How should client records be managed to comply with data protection requirements?

• A. Kept on paper in unlocked drawer for quick access.
• B. Stored digitally with no access restrictions.
• C. Stored securely, accessible only to authorized staff, with up-to-date, accurate information and consent.
• D. Shared with any staff member who asks.

Answer: (C)

Data protection requirements mean client records must be kept confidential, accurate, and used only by people who need to see them. The best approach is to store records securely, so they’re protected from theft or loss, and restrict access to only authorized staff. Keeping information up-to-date and accurate ensures you’re making decisions based on current details, and obtaining consent shows you’re processing data with the client’s permission and for legitimate purposes. This combination protects privacy, reduces risk of breaches, and supports clients’ rights over their information.

Options that leave records unsecured—whether in an unlocked drawer or with unrestricted digital access—create clear security risks and violate confidentiality. Sharing records with any staff member who asks also ignores consent and purpose limitation, which data protection rules require.