# Your sector adds its own rules to UK data protection law

Your sector regulator and the data protection regulator can both ask about the same data.

**The short answer.** If you work in health, finance, law or education, two sets of rules apply to you. One is UK data protection law. The other is the rulebook for your sector. The sector rules sit on top of the general ones, and neither replaces the other.

The ICO's guidance says it is an advantage if your data protection officer also knows your industry or sector well (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026). It is a fair question for any outside adviser too: what has the team done in your sector before? The guide to [choosing a data protection adviser](/guides/how-to-choose-a-data-protection-adviser) has more questions.

**The layers of rules on your data**

- Your sector's rules: for example, NHS England's Data Security and Protection Toolkit, which every organisation with access to NHS patient data and systems must use
- Extra protection for sensitive data: special category data, such as health data
- UK data protection law: the UK GDPR, the general rules for using personal data

Your sector's rules sit on top of UK data protection law and add to it.

Source: ICO, special category data, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-is-special-category-data/ (checked 29 September 2026); NHS England Digital, https://digital.nhs.uk/cyber-and-data-security/cyber-security-services/data-security-and-protection-toolkit (checked 29 September 2026)

> "The UK GDPR singles out some types of personal data as likely to be more sensitive, and gives them extra protection"
> The ICO, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-is-special-category-data/ (checked 29 September 2026)

## Health and care: NHS patient data and UK GDPR

UK GDPR gives health data extra protection, and your sector adds more. NHS England says every organisation with access to NHS patient data and systems must use its Data Security and Protection Toolkit (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-is-special-category-data/) and [NHS England Digital](https://digital.nhs.uk/cyber-and-data-security/cyber-security-services/data-security-and-protection-toolkit), checked 29 September 2026).

### Can we use AI on patient data?

You can use AI on patient data, within limits. Under UK GDPR, a machine alone can make a significant decision using health data on two grounds only. One is the person's explicit consent. The other is where a contract needs it or the law allows it, and there is a substantial public interest. Large-scale use of health data also needs a data protection impact assessment ([legislation.gov.uk](https://www.legislation.gov.uk/eur/2016/679/article/22B) and the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/when-do-we-need-to-do-a-dpia/), checked 29 September 2026).

### What rules apply to health data in the US?

In the US, HIPAA applies to many organisations. The HIPAA Privacy Rule is a US federal rule. It applies to health plans, healthcare clearinghouses and every healthcare provider that sends health information electronically in certain transactions (the [CDC](https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html), checked 29 September 2026).

## Financial services: reporting incidents to the UK's FCA

From 18 March 2027, a firm regulated by the UK's Financial Conduct Authority (FCA) may have two regulators to tell after an incident (the [FCA](https://www.fca.org.uk/firms/operational-resilience/reporting-operational-incidents) and the [ICO](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/), checked 29 September 2026).

### Who do we tell if there is a data breach?

You may have to tell two regulators. Under UK GDPR, you must report a breach likely to put people at risk to the UK data protection regulator. Do it without undue delay and, where feasible, within 72 hours. From 18 March 2027, most firms regulated by the UK’s FCA must also report operational incidents, such as cyber attacks, that meet set thresholds (the [ICO](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/) and the [FCA](https://www.fca.org.uk/firms/operational-resilience/reporting-operational-incidents), checked 29 September 2026).

## Law firms in England and Wales: client confidentiality

Solicitors in England and Wales must keep client affairs confidential under the SRA code (the [SRA code](https://www.sra.org.uk/solicitors/standards-regulations/code-conduct-solicitors/) and the [SRA](https://www.sra.org.uk/consumers/what-sra-about), checked 29 September 2026).

## Schools in England: academies and maintained schools need a DPO

In England, maintained schools and academies must have a data protection officer ([GOV.UK](https://www.gov.uk/guidance/data-protection-in-schools/role-of-data-protection-officers), checked 29 September 2026).

## Sector rules on data: what to check first

1. Find the rules your sector adds on data, and who enforces them.
2. Check whether you hold special category data, such as health data, which UK law protects more closely.
3. Plan who you tell after a breach: the UK data protection regulator, and your sector regulator where its rules require it.
4. Check the UK rules on automated decisions before an AI tool makes decisions about people with no human involved.
5. If you bring in outside help, ask for an example of past work in your sector, such as a risk assessment on patient data.

## The 95 providers for this situation

Grouped by type, alphabetical inside each type.

### Advisory firms (54)

- [Accorian (Esha Corporation dba Accorian; Accorian Assurance)](https://theassurancedesk.com/advisers/accorian.md): Advisory firm
- [Actica Consulting Limited](https://theassurancedesk.com/advisers/actica-consulting-limited.md): Advisory firm
- [Aleada Consulting](https://theassurancedesk.com/advisers/aleada-consulting.md): Advisory firm
- [Amethyst Risk Management Limited](https://theassurancedesk.com/advisers/amethyst-risk-management.md): Advisory firm
- [Ametros Group](https://theassurancedesk.com/advisers/ametros-group.md): Advisory firm
- [Anekanta Consulting](https://theassurancedesk.com/advisers/anekanta-consulting.md): Advisory firm
- [Arcanum Cyber Security (Arcanum Information Security Limited)](https://theassurancedesk.com/advisers/arcanum-cyber-security.md): Advisory firm
- [AvISO Consultancy](https://theassurancedesk.com/advisers/aviso-consultancy.md): Advisory firm
- [BABL AI Inc.](https://theassurancedesk.com/advisers/babl-ai.md): Advisory firm
- [BD Emerson LLC](https://theassurancedesk.com/advisers/bd-emerson.md): Advisory firm
- [Bratby Law](https://theassurancedesk.com/advisers/bratby-law.md): Advisory firm
- [Bridewell](https://theassurancedesk.com/advisers/bridewell.md): Advisory firm
- [Bright Defense, LLC](https://theassurancedesk.com/advisers/bright-defense.md): Advisory firm
- [C3IA Solutions Limited](https://theassurancedesk.com/advisers/c3ia-solutions.md): Advisory firm
- [CBIZ Pivot Point Security](https://theassurancedesk.com/advisers/cbiz-pivot-point-security.md): Advisory firm
- [Compass IT Compliance, LLC](https://theassurancedesk.com/advisers/compass-it-compliance.md): Advisory firm
- [Cyber Defense Group](https://theassurancedesk.com/advisers/cyber-defense-group.md): Advisory firm
- [CyPro](https://theassurancedesk.com/advisers/cypro.md): Advisory firm
- [Data Privacy & Security Advisors, LLC (The DPSA)](https://theassurancedesk.com/advisers/data-privacy-security-advisors-dpsa.md): Advisory firm
- [Data Protection People](https://theassurancedesk.com/advisers/data-protection-people.md): Advisory firm
- [DCI Consulting Group, Inc.](https://theassurancedesk.com/advisers/dci-consulting-group.md): Advisory firm
- [Eticas.ai (Algorithmic Auditing Inc., US entity of Eticas Research and Consulting S.L.)](https://theassurancedesk.com/advisers/eticas-ai.md): Advisory firm
- [Fast Data Science](https://theassurancedesk.com/advisers/fast-data-science.md): Advisory firm
- [Forvis Mazars](https://theassurancedesk.com/advisers/forvis-mazars.md): Advisory firm
- [Fractional CISO, LLC](https://theassurancedesk.com/advisers/fractional-ciso.md): Advisory firm
- [GDPR Advisor (PSA Professional Solutions)](https://theassurancedesk.com/advisers/gdpr-advisor.md): Advisory firm
- [Gowling WLG (UK) LLP](https://theassurancedesk.com/advisers/gowling-wlg-uk-llp.md): Advisory firm
- [Handley Gill](https://theassurancedesk.com/advisers/handley-gill.md): Advisory firm
- [HewardMills](https://theassurancedesk.com/advisers/hewardmills.md): Advisory firm
- [Hope & May](https://theassurancedesk.com/advisers/hope-and-may.md): Advisory firm
- [JBW Group International, LLC](https://theassurancedesk.com/advisers/jbw-group-international-llc.md): Advisory firm
- [JVR Consultancy](https://theassurancedesk.com/advisers/jvr-consultancy.md): Advisory firm
- [Kafico](https://theassurancedesk.com/advisers/kafico.md): Advisory firm
- [Kemp IT Law LLP](https://theassurancedesk.com/advisers/kemp-it-law-llp.md): Advisory firm
- [KPMG LLP (UK)](https://theassurancedesk.com/advisers/kpmg-llp-uk.md): Advisory firm
- [Kuma (Kimble and Associates, LLC)](https://theassurancedesk.com/advisers/kuma.md): Advisory firm
- [Logiq Consulting Ltd](https://theassurancedesk.com/advisers/logiq-consulting.md): Advisory firm
- [Meditology Services, LLC](https://theassurancedesk.com/advisers/meditology-services.md): Advisory firm
- [ORCAA (O'Neil Risk Consulting and Algorithmic Auditing, Inc.)](https://theassurancedesk.com/advisers/orcaa.md): Advisory firm
- [PricewaterhouseCoopers LLP (PwC UK)](https://theassurancedesk.com/advisers/pricewaterhousecoopers-llp-uk.md): Advisory firm
- [Privacy Ref, Inc.](https://theassurancedesk.com/advisers/privacy-ref.md): Advisory firm
- [Red Clover Advisors, LLC](https://theassurancedesk.com/advisers/red-clover-advisors.md): Advisory firm
- [Resolution Economics LLC](https://theassurancedesk.com/advisers/resolution-economics.md): Advisory firm
- [Responsible Artificial Intelligence LLC (RAI LLC)](https://theassurancedesk.com/advisers/rai-llc.md): Advisory firm
- [Rhymetec LLC](https://theassurancedesk.com/advisers/rhymetec.md): Advisory firm
- [RightCue Consulting Services Ltd](https://theassurancedesk.com/advisers/rightcue.md): Advisory firm
- [Rocket-Hire LLC](https://theassurancedesk.com/advisers/rocket-hire.md): Advisory firm
- [Securys](https://theassurancedesk.com/advisers/securys.md): Advisory firm
- [Strategic Management Services, LLC](https://theassurancedesk.com/advisers/strategic-management-services.md): Advisory firm
- [The DPO Centre](https://theassurancedesk.com/advisers/dpo-centre.md): Advisory firm
- [URM Consulting](https://theassurancedesk.com/advisers/urm-consulting.md): Advisory firm
- [vCISO Services, LLC](https://theassurancedesk.com/advisers/vciso-services.md): Advisory firm
- [Winston Taylor UK LLP (formerly Taylor Wessing)](https://theassurancedesk.com/advisers/winston-taylor-uk.md): Advisory firm
- [Zaviant (WJS Cyber Consulting, LLC d/b/a Zaviant)](https://theassurancedesk.com/advisers/zaviant.md): Advisory firm

### Certification bodies (23)

- [360 Advanced, Inc.](https://theassurancedesk.com/advisers/360-advanced.md): Certification body
- [A-LIGN Compliance and Security, Inc. (dba A-LIGN)](https://theassurancedesk.com/advisers/a-lign.md): Certification body
- [Amtivo](https://theassurancedesk.com/advisers/amtivo.md): Certification body
- [Aprio, LLP](https://theassurancedesk.com/advisers/aprio-llp.md): Certification body
- [BSI (The British Standards Institution)](https://theassurancedesk.com/advisers/bsi.md): Certification body
- [Bureau Veritas](https://theassurancedesk.com/advisers/bureau-veritas.md): Certification body
- [Centre for Assessment](https://theassurancedesk.com/advisers/centre-for-assessment.md): Certification body
- [Coalfire Certification, Inc.](https://theassurancedesk.com/advisers/coalfire-certification.md): Certification body
- [ControlCase Assessments LLC](https://theassurancedesk.com/advisers/controlcase-assessments.md): Certification body
- [DNV](https://theassurancedesk.com/advisers/dnv.md): Certification body
- [EAGLE Registrations Inc.](https://theassurancedesk.com/advisers/eagle-registrations.md): Certification body
- [Intertek](https://theassurancedesk.com/advisers/intertek.md): Certification body
- [IS Partners, LLC](https://theassurancedesk.com/advisers/is-partners.md): Certification body
- [Kompleye Attestation, LLC](https://theassurancedesk.com/advisers/kompleye-attestation.md): Certification body
- [Linford & Company LLP](https://theassurancedesk.com/advisers/linford-and-company-llp.md): Certification body
- [LRQA](https://theassurancedesk.com/advisers/lrqa.md): Certification body
- [Palindrome Technologies, Inc.](https://theassurancedesk.com/advisers/palindrome-technologies.md): Certification body
- [Peers Quality Assurance Limited (PQAL)](https://theassurancedesk.com/advisers/peers-quality-assurance-pqal.md): Certification body
- [Perry Johnson Registrars, Inc.](https://theassurancedesk.com/advisers/perry-johnson-registrars.md): Certification body
- [RA Cert Ltd](https://theassurancedesk.com/advisers/ra-cert-ltd.md): Certification body
- [Responsible AI Institute (Responsible Artificial Intelligence Institute)](https://theassurancedesk.com/advisers/responsible-ai-institute.md): Certification body
- [Schellman Compliance, LLC](https://theassurancedesk.com/advisers/schellman-compliance.md): Certification body
- [TÜV UK Limited (TÜV NORD Group)](https://theassurancedesk.com/advisers/tuv-uk.md): Certification body

### Software products (18)

- [Advai](https://theassurancedesk.com/advisers/advai.md): Software product
- [Arthur AI](https://theassurancedesk.com/advisers/arthur-ai.md): Software product
- [BigID](https://theassurancedesk.com/advisers/bigid.md): Software product
- [Credo AI](https://theassurancedesk.com/advisers/credo-ai.md): Software product
- [Fiddler AI](https://theassurancedesk.com/advisers/fiddler-ai.md): Software product
- [Hyperproof](https://theassurancedesk.com/advisers/hyperproof.md): Software product
- [IBM watsonx.governance](https://theassurancedesk.com/advisers/ibm-watsonx-governance.md): Software product
- [ISMS.online](https://theassurancedesk.com/advisers/isms-online.md): Software product
- [LogicGate](https://theassurancedesk.com/advisers/logicgate.md): Software product
- [Metomic](https://theassurancedesk.com/advisers/metomic.md): Software product
- [Microsoft Purview](https://theassurancedesk.com/advisers/microsoft-purview.md): Software product
- [Monitaur](https://theassurancedesk.com/advisers/monitaur.md): Software product
- [OneTrust AI Governance](https://theassurancedesk.com/advisers/onetrust-ai-governance.md): Software product
- [Strike Graph](https://theassurancedesk.com/advisers/strike-graph.md): Software product
- [SureCloud](https://theassurancedesk.com/advisers/surecloud.md): Software product
- [Thoropass](https://theassurancedesk.com/advisers/thoropass.md): Software product
- [Trilateral Research](https://theassurancedesk.com/advisers/trilateral-research.md): Software product
- [Trustible](https://theassurancedesk.com/advisers/trustible.md): Software product

## Data protection in regulated sectors: common questions

### Do we need a data protection officer?

UK GDPR requires a data protection officer in three cases. You are a public authority. Your core work tracks people regularly, systematically and at scale. Or it uses health, criminal or other sensitive data at scale (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026).

## Where next

- [After a data breach: what UK law asks of you](https://theassurancedesk.com/best/post-breach.md)
- [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md)
- [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.