Skip to content

Use the compliance hub

Find the data-protection and governance tools in one place, see which you may open, and make the audit pack.

Checked against the screens:

Every organisation can choose its own words for the people and roles it works with. When you are signed in, this guide uses your organisation’s words. Otherwise it uses the product’s own.

The hub is open to managers, admins and the data-protection lead. Each card inside it has its own list of who may use it.

Steps

  1. Open Compliance from the menu. The page is called Statutory governance in one place.
  2. Read the cards. A card you may use is a link with Open on it. A dimmed card tells you who can use it.
  3. Press a card to go to that tool, such as the Audit log or the Retention policy.
  4. For the audit pack, press Safeguarding audit pack. Choose a first day and a last day.
  5. Press Download the pack. A PDF is saved to your downloads.
  6. For a spreadsheet of one area or commissioner, open Manager register.

If it goes wrong

  • If the page says it is for managers, data-protection leads and admins, ask one of them to open it for you.
  • If the pack says the first day is after the last day, swap the two dates round and try again.
  • If the pack could not be made, nothing was downloaded. Wait a minute and try again.

The cards and who may use them

  • Staff training compliance: who is current, due soon, overdue or missing evidence. Managers and admins.
  • Information agreements: data-sharing agreements, signatories and expiry dates. Those allowed to see agreements.
  • SAR queue: subject access requests, with the one-month legal window. Admins.
  • Retention policy: read-only for your organisation. Admins.
  • Restricted children: those flagged as restricted from processing. Admins.
  • Safeguarding deletion requests: a multi-stage approval queue. It needs sign-off from the DSL, the data-protection lead and an admin.
  • Audit log: entries recorded for your organisation. Managers, admins and the data-protection lead.
  • Bulk export and Tenant export (DPA backup): whole-organisation exports. Admins only. The tenant export is kept for seven days, then deleted.
  • Manager register: young people, sessions, attendance and outcomes for one area or commissioner. It leaves out notes and safeguarding detail.

Cards you cannot open

A dimmed card is not an error. It names the roles that can use it. If you need the tool, ask someone in that role.

The safeguarding audit pack

The pack is a PDF for governors and inspectors, set out against Keeping Children Safe in Education. Choose the dates it covers. Making the pack is recorded in the audit log, so it is always clear who made it and when.

Who sees the hub

The page itself is open to managers, admins and the data-protection lead. Someone with another role is told it is not open to them and who to ask.

How it links together

Where the cards leadThe hub links to the tools that keep you within the law.
  1. HubCards by role
  2. ToolAudit, SAR, retention
  3. PackAudit pack PDF
  4. Audit logRecords who did it

The hub holds no data of its own. Each card opens a tool that works on live records, such as staff training, agreements and exports. Making the audit pack is written to the audit log. Exports leave the system, so only the roles shown on a card can use them. See the guide on record quality for gaps in plans.

Questions people ask

Why can't I open the Compliance page?

It is for managers, admins and the data-protection lead. Ask one of them, or ask your admin about your role.

Why is a card dimmed?

Your role cannot use it. The card names who can, so you know who to ask.

How do I make the audit pack?

Press Safeguarding audit pack, choose the first and last day, and press Download the pack.

Is making the pack recorded?

Yes. It is written to the audit log, so there is a trail of who made it.

Does the manager register contain notes?

No. It excludes notes and safeguarding detail, and covers one area or commissioner at a time.

How long does a tenant export last?

It is kept for seven days and then deleted. It is a backup of your whole organisation.