CQC Regulation 17 sets no retention period, and 28 days is not one

Ask how long a CQC-registered provider in England must keep staff training records and you will often be told 28 days, or three years, or seven. The first of those is a misreading of the regulation. The other two are not in it. Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 specifies no retention period at all, and it does not use the word training.

What the regulation actually says

Regulation 17 is the good governance regulation. On records, 17(2)(d) requires providers to "maintain securely such other records as are necessary to be kept in relation to" firstly "persons employed in the carrying on of the regulated activity", and secondly "the management of the regulated activity". The guidance adds that employee records "must include information relevant to their employment in the role". The CQC's guidance is at cqc.org.uk.

Two things follow. First, staff training records are covered by inference rather than by name — they are "information relevant to their employment in the role", read alongside the training and competence requirements in Regulations 18 and 19. Second, there is no number. On destruction, the guidance says records must be destroyed in line with current legislation and nationally recognised guidance, with data protection rules applying to the retention of personal information. That is a pointer to other sources, not a period.

The 28 days is a response deadline, not a retention period

This is the conflation worth stamping out, because it travels fast and it is the kind of error that makes a policy look authoritative while being wrong.

Regulation 17(3) provides that the registered person must send to the Commission, when requested to do so, specified information "by no later than 28 days beginning on the day after receipt of the request". That is how long you have to respond to the CQC once it asks. It says nothing about how long the underlying record must exist. A provider that destroyed a record two years ago has not breached a 28-day rule; it has potentially breached 17(2)(d) by failing to maintain a necessary record, which is a different and less tidily quantified problem.

So what sets the period?

Because Regulation 17 does not, the period has to come from somewhere else, and in England it comes from a combination of sources rather than a single rule.

• Data protection. The storage limitation principle requires personal data not to be kept longer than necessary. This operates as a ceiling, not a floor — it pushes against indefinite retention rather than setting a minimum.
• Nationally recognised guidance. The CQC's own wording defers to it, so whichever records management code applies to your sector is doing the work the regulation does not.
• Professional regulators, for the individual. These are real numbers and they vary widely. The GDC requires dental professionals to keep CPD evidence for the five-year cycle "and for five years after the completed cycle" — see gdc-uk.org — effectively up to ten years from the start of a cycle. The Bar Standards Board sets three years by rule. The SRA sets none and says so.
• Employment and liability considerations, which sit outside the care regulations entirely.

Note that these are different duties on different parties. The GDC's ten-year figure binds the dental professional, not the employer. An employer cannot discharge its Regulation 17 duty by pointing at the registrant's portfolio, and a registrant cannot discharge theirs by pointing at the employer's HR system.

How to write a defensible policy

Since no number is handed to you, the policy has to carry its own reasoning. Four things make it defensible:

• State the period and the basis for it. "Six years, by reference to our records management code and limitation considerations" is defensible. "Six years" alone is an assertion.
• Separate the employer duty from the registrant duty, and set each to the longer of the applicable requirements rather than assuming they align.
• Make the retention trigger explicit. From the date of the record, from the end of the training year, or from the end of employment are three different clocks and they produce very different outcomes for a long-serving employee.
• Do not cite a period to the CQC that the regulation does not contain. Attributing a figure to Regulation 17 is checkable in about a minute, and it undermines the rest of the document.

It is worth knowing that this is an English peculiarity rather than a universal one. Ireland's designated centre regulations do specify retention periods for staff training records, in statute, with numbers — and they differ between service types.

For the detail of what Regulations 17 and 18 require of a training records system, see our guide to CQC training records requirements. For the Irish comparison, see why Irish training records are kept seven years or four. And for registrant-side periods across regulators, see how long CPD evidence must be kept.