# What is a Caldicott guardian, and who needs one? If you run or advise a health or care service, this person weighs how confidential information about the people you care for is used. The Assurance Desk. Published 22 October 2026. Last checked 22 October 2026. **The short answer.** A Caldicott guardian is a senior person who protects the confidentiality of health and care information. They weigh the ethics and law of sharing it. NHS organisations and councils with adult social care duties have long been required to have one. In England, the National Data Guardian's 2021 guidance also expects other public health and care bodies to have one. So do organisations those bodies contract to deliver care ([GOV.UK, National Data Guardian guidance on the appointment of Caldicott Guardians, their role and responsibilities](https://www.gov.uk/government/publications/national-data-guardian-guidance-on-the-appointment-of-caldicott-guardians-their-role-and-responsibilities), [GOV.UK, NDG announces new Caldicott Principle and guidance on Caldicott Guardians](https://www.gov.uk/government/news/ndg-announces-new-caldicott-principle-and-guidance-on-caldicott-guardians) and [GOV.UK, Caring about social care](https://www.gov.uk/government/news/caring-about-social-care), checked 22 October 2026). ## In this series - [Do the Caldicott principles apply after a patient dies?](https://theassurancedesk.com/guides/caldicott-principles-deceased.md) - [What is the DSPT, and does your organisation have to complete it?](https://theassurancedesk.com/guides/dspt-data-security-and-protection-toolkit.md) ## What does a Caldicott guardian do? A Caldicott guardian protects the confidentiality of people's information by considering the ethical and legal sides of each data sharing decision. The role is often called the conscience of the organisation ([GOV.UK, National Data Guardian guidance on the appointment of Caldicott Guardians, their role and responsibilities](https://www.gov.uk/government/publications/national-data-guardian-guidance-on-the-appointment-of-caldicott-guardians-their-role-and-responsibilities) and [GOV.UK, Why Caldicott Principles and Caldicott Guardians are still relevant in 2020](https://www.gov.uk/government/news/why-caldicott-principles-and-caldicott-guardians-are-still-relevant-in-2020), checked 22 October 2026). The Caldicott Principles say to involve the guardian when a new or difficult judgment about confidential information is needed. In practice, guardians are often asked to untangle complicated sharing questions under pressure ([GOV.UK, The Caldicott Principles](https://www.gov.uk/government/publications/the-caldicott-principles) and [GOV.UK, In praise of the UK Caldicott Guardian Council and Caldicott Guardians](https://www.gov.uk/government/news/in-praise-of-the-uk-caldicott-guardian-council-and-caldicott-guardians), checked 22 October 2026). The questions run both ways. Some staff worry about sharing too much. Others come to the guardian anxious about sharing information that they think does need to be shared ([GOV.UK, In praise of the UK Caldicott Guardian Council and Caldicott Guardians](https://www.gov.uk/government/news/in-praise-of-the-uk-caldicott-guardian-council-and-caldicott-guardians), checked 22 October 2026). Many guardians are clinicians or care providers themselves. For social care, the National Data Guardian says the guardian should know the social care setting and be available to frontline staff ([GOV.UK, Why Caldicott Principles and Caldicott Guardians are still relevant in 2020](https://www.gov.uk/government/news/why-caldicott-principles-and-caldicott-guardians-are-still-relevant-in-2020) and [GOV.UK, Caring about social care](https://www.gov.uk/government/news/caring-about-social-care), checked 22 October 2026). The idea dates from a 1997 review, which recommended a senior person, preferably a health professional, as guardian in each health organisation. In December 2020 there were over 18,000 Caldicott guardians in post ([GOV.UK, NDG announces new Caldicott Principle and guidance on Caldicott Guardians](https://www.gov.uk/government/news/ndg-announces-new-caldicott-principle-and-guidance-on-caldicott-guardians), checked 22 October 2026). ## Who must have a Caldicott guardian? Before the 2021 guidance, only NHS organisations and local authorities were required to have a Caldicott guardian. Local authorities with adult social care duties have been required to have one since 2002 ([GOV.UK, National Data Guardian guidance on the appointment of Caldicott Guardians, their role and responsibilities](https://www.gov.uk/government/publications/national-data-guardian-guidance-on-the-appointment-of-caldicott-guardians-their-role-and-responsibilities), [GOV.UK, NDG announces new Caldicott Principle and guidance on Caldicott Guardians](https://www.gov.uk/government/news/ndg-announces-new-caldicott-principle-and-guidance-on-caldicott-guardians) and [GOV.UK, Caring about social care](https://www.gov.uk/government/news/caring-about-social-care), checked 22 October 2026). The National Data Guardian's 2021 guidance widened that group in England. It covers public bodies in the health service, adult social care or adult carer support. It applies where they handle confidential information about patients or service users ([GOV.UK, National Data Guardian guidance on the appointment of Caldicott Guardians, their role and responsibilities](https://www.gov.uk/government/publications/national-data-guardian-guidance-on-the-appointment-of-caldicott-guardians-their-role-and-responsibilities) and [GOV.UK, Caring about social care](https://www.gov.uk/government/news/caring-about-social-care), checked 22 October 2026). It also covers organisations contracted by those public bodies to deliver health or adult social care. A care home, GP practice or clinic that delivers care under such a contract falls within that description ([GOV.UK, National Data Guardian guidance on the appointment of Caldicott Guardians, their role and responsibilities](https://www.gov.uk/government/publications/national-data-guardian-guidance-on-the-appointment-of-caldicott-guardians-their-role-and-responsibilities), checked 22 October 2026). Organisations in scope must give the guidance due regard. It is issued under the Health and Social Care (National Data Guardian) Act 2018. The National Data Guardian later said it encouraged, but did not mandate, every organisation to have or have access to a guardian ([GOV.UK, National Data Guardian guidance on the appointment of Caldicott Guardians, their role and responsibilities](https://www.gov.uk/government/publications/national-data-guardian-guidance-on-the-appointment-of-caldicott-guardians-their-role-and-responsibilities) and [GOV.UK, Caring about social care](https://www.gov.uk/government/news/caring-about-social-care), checked 22 October 2026). Organisations were encouraged to comply by 30 June 2023, including putting their guardian on the Caldicott Guardian Register. An organisation that completes the Data Security and Protection Toolkit gives its guardian's details in its annual submission ([GOV.UK, National Data Guardian guidance on the appointment of Caldicott Guardians, their role and responsibilities](https://www.gov.uk/government/publications/national-data-guardian-guidance-on-the-appointment-of-caldicott-guardians-their-role-and-responsibilities), checked 22 October 2026). **Who is expected to have a Caldicott guardian in England, by type of organisation. The 2021 guidance asks for regard, not a legal duty on every organisation.** | Organisation | Position | | --- | --- | | NHS organisations | Required before the 2021 guidance | | Local authorities with adult social care duties | Required since 2002 | | Public bodies in health, adult social care or adult carer support | In scope of the 2021 guidance | | Organisations contracted by those bodies to deliver health or adult social care | In scope of the 2021 guidance | | Prisons, police and the armed forces | Some appoint one by choice | Source: GOV.UK, National Data Guardian guidance on the appointment of Caldicott Guardians, their role and responsibilities, https://www.gov.uk/government/publications/national-data-guardian-guidance-on-the-appointment-of-caldicott-guardians-their-role-and-responsibilities (checked 22 October 2026); GOV.UK, NDG announces new Caldicott Principle and guidance on Caldicott Guardians, https://www.gov.uk/government/news/ndg-announces-new-caldicott-principle-and-guidance-on-caldicott-guardians (checked 22 October 2026); GOV.UK, Why Caldicott Principles and Caldicott Guardians are still relevant in 2020, https://www.gov.uk/government/news/why-caldicott-principles-and-caldicott-guardians-are-still-relevant-in-2020 (checked 22 October 2026); GOV.UK, Caring about social care, https://www.gov.uk/government/news/caring-about-social-care (checked 22 October 2026) ## What if a small care provider cannot appoint its own guardian? If appointing one of your own staff is not proportionate or feasible, the guidance says to arrange the function another way. That might mean sharing a guardian, or arranging for your commissioning organisation to provide it ([GOV.UK, Caring about social care](https://www.gov.uk/government/news/caring-about-social-care), checked 22 October 2026). The guidance also allows for an organisation that chooses not to appoint one. The National Data Guardian has said it is not about giving someone the title to tick a box. Some social care organisations, especially small ones, have raised concerns about how feasible the guidance is ([GOV.UK, Caring about social care](https://www.gov.uk/government/news/caring-about-social-care), checked 22 October 2026). The role can also be bought in. The Assurance Desk recorded Hope & May's services from its website on 16 July 2026. The list included an outsourced Caldicott Guardian service ([The Assurance Desk, Hope & May profile](https://theassurancedesk.com/advisers/hope-and-may), checked 22 October 2026). Help is free. The UK Caldicott Guardian Council is the national body for guardians and offers practical resources and a way to ask for advice. Its elearning, The Role of the Caldicott Guardian, is free for NHS health and care organisations, and others may qualify through OpenAthens ([GOV.UK, In praise of the UK Caldicott Guardian Council and Caldicott Guardians](https://www.gov.uk/government/news/in-praise-of-the-uk-caldicott-guardian-council-and-caldicott-guardians), checked 22 October 2026). ## What are the eight Caldicott Principles? The National Data Guardian published the current Caldicott Principles on 8 December 2020, for England. They cover health and social care data where people can be identified and would expect privacy ([GOV.UK, The Caldicott Principles](https://www.gov.uk/government/publications/the-caldicott-principles), checked 22 October 2026). There were six principles in 1997, and a seventh came in 2013. The December 2020 set has eight. An older list with fewer than eight predates the current set ([GOV.UK, NDG announces new Caldicott Principle and guidance on Caldicott Guardians](https://www.gov.uk/government/news/ndg-announces-new-caldicott-principle-and-guidance-on-caldicott-guardians), checked 22 October 2026). The eighth principle was added in 2020. It asks you to consider and inform patient and service user expectations when you use confidential information, so there are no surprises ([GOV.UK, The Caldicott Principles](https://www.gov.uk/government/publications/the-caldicott-principles) and [GOV.UK, NDG announces new Caldicott Principle and guidance on Caldicott Guardians](https://www.gov.uk/government/news/ndg-announces-new-caldicott-principle-and-guidance-on-caldicott-guardians), checked 22 October 2026). As a minimum, that means accessible, relevant and appropriate information. Some uses need more engagement. The National Data Guardian does not intend the principle to be a legal basis on its own ([GOV.UK, The Caldicott Principles](https://www.gov.uk/government/publications/the-caldicott-principles) and [GOV.UK, NDG announces new Caldicott Principle and guidance on Caldicott Guardians](https://www.gov.uk/government/news/ndg-announces-new-caldicott-principle-and-guidance-on-caldicott-guardians), checked 22 October 2026). **The eight Caldicott Principles, December 2020, in plain words. The official wording is longer.** | Principle | In plain words | | --- | --- | | 1. Justify the purpose | Define, check and write down every use or transfer of confidential information | | 2. Use it only when necessary | Leave confidential information out unless the purpose needs it | | 3. Use the minimum | Justify each item, so only the minimum is used | | 4. Need to know | Only people who need the information see it, and only the parts they need | | 5. Know your responsibilities | Everyone with access understands their duty of confidentiality | | 6. Comply with the law | Every use must be lawful, under statute and the common law | | 7. Share for individual care | The duty to share for a person's care is as important as the duty to protect confidentiality | | 8. Inform patients and service users | No surprises: people know how and why their information is used, and their choices | Source: GOV.UK, The Caldicott Principles, https://www.gov.uk/government/publications/the-caldicott-principles (checked 22 October 2026); GOV.UK, NDG announces new Caldicott Principle and guidance on Caldicott Guardians, https://www.gov.uk/government/news/ndg-announces-new-caldicott-principle-and-guidance-on-caldicott-guardians (checked 22 October 2026) ## Is a Caldicott guardian the same as a DPO? A Caldicott guardian and a data protection officer (DPO) are different roles. Under UK GDPR, a public authority or body must appoint a DPO ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 22 October 2026). So must an organisation whose core activities are large scale processing of special category data. The Information Commissioner's Office gives a health insurer handling many people's health information as an example ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 22 October 2026). A DPO monitors compliance, advises on data protection duties and impact assessments, and is a contact point for individuals. The DPO must be independent and report to the highest management level ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 22 October 2026). The National Data Guardian describes the guardian as complementing the DPO and the senior information risk owner. Those roles make sure the law and the technical protections are right. The guardian brings a different focus ([GOV.UK, No surprises](https://www.gov.uk/government/speeches/no-surprises) and [GOV.UK, Why Caldicott Principles and Caldicott Guardians are still relevant in 2020](https://www.gov.uk/government/news/why-caldicott-principles-and-caldicott-guardians-are-still-relevant-in-2020), checked 22 October 2026). **Caldicott guardian and data protection officer compared** - **Caldicott guardian** - Weighs the ethics and law of sharing confidential health and care information - Involved when a new or difficult decision is needed - Expected under National Data Guardian guidance in England - **Data protection officer** - Required by UK GDPR for public authorities and some large scale processing - Monitors compliance and advises on data protection duties - Must be independent and report to the highest management level The roles work side by side. Whether one person can hold both depends on the conflict of interests test. Source: GOV.UK, National Data Guardian guidance on the appointment of Caldicott Guardians, their role and responsibilities, https://www.gov.uk/government/publications/national-data-guardian-guidance-on-the-appointment-of-caldicott-guardians-their-role-and-responsibilities (checked 22 October 2026); GOV.UK, The Caldicott Principles, https://www.gov.uk/government/publications/the-caldicott-principles (checked 22 October 2026); ICO, Data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 22 October 2026) ## Can the DPO also be the Caldicott guardian? The DPO can also be the Caldicott guardian only if holding both jobs causes no conflict of interests. The Information Commissioner's Office lets a DPO take on other tasks on that condition ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 22 October 2026). A DPO cannot hold a position that decides why and how personal data is used. An existing employee can be the DPO if their other duties are compatible ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 22 October 2026). So the test is whether your guardian decides those things, or advises on them. The National Data Guardian pages we read do not say whether one person can hold both roles. Several organisations can share one DPO, as small providers can share a guardian ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/) and [GOV.UK, Caring about social care](https://www.gov.uk/government/news/caring-about-social-care), checked 22 October 2026). ## What to do 1. Check whether you are a public health or adult social care body in England, or are contracted by one to deliver care ([GOV.UK, National Data Guardian guidance on the appointment of Caldicott Guardians, their role and responsibilities](https://www.gov.uk/government/publications/national-data-guardian-guidance-on-the-appointment-of-caldicott-guardians-their-role-and-responsibilities), checked 22 October 2026). 2. If appointing your own staff member is not proportionate, arrange the function another way, such as a shared guardian ([GOV.UK, Caring about social care](https://www.gov.uk/government/news/caring-about-social-care), checked 22 October 2026). 3. Put your guardian's details on the Caldicott Guardian Register, and in your Data Security and Protection Toolkit submission if you complete one ([GOV.UK, National Data Guardian guidance on the appointment of Caldicott Guardians, their role and responsibilities](https://www.gov.uk/government/publications/national-data-guardian-guidance-on-the-appointment-of-caldicott-guardians-their-role-and-responsibilities), checked 22 October 2026). 4. Check the information you give patients and service users against the eighth principle, so nothing comes as a surprise ([GOV.UK, The Caldicott Principles](https://www.gov.uk/government/publications/the-caldicott-principles), checked 22 October 2026). 5. If one person will hold both roles, check the guardian's duties against the conflict of interests test for DPOs ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 22 October 2026). ## Common questions ### How many Caldicott Principles are there? Eight. The National Data Guardian published the revised and expanded set of 8 in December 2020 ([GOV.UK, NDG announces new Caldicott Principle and guidance on Caldicott Guardians](https://www.gov.uk/government/news/ndg-announces-new-caldicott-principle-and-guidance-on-caldicott-guardians), checked 22 October 2026). ### Is having a Caldicott guardian a legal requirement? Organisations in scope must give the 2021 guidance due regard. The National Data Guardian has said it encouraged, but did not mandate, every organisation to have or have access to a guardian ([GOV.UK, National Data Guardian guidance on the appointment of Caldicott Guardians, their role and responsibilities](https://www.gov.uk/government/publications/national-data-guardian-guidance-on-the-appointment-of-caldicott-guardians-their-role-and-responsibilities) and [GOV.UK, Caring about social care](https://www.gov.uk/government/news/caring-about-social-care), checked 22 October 2026). ## Where next - [Regulated sectors](https://theassurancedesk.com/best/sector-regulated.md) - [First DPO or AI policy](https://theassurancedesk.com/best/first-appointment.md) - [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md) - [Can your IT manager be your DPO?](https://theassurancedesk.com/guides/can-your-it-manager-be-your-dpo.md) - [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md) - [What are the UK GDPR principles? All seven, in plain English](https://theassurancedesk.com/guides/uk-gdpr-seven-principles.md) - [Outsourced DPO: how do you choose one in the UK?](https://theassurancedesk.com/guides/how-to-find-an-outsourced-dpo.md) ## Sources - GOV.UK, National Data Guardian guidance on the appointment of Caldicott Guardians, their role and responsibilities: https://www.gov.uk/government/publications/national-data-guardian-guidance-on-the-appointment-of-caldicott-guardians-their-role-and-responsibilities (checked 22 October 2026) - GOV.UK, NDG announces new Caldicott Principle and guidance on Caldicott Guardians: https://www.gov.uk/government/news/ndg-announces-new-caldicott-principle-and-guidance-on-caldicott-guardians (checked 22 October 2026) - GOV.UK, Caring about social care: https://www.gov.uk/government/news/caring-about-social-care (checked 22 October 2026) - GOV.UK, Why Caldicott Principles and Caldicott Guardians are still relevant in 2020: https://www.gov.uk/government/news/why-caldicott-principles-and-caldicott-guardians-are-still-relevant-in-2020 (checked 22 October 2026) - GOV.UK, The Caldicott Principles: https://www.gov.uk/government/publications/the-caldicott-principles (checked 22 October 2026) - GOV.UK, In praise of the UK Caldicott Guardian Council and Caldicott Guardians: https://www.gov.uk/government/news/in-praise-of-the-uk-caldicott-guardian-council-and-caldicott-guardians (checked 22 October 2026) - The Assurance Desk, Hope & May profile: https://theassurancedesk.com/advisers/hope-and-may (checked 22 October 2026) - ICO, Data protection officers: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 22 October 2026) - GOV.UK, No surprises: https://www.gov.uk/government/speeches/no-surprises (checked 22 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.