# Do the Caldicott principles apply after a patient dies?

When a relative or an executor asks for a dead person's records, you need to know which rules still protect them.

The Assurance Desk. Published 22 October 2026. Last checked 23 October 2026.

Part of the guide [What is a Caldicott guardian, and who needs one?](https://theassurancedesk.com/guides/caldicott-guardian.md).

**The short answer.** Yes. The UK Caldicott Guardian Council says the Caldicott principles also apply to records and information about people who have died. UK GDPR and the Data Protection Act apply only to living people. The General Medical Council's guidance to doctors says the duty of confidentiality persists after a patient has died. The Information Commissioner's Office says the duty of confidence can apply after the person dies ([UK Caldicott Guardian Council, Information sharing and disclosure](https://www.ukcgc.uk/information-sharing-and-disclosure), [General Medical Council, Disclosing medical records after death](https://www.gmc-uk.org/professional-standards/learning-materials/disclosing-medical-records-after-death) and [ICO, How does section 41 apply to requests for information about deceased people?](https://ico.org.uk/for-organisations/foi/freedom-of-information-and-environmental-information-regulations/section-41-information-provided-in-confidence/how-does-section-41-apply-to-requests-for-information-about-deceased-people/), checked 23 October 2026).

## Do the Caldicott principles apply to the deceased?

Yes, the Caldicott principles apply to the deceased, according to the UK Caldicott Guardian Council. The council says the Data Protection Act and UK GDPR apply only to living people. It says the principles also apply to records and information about people who have died. This is the council's guidance ([UK Caldicott Guardian Council, Information sharing and disclosure](https://www.ukcgc.uk/information-sharing-and-disclosure), checked 23 October 2026).

The General Medical Council's guidance to doctors points the same way. It says the duty of confidentiality persists after a patient has died. This is the council's guidance to doctors, not law ([General Medical Council, Disclosing medical records after death](https://www.gmc-uk.org/professional-standards/learning-materials/disclosing-medical-records-after-death), checked 23 October 2026).

The published principles point the same way. They cover health and social care data where people can be identified and would expect it to be kept private. Principle 6 asks everyone handling confidential information to comply with statute and the common law ([GOV.UK, The Caldicott Principles](https://www.gov.uk/government/publications/the-caldicott-principles), checked 23 October 2026).

The Information Commissioner's Office says the duty of confidence can apply even after the person it was owed to dies ([ICO, How does section 41 apply to requests for information about deceased people?](https://ico.org.uk/for-organisations/foi/freedom-of-information-and-environmental-information-regulations/section-41-information-provided-in-confidence/how-does-section-41-apply-to-requests-for-information-about-deceased-people/), checked 23 October 2026).

So the principles still guide what you do with a dead person's records. Use the minimum information needed. Give access only to people who need to know ([UK Caldicott Guardian Council, Information sharing and disclosure](https://www.ukcgc.uk/information-sharing-and-disclosure) and [GOV.UK, The Caldicott Principles](https://www.gov.uk/government/publications/the-caldicott-principles), checked 23 October 2026).

The National Data Guardian published the current principles on 8 December 2020, and they apply to England ([GOV.UK, The Caldicott Principles](https://www.gov.uk/government/publications/the-caldicott-principles), checked 23 October 2026).

## Does UK GDPR apply to someone who has died?

No, UK GDPR does not apply to someone who has died. Under UK data protection law, personal data is information about living people. So a person cannot make a subject access request for information about someone who has died ([ICO, Subject access request advice](https://ico.org.uk/for-organisations/advice-for-small-organisations/subject-access-requests-sar/subject-access-request-advice/), checked 23 October 2026).

Where medical records are needed on behalf of a person who has died, other laws apply instead ([ICO, Subject access request advice](https://ico.org.uk/for-organisations/advice-for-small-organisations/subject-access-requests-sar/subject-access-request-advice/), checked 23 October 2026).

Data protection law can still matter. A dead person's record may also hold information about a living person, such as a family member. The ICO says the rules on personal information can still be relevant to that part ([ICO, How does section 41 apply to requests for information about deceased people?](https://ico.org.uk/for-organisations/foi/freedom-of-information-and-environmental-information-regulations/section-41-information-provided-in-confidence/how-does-section-41-apply-to-requests-for-information-about-deceased-people/), checked 23 October 2026).

## Who can see a dead patient's health records?

Health records of someone who has died can be seen under the Access to Health Records Act 1990. The UK Caldicott Guardian Council says the Act gives certain people formal rights of access. The General Medical Council says there are circumstances in which doctors must disclose relevant information about a patient who has died ([UK Caldicott Guardian Council, Information sharing and disclosure](https://www.ukcgc.uk/information-sharing-and-disclosure) and [General Medical Council, Disclosing medical records after death](https://www.gmc-uk.org/professional-standards/learning-materials/disclosing-medical-records-after-death), checked 23 October 2026).

Under the Act, an application goes to the holder of the record. Once the patient has died, the patient's personal representative can apply. So can anyone who may have a claim arising out of the death ([legislation.gov.uk, Access to Health Records Act 1990, section 3](https://www.legislation.gov.uk/ukpga/1990/23/section/3), checked 23 October 2026).

A medical examiner acting under section 20 of the Coroners and Justice Act 2009 can also apply. Where a will names an executor, the executor will normally be the personal representative ([legislation.gov.uk, Access to Health Records Act 1990, section 3](https://www.legislation.gov.uk/ukpga/1990/23/section/3) and [ICO, How does section 41 apply to requests for information about deceased people?](https://ico.org.uk/for-organisations/foi/freedom-of-information-and-environmental-information-regulations/section-41-information-provided-in-confidence/how-does-section-41-apply-to-requests-for-information-about-deceased-people/), checked 23 October 2026).

Access has limits, even for the personal representative. When a personal representative or someone with a claim applies, some parts are held back. The record holder does not give access to any part it thinks is not relevant to a claim arising out of the death ([legislation.gov.uk, Access to Health Records Act 1990, section 5](https://www.legislation.gov.uk/ukpga/1990/23/section/5), checked 23 October 2026).

The General Medical Council shows this in a case study. A GP was asked for a dead patient's records for a claim. She was concerned that sending the whole record would disclose confidential information irrelevant to the purpose. She sent the records about the patient's final illness, which was all she believed to be relevant to the claim ([General Medical Council, Disclosing medical records after death](https://www.gmc-uk.org/professional-standards/learning-materials/disclosing-medical-records-after-death), checked 23 October 2026).

The Act does not reach every record. Parts made before it came into force are held back ([legislation.gov.uk, Access to Health Records Act 1990, section 5](https://www.legislation.gov.uk/ukpga/1990/23/section/5), checked 23 October 2026).

Northern Ireland has its own route. The General Medical Council names the Access to Health Records (Northern Ireland) Order 1993. It says the Order gives access to a dead patient's personal representative and anyone with a claim arising out of the death ([General Medical Council, Disclosing medical records after death](https://www.gmc-uk.org/professional-standards/learning-materials/disclosing-medical-records-after-death), checked 23 October 2026).

**What the Access to Health Records Act holds back when a personal representative or someone with a claim applies after a death. The record holder makes these judgments.**

| What the record holds | What happens |
| --- | --- |
| A note, made at the patient's request, that they did not want access given | No access is given |
| Information likely to cause serious harm to someone's physical or mental health | That part is held back |
| Information about, or from, another person who could be identified | That part is held back, unless that person is a health professional involved in the patient's care |
| Information the patient gave expecting it would not be disclosed to the applicant | That part is held back |
| Information not relevant to any claim arising out of the death | That part is held back |
| Parts made before the Act came into force | That part is held back |

Source: legislation.gov.uk, Access to Health Records Act 1990, section 4, https://www.legislation.gov.uk/ukpga/1990/23/section/4 (checked 23 October 2026); legislation.gov.uk, Access to Health Records Act 1990, section 5, https://www.legislation.gov.uk/ukpga/1990/23/section/5 (checked 23 October 2026)

## What about social care records after a death?

Social care records sit outside the Act. The UK Caldicott Guardian Council says no comparable law gives access to the social care records of someone who has died. It says the Caldicott principles may still be applied ([UK Caldicott Guardian Council, Information sharing and disclosure](https://www.ukcgc.uk/information-sharing-and-disclosure), checked 23 October 2026).

These requests are common. The Information Commissioner's Office says the most common requests about people who have died are for their medical or social care records. These requests often come from relatives ([ICO, How does section 41 apply to requests for information about deceased people?](https://ico.org.uk/for-organisations/foi/freedom-of-information-and-environmental-information-regulations/section-41-information-provided-in-confidence/how-does-section-41-apply-to-requests-for-information-about-deceased-people/), checked 23 October 2026).

Records outside the Act can still be confidential, because the duty of confidence can apply after death. In its freedom of information guidance, the ICO says it is enough that the person would have expected the information to be kept private ([ICO, How does section 41 apply to requests for information about deceased people?](https://ico.org.uk/for-organisations/foi/freedom-of-information-and-environmental-information-regulations/section-41-information-provided-in-confidence/how-does-section-41-apply-to-requests-for-information-about-deceased-people/), checked 23 October 2026).

If the person had said they were content for the information to be made public, that can be taken into account. The ICO's confidentiality exemption does not cover the facts usually recorded in a death certificate ([ICO, How does section 41 apply to requests for information about deceased people?](https://ico.org.uk/for-organisations/foi/freedom-of-information-and-environmental-information-regulations/section-41-information-provided-in-confidence/how-does-section-41-apply-to-requests-for-information-about-deceased-people/), checked 23 October 2026).

**Health records and social care records after a death**

- **Health records**
  - The Access to Health Records Act 1990 gives a route to apply
  - A personal representative, someone with a claim arising out of the death, or a medical examiner can apply
  - For a personal representative or claimant, parts not relevant to a claim are held back
  - No fee can be charged
- **Social care records**
  - No comparable law gives access, the UK Caldicott Guardian Council says
  - The Caldicott principles may still be applied
  - The duty of confidence can still apply after death, the ICO says

A summary of the law and guidance cited. In Northern Ireland, the General Medical Council points to the Access to Health Records (Northern Ireland) Order 1993.

Source: UK Caldicott Guardian Council, Information sharing and disclosure, https://www.ukcgc.uk/information-sharing-and-disclosure (checked 23 October 2026); ICO, How does section 41 apply to requests for information about deceased people?, https://ico.org.uk/for-organisations/foi/freedom-of-information-and-environmental-information-regulations/section-41-information-provided-in-confidence/how-does-section-41-apply-to-requests-for-information-about-deceased-people/ (checked 23 October 2026); legislation.gov.uk, Access to Health Records Act 1990, section 3, https://www.legislation.gov.uk/ukpga/1990/23/section/3 (checked 23 October 2026); legislation.gov.uk, Access to Health Records Act 1990, section 5, https://www.legislation.gov.uk/ukpga/1990/23/section/5 (checked 23 October 2026); General Medical Council, Disclosing medical records after death, https://www.gmc-uk.org/professional-standards/learning-materials/disclosing-medical-records-after-death (checked 23 October 2026)

## What should you share with a bereaved family?

Share what is appropriate. After a bereavement, loved ones may need information to help them grieve. The UK Caldicott Guardian Council says Caldicott Guardians should make sure appropriate information is not unnecessarily withheld ([UK Caldicott Guardian Council, Information sharing and disclosure](https://www.ukcgc.uk/information-sharing-and-disclosure), checked 23 October 2026).

The council also says a Caldicott Guardian may decide that information should not be shared, even where the law allows it. The guardian advises on the ethical as well as the legal side, following the Caldicott principles ([UK Caldicott Guardian Council, Information sharing and disclosure](https://www.ukcgc.uk/information-sharing-and-disclosure), checked 23 October 2026).

The council says there may be differing legal opinion on how the law applies in individual cases. The Caldicott principles advise involving a Caldicott Guardian where a novel or difficult judgment is needed ([UK Caldicott Guardian Council, Information sharing and disclosure](https://www.ukcgc.uk/information-sharing-and-disclosure) and [GOV.UK, The Caldicott Principles](https://www.gov.uk/government/publications/the-caldicott-principles), checked 23 October 2026).

Write the decision down. The council says guardians should record the advice they give, the decisions they make and the reasons behind them. A guardian should be able to justify a decision ([UK Caldicott Guardian Council, Information sharing and disclosure](https://www.ukcgc.uk/information-sharing-and-disclosure), checked 23 October 2026).

## What should a care or health provider do with a request?

A care or health provider should first work out which rules apply to the request. A request from a relative is not a subject access request. For medical records, check whether the person asking has a right of access under the Access to Health Records Act 1990 ([ICO, Subject access request advice](https://ico.org.uk/for-organisations/advice-for-small-organisations/subject-access-requests-sar/subject-access-request-advice/) and [ICO, How does section 41 apply to requests for information about deceased people?](https://ico.org.uk/for-organisations/foi/freedom-of-information-and-environmental-information-regulations/section-41-information-provided-in-confidence/how-does-section-41-apply-to-requests-for-information-about-deceased-people/), checked 23 October 2026).

You have 21 days to give access if every part of the record was made in the 40 days before the application. In any other case you have 40 days ([legislation.gov.uk, Access to Health Records Act 1990, section 3](https://www.legislation.gov.uk/ukpga/1990/23/section/3), checked 23 October 2026).

If you need more information to deal with the application, ask for it within 14 days. No fee can be charged for giving access ([legislation.gov.uk, Access to Health Records Act 1990, section 3](https://www.legislation.gov.uk/ukpga/1990/23/section/3), checked 23 October 2026).

If the applicant asks, you supply a copy. Where terms in the record cannot be understood without explanation, you explain them ([legislation.gov.uk, Access to Health Records Act 1990, section 3](https://www.legislation.gov.uk/ukpga/1990/23/section/3), checked 23 October 2026).

**Handling a request for a dead person's records**

1. Check it is not a subject access request: UK data protection law covers living people only
2. Check what kind of record it is: The Access to Health Records Act 1990 covers medical records; no comparable law covers social care records
3. Check who is asking: A personal representative, someone with a claim arising out of the death, or a medical examiner
4. Ask for anything missing: Ask within 14 days
5. Check for the patient's note: A note asking that no access be given means no access
6. Hold back what the Act excludes: For a personal representative or someone with a claim, only parts relevant to a claim
7. Reply in time, with no fee: 21 days for a record made in the last 40 days, otherwise 40 days
8. Involve the Caldicott Guardian and record the decision: For a novel or difficult judgment, with the reasons written down

A general order of checks, based on the law and guidance cited. It is information, not advice on a particular request.

Source: ICO, Subject access request advice, https://ico.org.uk/for-organisations/advice-for-small-organisations/subject-access-requests-sar/subject-access-request-advice/ (checked 23 October 2026); UK Caldicott Guardian Council, Information sharing and disclosure, https://www.ukcgc.uk/information-sharing-and-disclosure (checked 23 October 2026); legislation.gov.uk, Access to Health Records Act 1990, section 3, https://www.legislation.gov.uk/ukpga/1990/23/section/3 (checked 23 October 2026); legislation.gov.uk, Access to Health Records Act 1990, section 4, https://www.legislation.gov.uk/ukpga/1990/23/section/4 (checked 23 October 2026); legislation.gov.uk, Access to Health Records Act 1990, section 5, https://www.legislation.gov.uk/ukpga/1990/23/section/5 (checked 23 October 2026); GOV.UK, The Caldicott Principles, https://www.gov.uk/government/publications/the-caldicott-principles (checked 23 October 2026)

## What to do

1. Do not treat a relative's request as a subject access request, because UK data protection law does not cover people who have died ([ICO, Subject access request advice](https://ico.org.uk/for-organisations/advice-for-small-organisations/subject-access-requests-sar/subject-access-request-advice/), checked 23 October 2026).
2. Apply the Caldicott principles to the records of people who have died, as the UK Caldicott Guardian Council advises, and keep them confidential ([UK Caldicott Guardian Council, Information sharing and disclosure](https://www.ukcgc.uk/information-sharing-and-disclosure) and [General Medical Council, Disclosing medical records after death](https://www.gmc-uk.org/professional-standards/learning-materials/disclosing-medical-records-after-death), checked 23 October 2026).
3. Check who is asking for medical records: the personal representative, a medical examiner, or someone with a claim arising out of the death ([legislation.gov.uk, Access to Health Records Act 1990, section 3](https://www.legislation.gov.uk/ukpga/1990/23/section/3), checked 23 October 2026).
4. Hold back parts that would cause serious harm, identify another person, or are not relevant to a claim ([legislation.gov.uk, Access to Health Records Act 1990, section 5](https://www.legislation.gov.uk/ukpga/1990/23/section/5), checked 23 October 2026).
5. Reply within 21 or 40 days, depending on when the record was made, and charge no fee ([legislation.gov.uk, Access to Health Records Act 1990, section 3](https://www.legislation.gov.uk/ukpga/1990/23/section/3), checked 23 October 2026).
6. Involve your Caldicott Guardian for a novel or difficult decision, and record the advice, the decision and the reasons ([GOV.UK, The Caldicott Principles](https://www.gov.uk/government/publications/the-caldicott-principles) and [UK Caldicott Guardian Council, Information sharing and disclosure](https://www.ukcgc.uk/information-sharing-and-disclosure), checked 23 October 2026).

## Common questions

### Can a relative make a subject access request for a dead parent's records?

No. A subject access request cannot be made for information about someone who has died. Where medical records are needed, other laws apply instead ([ICO, Subject access request advice](https://ico.org.uk/for-organisations/advice-for-small-organisations/subject-access-requests-sar/subject-access-request-advice/), checked 23 October 2026).

### Can a family see a dead relative's social care records?

There is no comparable law to the Access to Health Records Act 1990 for social care records, the UK Caldicott Guardian Council says. It says guardians should make sure appropriate information is not unnecessarily withheld from loved ones after a bereavement ([UK Caldicott Guardian Council, Information sharing and disclosure](https://www.ukcgc.uk/information-sharing-and-disclosure), checked 23 October 2026).

### Can you charge for access to a dead patient's records?

No. Under the Access to Health Records Act 1990, no fee can be charged for giving access ([legislation.gov.uk, Access to Health Records Act 1990, section 3](https://www.legislation.gov.uk/ukpga/1990/23/section/3) and [ICO, How does section 41 apply to requests for information about deceased people?](https://ico.org.uk/for-organisations/foi/freedom-of-information-and-environmental-information-regulations/section-41-information-provided-in-confidence/how-does-section-41-apply-to-requests-for-information-about-deceased-people/), checked 23 October 2026).

### What applies in Northern Ireland?

Northern Ireland has its own route. The General Medical Council says the Access to Health Records (Northern Ireland) Order 1993 gives access to a dead patient's personal representative and anyone with a claim arising out of the death ([General Medical Council, Disclosing medical records after death](https://www.gmc-uk.org/professional-standards/learning-materials/disclosing-medical-records-after-death), checked 23 October 2026).

## Where next

- [Regulated sectors](https://theassurancedesk.com/best/sector-regulated.md)
- [DSAR: what to do when a subject access request arrives](https://theassurancedesk.com/guides/subject-access-request-what-to-do.md)
- [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md)
- [What are the UK GDPR principles? All seven, in plain English](https://theassurancedesk.com/guides/uk-gdpr-seven-principles.md)
- [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md)

## Sources

- UK Caldicott Guardian Council, Information sharing and disclosure: https://www.ukcgc.uk/information-sharing-and-disclosure (checked 23 October 2026)
- General Medical Council, Disclosing medical records after death: https://www.gmc-uk.org/professional-standards/learning-materials/disclosing-medical-records-after-death (checked 23 October 2026)
- ICO, How does section 41 apply to requests for information about deceased people?: https://ico.org.uk/for-organisations/foi/freedom-of-information-and-environmental-information-regulations/section-41-information-provided-in-confidence/how-does-section-41-apply-to-requests-for-information-about-deceased-people/ (checked 23 October 2026)
- GOV.UK, The Caldicott Principles: https://www.gov.uk/government/publications/the-caldicott-principles (checked 23 October 2026)
- ICO, Subject access request advice: https://ico.org.uk/for-organisations/advice-for-small-organisations/subject-access-requests-sar/subject-access-request-advice/ (checked 23 October 2026)
- legislation.gov.uk, Access to Health Records Act 1990, section 3: https://www.legislation.gov.uk/ukpga/1990/23/section/3 (checked 23 October 2026)
- legislation.gov.uk, Access to Health Records Act 1990, section 5: https://www.legislation.gov.uk/ukpga/1990/23/section/5 (checked 23 October 2026)
- legislation.gov.uk, Access to Health Records Act 1990, section 4: https://www.legislation.gov.uk/ukpga/1990/23/section/4 (checked 23 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.