Storing and destroying Disclosure documents
The CRB/SCRO Code of Practice requires that paper Disclosures are stored in a locked, non-portable cabinet separately from other personnel files and only accessed by the minimum number of people; all of whom are directly involved in making the decision whether the individual concerned should be placed in the role.
The CoP also forbids any photocopying, faxing, extracting or scanning of Disclosures and even requires that any notes taken that refer directly to Disclosure content are destroyed immediately after use.
The documents themselves should only be retained until the placement decision has been made and then destroyed securely. The guidelines say that this should take no longer than 6 months, though for some CQC regulated organisations 12 months is acceptable to allow the document to be seen at the next inspection visit.
DDC's standard process for paper Disclosure documents is to retain them in accordance with the CoP for 3 months or 12 months for CQC regulated organisations, then shred them securely.
Disclosures received electronically are deleted 3 months from receipt and the data captured as part of the electronic application process is deleted 30 days from receipt of the Disclosure*. This allows time for any dispute to be raised by the applicant or client, in whch case the deletion of the data can be postponed manually until the dispute is resolved.
Should there subsequently be a legal requirement to re-create a Disclosure as at the time of issue, the CRB can do this based on the document number and issue date. (They store a digital image of the original document issued so the replacement will reflect that and not the records at the time of issue - which could in theory be different)
* DDC will retain some identity data in order to uniquely identify who the Disclosure number & issue date relates to and facilitate contacting the applicant should that be required. This is covered under the Data Protection Act.