The terminology, explained.

The independent regulator of health and adult social care in England. CQC registers, monitors, assesses and inspects services within its remit and can take enforcement action.

A structured assessment of how proposed personal data use could affect people and how to reduce the risks. A DPIA is required where processing is likely to result in a high risk to individuals.

An online assessment used to evidence data security and protection arrangements in health and care. The applicable requirements depend on the organisation's category, circumstances and assessment year.

The requirement to act openly and transparently with people receiving care. Regulation 20 also sets specific steps when a notifiable safety incident occurs, including information, an apology and written follow-up.

Information used to support a finding about a service. It can include people's experiences, staff feedback, observations, records and outcomes; its relevance, reliability and date all matter.

The opportunity to identify factual errors or incomplete evidence in a draft CQC report. A clear response links each proposed correction to the relevant passage and evidence from the assessment period.

The questions CQC uses to organise its assessment of services: are they safe, effective, caring, responsive and well-led? These provide a structure for considering the quality of care.

The core requirements below which care must not fall, covering matters such as person-centred care, dignity, consent, safety, staffing, governance and candour. Which detailed provisions apply depends on the service.

An independent, sampled review that explores how a service might evidence its quality and compliance. It produces findings and improvement priorities; it cannot award a CQC rating or guarantee an assessment outcome.

The person an organisational provider identifies to supervise the management of its regulated activities. This role is distinct from the role of a registered manager.

A formal notice communicating a registration decision by CQC. The decision, its legal basis and the notice determine the available appeal route and when action must be taken.

A formal notice explaining a registration decision CQC proposes to make, such as imposing a condition or cancelling registration. It provides a route for representations before the proposed decision is made.

Information relating to an identified or identifiable living person. Removing a name does not necessarily make information anonymous if the person can still be identified.

Information requested by CQC from relevant providers about their service, what is working well and what they plan to improve. Answers should be accurate, specific and supported by evidence.

A statement within CQC's assessment framework describing a commitment expected of providers, commissioners or system leaders. Quality statements sit under the five key questions and connect to relevant regulations.

CQC's route for considering whether it failed to follow its process when deciding a rating. A request needs to identify the alleged process error and meet the applicable submission requirements.

An individual registered with CQC to manage specified regulated activities. Whether a registered manager is required depends on the provider's circumstances and registration conditions.

The individual, partnership or organisation registered with CQC to carry on specified regulated activities. Identifying the correct legal provider is an important part of registration.

An activity defined in the registration regulations, such as personal care or treatment of disease, disorder or injury. The service's actual activities and any applicable exceptions determine its registration requirements.

The good governance requirement in the 2014 regulated activities regulations. It covers effective systems for quality, safety, risk, records, feedback and improvement.

The visiting and accompanying requirement applying to relevant care home, hospital and hospice settings. Its detailed requirements and exceptions must be considered for the particular service and circumstances.

Personal data given additional protection under UK GDPR, including information about health. Its use requires an appropriate Article 9 condition as well as a lawful basis under Article 6.

A required description of a provider's aims, services, locations and the people it intends to support. It should accurately reflect the service and be kept up to date.

A report to CQC required by the registration regulations when a specified event or change occurs. The responsible person, timing and reporting route depend on the particular notification duty.

A formal CQC notice identifying a failure to meet a requirement and specifying the required compliance timescale. Its compliance date and the deadline for representations are separate matters.