The Eight Caldicott Principles and the Guardian: No Duty to Appoint

There is no statutory duty to appoint a Caldicott Guardian. There is a statutory duty to have regard to guidance that recommends you appoint one — which is a different obligation, and one most organisations describe incorrectly.

Getting that distinction right matters, because the way you comply with a duty to have regard is not the way you comply with a duty to do something.

The eight principles

The National Data Guardian published the current set in December 2020, adding an eighth about informing patients. Verbatim:

1. Justify the purpose or purposes for using confidential information. "Every proposed use or transfer of confidential information should be clearly defined, scrutinised and documented, with continuing uses regularly reviewed by an appropriate guardian."

2. Use confidential information only when it is necessary. "Confidential information should not be included unless it is necessary for the specified purpose(s) for which the information is used or accessed. The need to identify individuals should be considered at each stage of satisfying the purpose(s) and alternatives used where possible."

3. Use the minimum necessary confidential information. "Where use of confidential information is considered to be necessary, each item of information must be justified so that only the minimum amount of confidential information is included as necessary for a given function."

4. Access to confidential information should be on a strict need-to-know basis. "Only those who need access to confidential information should have access to it, and then only to the items that they need to see. This may mean introducing access controls or splitting information flows where one flow is used for several purposes."

5. Everyone with access to confidential information should be aware of their responsibilities. "Action should be taken to ensure that all those handling confidential information understand their responsibilities and obligations to respect the confidentiality of patient and service users."

6. Comply with the law. "Every use of confidential information must be lawful. All those handling confidential information are responsible for ensuring that their use of and access to that information complies with legal requirements set out in statute and under the common law."

7. The duty to share information for individual care is as important as the duty to protect patient confidentiality. "Health and social care professionals should have the confidence to share confidential information in the best interests of patients and service users within the framework set out by these principles. They should be supported by the policies of their employers, regulators and professional bodies."

8. Inform patients and service users about how their confidential information is used. "A range of steps should be taken to ensure no surprises for patients and service users, so they can have clear expectations about how and why their confidential information is used, and what choices they have about this."

Principle 5 is a training obligation in disguise

Read principle 5 again. "Action should be taken to ensure that all those handling confidential information understand their responsibilities." That is a training duty expressed as a confidentiality principle, and it is the principle every information governance course should be mapped against.

Principle 7 is the one most often forgotten, and it exists because the original six principles were read as discouraging sharing. The duty to share for individual care is stated as being as important as the duty to protect — and staff should be supported by their employer's policies in doing so. If your confidentiality training teaches caution without teaching when to share, it is teaching half the framework.

Two scope points worth knowing. The principles apply to information used within health and social care organisations and when shared between organisations and individuals, and to all data collected for providing services where people can be identified and would expect privacy. And: "In some instances, the principles should also be applied to the processing of staff information."

The Guardian: a duty to have regard, not a duty to appoint

The National Data Guardian issued guidance on appointing Caldicott Guardians in August 2021, at version 1.0, and that remains current. Its own statement of status is precise:

The guidance is issued under section 1(2) of the Health and Social Care (National Data Guardian) Act 2018, which empowers the National Data Guardian to provide guidance about processing health and adult social care data in England. "The Act requires that certain organisations and persons must have regard to such guidance, to the extent that it is relevant to their functions or activities."

And then the appointment itself: the National Data Guardian "recommends" that the organisations who must have regard to the guidance "should" appoint a Caldicott Guardian.

So the chain is: statutory duty to have regard to guidance which recommends appointment. Not a statutory duty to appoint.

What "having regard" actually requires of you

This is the part that answers how you evidence it, and the guidance spells it out. Organisations in scope "should be able to show that: they are aware of the guidance and, they have taken it into account when making a decision to which the guidance is relevant and, if they have decided to depart from the guidance, they have good reasons for doing so."

Three evidenceable things: awareness, consideration, and a recorded reason for any departure. That is a documentation task, not a recruitment task — and a small provider that has genuinely considered the guidance and recorded why it has not appointed a Guardian is in a better position than one that has appointed somebody and cannot explain the decision.

Who is in scope of the statutory duty

Two categories. Public bodies exercising functions relating to the health service, adult social care or adult carer support in England that process confidential information about patients or service users. And other persons or organisations providing services as part of the publicly funded health service, adult social care, or adult carer support under arrangements with such a public body, and processing that information.

The second limb carries an important restriction: for organisations that are not public bodies, "the duty to have regard to this guidance applies ... only in relation to work that is publicly funded."

Purely private providers are not in scope. Nor are police, prisons, universities or suppliers — though the guidance notes there is nothing preventing them appointing a Guardian. If you run a wholly self-funded care home, the statutory duty does not reach you, and that is worth knowing before you buy a compliance product that says it does.

Registration, and the DSPT connection

The National Data Guardian expects organisations subject to the duty to comply, "including by registering the details of their Caldicott Guardian(s) on the Caldicott Guardian Register." Compliance was recommended by 30 June 2023.

And where an organisation completes the Data Security and Protection Toolkit, the Toolkit requires details of the Caldicott Guardian as part of the annual submission. That is the practical enforcement route — not the National Data Guardian, which "does not hold any regulatory function or enforcement powers," although it works closely with and may make referrals to bodies that do, such as CQC.

So the realistic position is that the Toolkit is where this gets checked. Our guide to information governance training and the DSPT covers the submission requirements and which track applies to you, and our guide to the DSPT deadline covers the mechanics.

Training the Guardian

One provision that is routinely ignored. The guidance states at section 8.5: "Organisations should provide their Caldicott Guardian with access to training and continuous professional development that is appropriate to the individual and the organisation. The organisation should, where necessary, set aside time and resource for this purpose."

In most organisations the Caldicott Guardian role is held alongside a substantive clinical or executive post, and the time and resource sentence is the one that never makes it into the job description. If you are appointing a Guardian, that provision is the thing to negotiate at the point of appointment rather than afterwards.

One further line worth having in your policy: "Where a novel and/or difficult judgment or decision is required, it is advisable to involve a Caldicott Guardian." That is the trigger for escalation, and it belongs in your information sharing procedure rather than only in the Guardian's own terms of reference.

What to do

Map your information governance training against principle 5 and check it teaches principle 7 as well as principles 1 to 4 — most courses are strong on minimisation and weak on the duty to share. Establish whether you are in scope of the statutory duty, remembering the publicly-funded restriction for non-public bodies. If you are, register your Guardian and keep the record. If you are not, record that you considered the guidance and why you concluded it does not apply. And if you have a Guardian, check they have the training time the guidance says they should.