What is a Caldicott guardian, and who needs one?

What does a Caldicott guardian do?

A Caldicott guardian protects the confidentiality of people's information by considering the ethical and legal sides of each data sharing decision. The role is often called the conscience of the organisation.

The Caldicott Principles say to involve the guardian when a new or difficult judgment about confidential information is needed. In practice, guardians are often asked to untangle complicated sharing questions under pressure.

The questions run both ways. Some staff worry about sharing too much. Others come to the guardian anxious about sharing information that they think does need to be shared.

Many guardians are clinicians or care providers themselves. For social care, the National Data Guardian says the guardian should know the social care setting and be available to frontline staff.

The idea dates from a 1997 review, which recommended a senior person, preferably a health professional, as guardian in each health organisation. In December 2020 there were over 18,000 Caldicott guardians in post.

Who must have a Caldicott guardian?

Before the 2021 guidance, only NHS organisations and local authorities were required to have a Caldicott guardian. Local authorities with adult social care duties have been required to have one since 2002.

The National Data Guardian's 2021 guidance widened that group in England. It covers public bodies in the health service, adult social care or adult carer support. It applies where they handle confidential information about patients or service users.

It also covers organisations contracted by those public bodies to deliver health or adult social care. A care home, GP practice or clinic that delivers care under such a contract falls within that description.

Organisations in scope must give the guidance due regard. It is issued under the Health and Social Care (National Data Guardian) Act 2018. The National Data Guardian later said it encouraged, but did not mandate, every organisation to have or have access to a guardian.

Organisations were encouraged to comply by 30 June 2023, including putting their guardian on the Caldicott Guardian Register. An organisation that completes the Data Security and Protection Toolkit gives its guardian's details in its annual submission.

What if a small care provider cannot appoint its own guardian?

If appointing one of your own staff is not proportionate or feasible, the guidance says to arrange the function another way. That might mean sharing a guardian, or arranging for your commissioning organisation to provide it.

The guidance also allows for an organisation that chooses not to appoint one. The National Data Guardian has said it is not about giving someone the title to tick a box. Some social care organisations, especially small ones, have raised concerns about how feasible the guidance is.

The role can also be bought in. The Assurance Desk recorded Hope & May's services from its website on 16 July 2026. The list included an outsourced Caldicott Guardian service.

Help is free. The UK Caldicott Guardian Council is the national body for guardians and offers practical resources and a way to ask for advice. Its elearning, The Role of the Caldicott Guardian, is free for NHS health and care organisations, and others may qualify through OpenAthens.

What are the eight Caldicott Principles?

The National Data Guardian published the current Caldicott Principles on 8 December 2020, for England. They cover health and social care data where people can be identified and would expect privacy.

There were six principles in 1997, and a seventh came in 2013. The December 2020 set has eight. An older list with fewer than eight predates the current set.

The eighth principle was added in 2020. It asks you to consider and inform patient and service user expectations when you use confidential information, so there are no surprises.

As a minimum, that means accessible, relevant and appropriate information. Some uses need more engagement. The National Data Guardian does not intend the principle to be a legal basis on its own.

Is a Caldicott guardian the same as a DPO?

A Caldicott guardian and a data protection officer (DPO) are different roles. Under UK GDPR, a public authority or body must appoint a DPO.

So must an organisation whose core activities are large scale processing of special category data. The Information Commissioner's Office gives a health insurer handling many people's health information as an example.

A DPO monitors compliance, advises on data protection duties and impact assessments, and is a contact point for individuals. The DPO must be independent and report to the highest management level.

The National Data Guardian describes the guardian as complementing the DPO and the senior information risk owner. Those roles make sure the law and the technical protections are right. The guardian brings a different focus.

Can the DPO also be the Caldicott guardian?

The DPO can also be the Caldicott guardian only if holding both jobs causes no conflict of interests. The Information Commissioner's Office lets a DPO take on other tasks on that condition.

A DPO cannot hold a position that decides why and how personal data is used. An existing employee can be the DPO if their other duties are compatible.

So the test is whether your guardian decides those things, or advises on them. The National Data Guardian pages we read do not say whether one person can hold both roles.

Several organisations can share one DPO, as small providers can share a guardian.

What to do

1. Check whether you are a public health or adult social care body in England, or are contracted by one to deliver care.
2. If appointing your own staff member is not proportionate, arrange the function another way, such as a shared guardian.
3. Put your guardian's details on the Caldicott Guardian Register, and in your Data Security and Protection Toolkit submission if you complete one.
4. Check the information you give patients and service users against the eighth principle, so nothing comes as a surprise.
5. If one person will hold both roles, check the guardian's duties against the conflict of interests test for DPOs.

Common questions

How many Caldicott Principles are there?

Eight. The National Data Guardian published the revised and expanded set of 8 in December 2020.

Is having a Caldicott guardian a legal requirement?

Organisations in scope must give the 2021 guidance due regard. The National Data Guardian has said it encouraged, but did not mandate, every organisation to have or have access to a guardian.

Where next

• Regulated sectors
• First DPO or AI policy
• Do you need a data protection officer? UK GDPR sets three tests
• Can your IT manager be your DPO?
• Who is a data controller, and who is a processor?
• What are the UK GDPR principles? All seven, in plain English
• Outsourced DPO: how do you choose one in the UK?

This is an independent editorial guide, not legal advice.