Transformation Directorate

This guidance has been reviewed by the Health and Care Information Governance Panel, including the Information Commissioner’s Office (ICO) and National Data Guardian (NDG).

The panel exists to simplify information governance guidance. Have we done a good job? Let us know at

Preparing for the UK COVID-19 Inquiry

COVID-19 Inquiry

The government has set up the independent public UK COVID-19 Inquiry to examine the UK’s preparedness and response to the Covid pandemic, and to learn lessons for the future. The official inquiry website provides a reliable source of updated information.

Visit the COVID-19 Inquiry website for all the key information related to the inquiry, including:

NHS England has established an inquiry team to support colleagues and oversee the response to and co-operation with the inquiry on behalf of NHS England. The team will lead solely on managing the relationship of NHS England with the public inquiry and not that of the wider health and care sector. NHS England cannot provide detailed advice, instructions, or guidance to other health and care organisations on how they should respond or provide evidence to the Inquiry. NHS organisations are welcome to visit the NHS Futures COVID-19 Inquiry workspace for further information and materials.

This guidance does not constitute legal advice. It is for each individual organisation to ensure they are appropriately prepared to respond to any request from the inquiry and seek independent legal advice where required.

The NHS Transformation Digital Policy Unit, a joint unit of NHS England and the Department for Health and Social Care, has developed FAQs to support the wider health and social care system to prepare for the COVID-19 Inquiry.

FAQs – preparing for the COVID-19 Inquiry

How do I find out about the COVID-19 Inquiry?

Visit the UK COVID-19 Inquiry website for key information and documents relating to the inquiry including updates, reports, notices and letters about the inquiry leads, public consultation, terms of reference and requests for records retention.

Will all health and care organisations need to respond to the COVID-19 Inquiry?

This will be decided by the chair of the inquiry and her team. However, it is unlikely that every health and care organisation will be required to participate.

The inquiry chair will be supported by a statutory inquiry team which, working under the direction of the chair, will determine the structure of the inquiry, and develop policies and processes. The chair will have broad legal powers to seek evidence and information and determine how that must be provided, by whom, when and in what format. If organisations are required to supply evidence, that will be a matter for them to address directly with the statutory inquiry team.

What should health and care organisations be doing to prepare?

Organisations may want to consider:

  • identifying inquiry leads and points of contact
  • identifying information of potential relevance and ensuring it is not destroyed.
  • keeping track of any senior staff / key individuals who are leaving the organisation: maintain contact details and ensure records are transferred before they leave
  • ensuring teams across your organisation are managing all records including emails, texts, WhatsApp messages, Microsoft Teams messages, logbooks and other formats so they are securely saved and are retrievable
  • following local records management policies and processes.
What support is available for the wider health and care system and individual organisations?

Health and care organisations can visit the UK COVID-19 Inquiry website for updated information. Any specific information governance (IG) related questions can be directed to the IG policy team in the NHS Transformation Digital Policy Unit at

Could I see an example document preservation notice?

There is a document preservation notice (sometimes called a ‘legal hold’ or ‘stop notice’) that has been used within NHS England. Please note that we are not instructing other organisations to use this notice, but it may be a helpful resource and can be adapted as needed.

Can we have a list of prompt questions for relevant leavers?

Organisations are advised to continue to follow your own local staff leaver and exit process for staff leavers responsible for managing records of potential relevance to the inquiry. Any questions will need to be drafted by the organisation as they will relate to the role of that individual in the Covid response.

Should we continue to answer freedom of information (FOI) and subject access requests (SAR) which relate to the inquiry?

Information relating to the COVID-19 Inquiry is not necessarily exempt from FOI requests or SARs and blanket exemptions, for example not responding to a request due to the inquiry, are not appropriate. You will need to consider any request received, on a case by case basis, and decide whether any exemptions apply in line with your usual FOI and SAR processes.

If I provide information in response to a formal request from the inquiry, will I breach UK general data protection regulations (GDPR) or confidentiality?

Section 21 of the Inquiries Act provides an inquiry with powers to issue a notice to require any person to attend or request any information that the chair sees as relevant.

If you receive one of these notices you must comply or explain to the chair why you cannot comply; for example, if you do not hold the requested information. The chair will then decide whether to maintain, revoke or vary the notice. It is a criminal offence under section 35 to not comply with an information request without good cause or reason, or to deliberately withhold, alter, distort, or destroy evidence relevant to an inquiry.

Responding to a formal request for information from the inquiry does not breach UK GDPR. The legal bases for processing personal information are:

  • Article 6 (1) (c) legal obligation, in this case compliance with a notice made under section 21 of the Inquiries Act 2005
  • Article 9 (2) (g) substantial public interest on the basis of law, to meet the statutory functions of the Inquiry

With regard to confidentiality, the Inquiries Act 2005 establishes a statutory obligation for health and care organisations to disclose relevant information to the chair of an inquiry when requested. This overrides the duty of confidentiality, allowing the disclosure to take place lawfully.

You should also make sure that your transparency materials cover information that is shared for the purposes of inquiries.

If I provide information in response to an informal request from the inquiry (that is to say, not a request made under Section 21 Inquiries Act), will I breach UK GDPR or confidentiality?

If you receive an informal request for information from the inquiry the legal bases under UK GDPR for processing personal data are:

  • Article 6 (1) (e) – public task
  • Article 9 (2) (g) – substantial public interest on the basis of law to meet the statutory functions of the Inquiry.

Confidential patient information and employee records (for example, HR records) are subject to a duty of confidentiality. An informal request will not override the duty of confidentiality. Therefore, information will either need to be provided in an effectively de-identified format (for example to provide an aggregated dataset showing numbers of inpatients by age, sex and ethnicity), or a formal section 21 request will need to be made by the inquiry for confidential information.

Many of the documents of interest to the inquiry, in particular internal working documents and communications, may not contain any confidential patient or employee data so you can provide these to the inquiry if requested.

You must only provide the specific information requested by the inquiry.

Will retaining information for the purpose of the inquiry breach UK GDPR or the common law duty of confidentiality?

No, you must retain information that is in scope of the inquiry, as set out in the terms of reference. You can rely upon UK GDPR:

  • Article 6 (1) (c) – compliance with a legal obligation (section 35 of the Inquiries Act 2005).
  • Article 6 (1) (e) – public task or official authority.
  • Article 9 (2) (g) – substantial public interest on the basis of law to meet the statutory functions of the inquiry.

The common law duty of confidentiality does not impose limits on records retention.

How should we evidence decisions made during the pandemic and ensure records are available for the inquiry?

Follow your local records management policy and ensure you work closely with your local records management team to ensure all records are identified and securely saved and are retrievable.

COVID-19 Inquiry