and an append-only audit log is a less intrusive route to the same safeguarding outcome.

Data subject rights. Access, rectification, erasure and portability requests are handled by the Controller, with export and deletion support from CareLedgerPro. No automated decision-making with legal or similarly significant effects takes place; receipt text extraction is a data-entry aid that a staff member always confirms.

The assessment drew on care-sector managers and finance administrators during product design, on the published expectations of the CQC quality statements for safeguarding and governance, and on ICO guidance for DPIAs and vulnerable data subjects. Service users and their representatives are consulted by the Controller as part of their own DPIA, since it is the Controller that holds that relationship.

Risks are scored on likelihood and impact to the rights and freedoms of data subjects, with residual risk assessed after the stated mitigations.

• Mandatory TOTP two-factor authentication for all accounts, with admin-only reset recorded in the user audit log.
• Row-level security on every table holding personal data, enforced in the database rather than the application.
• Role model of administrator, manager, staff and DPO, with roles held in a separate table and checked through a security-definer function.
• Append-only audit log and user audit log; update and delete are blocked by database triggers.
• Data-access logging for views of client and transaction records.
• Encryption in transit (TLS) and at rest at the storage layer.
• Private storage buckets for receipts and communication attachments, served through short-lived signed URLs.
• Invite-only account creation, leaked-password screening, and idle-session timeout.
• Built-in breach register with automatic 72-hour ICO deadline tracking.
• Automated database backups with point-in-time recovery.

Primary data storage is in UK/EU regions. Where any processing takes place outside the UK, appropriate safeguards are applied, including the UK International Data Transfer Addendum or Standard Contractual Clauses. The full list, with purpose and safeguards for each provider, is published on the sub-processors page, and the Article 28 position of the hosting and database provider is set out in the processor statement.

Financial transaction records, receipts, signatures and audit entries are retained for seven years from the end of the relevant financial year, consistent with UK financial record-keeping expectations. Account and access data is retained for the life of the subscription. On termination, data is exported and then deleted in line with the published retention and deletion policies.

Conclusion. With the measures above in place, no residual risk is assessed as high. Processing may proceed without prior consultation with the ICO under Article 36. This conclusion is CareLedgerPro's own assessment of the platform and is not an independent certification.

Review. This DPIA is reviewed at least annually, and additionally whenever a new category of personal data is introduced, a sub-processor changes, or a significant security or safeguarding feature is added or removed.