What Are the Eight Caldicott Principles?

The Caldicott Principles help health and social care organisations use confidential information responsibly. They support appropriate information sharing as well as confidentiality, recognising that relevant information can be essential for safe individual care.

The principles are not a substitute for law, professional guidance or local policy. A disclosure decision may involve data protection law, the common law duty of confidentiality and sector-specific rules. This article provides an educational overview, not legal advice. Staff should refer unusual, disputed or high-risk cases to their Caldicott Guardian, Data Protection Officer (DPO), information governance team or legal adviser.

What are the Caldicott Principles?

The eight principles provide a framework for deciding whether confidential information should be used or shared, what information is necessary and who should have access. The National Data Guardian principles apply across health and social care in England. They are also influential elsewhere in the UK, although legal and organisational arrangements vary by nation.

1. Justify the purpose or purposes for using confidential information.
2. Use confidential information only when it is necessary.
3. Use the minimum necessary confidential information.
4. Access to confidential information should be on a strict need-to-know basis.
5. Everyone with access to confidential information should be aware of their responsibilities.
6. Comply with the law.
7. The duty to share information for individual care is as important as the duty to protect confidentiality.
8. Inform patients and service users about how their confidential information is used.

These principles concern confidential information in any format, including electronic records, paper files, photographs and spoken information. Their purpose is not to prevent every disclosure. Instead, they help organisations make justified, lawful, necessary and proportionate decisions.

How have the Caldicott Principles evolved?

The original 1997 Caldicott review examined how patient-identifiable information was used in the NHS and established six principles. Dame Fiona Caldicott chaired that review.

A second review in 2013 added Principle 7. It clarified that sharing relevant information for individual care can be as important as protecting confidentiality. This addressed the risk that fear or misunderstanding could prevent appropriate information sharing.

In December 2020, the National Data Guardian revised the existing seven principles and added Principle 8. The eighth principle strengthened the expectation that patients and service users should be informed about how their confidential information is used.

Who is a Caldicott Guardian?

A Caldicott Guardian is a senior person who helps an organisation protect confidentiality while enabling appropriate information use and sharing. The role requires sufficient authority to influence organisational decisions, alongside sound judgement and knowledge of confidentiality and information governance.

The National Data Guardian’s Caldicott Guardian appointment guidance explains which organisations should appoint a Guardian and describes the role and responsibilities. A Guardian should be able to provide independent advice and challenge decisions when necessary. Relevant frontline health or social care experience is preferable because it helps the Guardian understand how information decisions affect care. Professional registration may be valuable in many organisations, but it is not a universal qualification for every Guardian.

The Guardian commonly advises senior leaders, contributes to policies, supports staff and considers complex or novel information-sharing questions. The Guardian does not personally approve every routine use of information and does not replace the DPO. The DPO has distinct responsibilities under data protection law, while the Guardian concentrates particularly on confidentiality and appropriate information sharing.

The Caldicott Principles explained

Principle 1: Justify the purpose

Every proposed use or transfer of confidential information should have a clear purpose. An organisation should document why the information is needed, review continuing uses regularly and avoid collecting information merely because it might become useful.

A justified purpose may relate to individual care, managing health or social care services, approved research, safeguarding or another lawful public-interest function. Benefit to the person is important in direct care, but it is not the only possible justification recognised by the principles.

Principle 2: Use confidential information only when necessary

Before using identifiable confidential information, consider whether the purpose could be achieved with anonymous information or another less intrusive approach. If identifiable information is genuinely necessary, staff should be able to explain why.

Anonymisation must be effective in context. Removing a name alone may not be sufficient if other details could identify the person when combined. Pseudonymised information is different from anonymous information because it may still be possible to reconnect the data to an individual.

Principle 3: Use the minimum necessary information

Only the information required for the defined purpose should be used or disclosed. Consider both the content and the number of people whose records are involved.

For example, a service evaluation may need age bands and broad outcomes, but not names, full dates of birth or complete clinical histories. Data minimisation lowers privacy risk while preserving useful information.

Principle 4: Apply strict need-to-know access

Access should be limited to people who need the information for their role and the particular task. Technical permissions, secure working practices and checks on inappropriate access all support this principle.

Seniority alone does not create a need to know. Equally, a professional involved in a person’s care may need prompt access to relevant information to provide safe care.

Related care skills, including accurate recording and assessment, also depend on understanding professional boundaries. See types of observation in health and social care for a wider introduction.

Principle 5: Understand responsibilities

Everyone handling confidential information must understand their personal responsibilities. Organisations should support this through induction, role-specific training, clear policies, secure systems and routes for reporting incidents or asking for advice.

This responsibility covers conversations as well as records. Discussing identifiable information where unauthorised people can overhear it may breach confidentiality. Staff should also follow approved procedures for remote working, email, messaging, printing, storage and disposal.

Principle 6: Comply with the law

Compliance involves several overlapping duties. Processing personal data generally requires a lawful basis under Article 6 of the UK GDPR. Because health data is special-category data, processing also normally requires an Article 9 condition and compliance with relevant provisions of the Data Protection Act 2018. The ICO’s special-category data guidance explains these additional protections.

The legal framework has also been updated by the Data (Use and Access) Act 2025. The 2025 Act amends the UK GDPR and the Data Protection Act 2018 rather than replacing them. Accordingly, organisations should apply the UK GDPR and Data Protection Act 2018 as amended, alongside confidentiality, human rights, professional and sector-specific duties. The ICO’s DUAA guidance for organisations explains the changes and their commencement.

One relevant change concerns recognised legitimate interests, which can provide an Article 6 route for certain specified purposes when its statutory conditions are met. This does not create a general permission to disclose health information. Special-category requirements, the common law duty of confidentiality and any applicable professional rules still need separate consideration.

A data protection basis does not automatically remove the separate common law duty of confidentiality. Confidential patient information will usually require consent, a legal requirement or power, a direct-care justification consistent with reasonable expectations, or a properly assessed public-interest justification. The ICO lawful basis guidance explains the data protection part of that assessment.

The Human Rights Act 1998 also protects private life. Particular health-sector provisions may apply, including statutory routes governing specified uses of confidential patient information. The Freedom of Information Act 2000 concerns access to information held by public authorities, but personal information is subject to exemptions and is not automatically disclosed in response to a request.

The Data Protection Act 1998 and its references to Schedules 2 and 3 are obsolete. That Act was repealed and must not be used as the current framework. Current decisions should be based on the UK GDPR and Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, together with every other applicable legal and professional duty.

Principle 7: Sharing for individual care matters

Staff should not withhold relevant information needed for safe individual care simply because they fear sharing anything confidential. Information sharing should still be lawful, necessary, proportionate and limited to people involved in the care or support.

This principle does not create unrestricted permission to disclose. It particularly addresses individual care, while other uses such as research, planning or service management require their own justification and safeguards.

Principle 8: Inform patients and service users

People should receive clear and accessible information about how their confidential information is used, who it may be shared with and what choices or rights are available. Organisations should avoid unexpected uses and provide more specific information where a use would not reasonably be anticipated.

Transparency may be limited in exceptional circumstances, such as where legislation restricts notification or giving notice would create a serious risk. Such decisions need a documented basis rather than a general assumption.

A practical information-sharing checklist

The following mechanism helps staff pause and test a proposed use or disclosure. It does not replace local policy or professional advice.

1. Define the purpose. State precisely what the recipient needs to achieve. Avoid vague aims such as “just in case”.
2. Identify the information. Separate information that is necessary from information that is merely interesting or convenient.
3. Consider less intrusive options. Decide whether anonymous, aggregated or pseudonymised information could meet the purpose.
4. Check authority and identity. Confirm who is requesting the information, their role and whether they are authorised to receive it.
5. Assess confidentiality. Consider consent, reasonable expectations, direct-care necessity, a legal requirement or power, and any compelling public-interest justification.
6. Check current data protection grounds. Identify the Article 6 lawful basis, the Article 9 condition for health data and any applicable requirement under the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025. Do not assume a new or amended lawful basis settles confidentiality.
7. Minimise and secure. Share only what is needed through an appropriate secure channel.
8. Inform the person where appropriate. Explain the use unless a lawful and properly justified reason prevents this.
9. Record the decision. Note the request, factors considered, information disclosed, recipient, authority and decision-maker.
10. Escalate uncertainty. Ask the Caldicott Guardian, DPO, information governance lead or legal adviser before acting where the case is novel, disputed or high risk.

Worked example: a police request

Suppose a police officer asks a GP practice for a person’s address and recent appointment information. The fact that the request comes from the police does not automatically authorise disclosure. Equally, the police do not need a court order in every possible circumstance.

The practice should verify the requester’s identity, ask what information is sought and why, and identify any cited statutory requirement or power. It should then consider consent, the common law duty of confidentiality, an Article 6 lawful basis, the Article 9 requirements for health data, relevant provisions of the Data Protection Act 2018 as amended, necessity and proportionality. The Data (Use and Access) Act 2025 does not create a blanket police-access entitlement or remove those separate checks.

If no legal requirement applies, disclosure might still be justifiable in the public interest, such as to prevent serious harm, but that requires a careful, case-specific assessment. Suspicion of an offence by itself is not a universal disclosure rule. If disclosure is justified, only necessary information should be shared securely and the reasoning should be recorded.

The GMC confidentiality guidance illustrates the careful professional assessment expected of doctors. Other professionals should follow current guidance from their own regulator.

Urgency may affect how quickly a decision must be made, but it does not remove the need to consider authority, necessity and proportionality. Where time permits, staff should seek advice before disclosing. If immediate action is required to address a serious risk, they should record what was known, why they acted and what information they shared.

Consent, direct care and other uses

Consent may support disclosure, but it is not the only possible route. For direct care, relevant confidential information can often be shared among professionals involved in care where this is consistent with the person’s reasonable expectations and applicable guidance. Staff should still respect objections unless an overriding legal or public-interest reason applies.

Secondary uses, including research, commissioning, service planning and audit, need separate consideration. Anonymous information should be used where it can achieve the purpose. Pseudonymised information remains personal data where someone can reconnect it to an individual using additional information.

Consent under the common law duty of confidentiality and consent as a UK GDPR lawful basis are related but distinct concepts. An organisation might rely on a different UK GDPR lawful basis while still needing to satisfy confidentiality through consent, statutory authority or public interest. This distinction is one reason complex cases need specialist input.

Common mistakes to avoid

A common mistake is treating confidentiality as a reason never to share. That may obstruct safe care. The opposite mistake is assuming that a professional role, public body or urgent-sounding request automatically permits access. Neither approach reflects the principles.

Organisations should also avoid collecting complete records when a limited extract will do, reusing information for a new purpose without assessment, relying on implied consent outside its proper context, or sending information before checking the recipient. Good decision-making connects the purpose, legal authority, confidentiality justification, minimum necessary information and secure method of transfer.

Another error is using data protection terminology without completing the separate confidentiality analysis. An Article 6 basis and Article 9 condition address data protection requirements, but they do not by themselves settle whether confidential information may be disclosed. The same remains true after the 2025 amendments. Staff must consider all applicable duties together.

Frequently asked questions

Do the Caldicott Principles apply after someone dies?

UK data protection legislation generally protects living individuals, so it does not apply to information about a deceased person in the same way. However, professional and common law duties of confidentiality can continue after death. Disclosure should therefore be assessed according to the circumstances, applicable law, professional guidance and the interests of others who may be identifiable in the record.

Does every disclosure require consent?

No. Information may sometimes be used or disclosed because it is necessary for direct care, required by law, supported by a statutory power or justified in the public interest. The correct route depends on the circumstances. Consent should not be requested as a formality where a person has no meaningful choice.

Is any disclosure a confidentiality breach?

No. An authorised and properly justified disclosure is not necessarily a breach. A breach can occur when information is accessed, used, lost or disclosed without appropriate authority or safeguards, or when more information is shared than necessary.

Are the Caldicott Principles the same as data protection law?

No. The Caldicott Principles are an information governance framework for health and social care. The UK GDPR and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, impose legal requirements. The 2025 Act updates the existing framework rather than replacing it. Organisations must apply the principles alongside current data protection law, confidentiality duties, human rights obligations, professional standards and relevant sector rules.

Did the Data (Use and Access) Act 2025 replace the UK GDPR?

No. The Act made changes to the UK GDPR, the Data Protection Act 2018 and related legislation. References to the UK GDPR and Data Protection Act 2018 therefore remain relevant, but they must be read in their amended form. Organisations should check current ICO guidance and commencement information rather than relying on older summaries.

Can information be shared to prevent harm?

Sometimes. A legal requirement or a sufficiently strong public-interest justification may permit or require disclosure. The seriousness and likelihood of harm, the connection between disclosure and prevention, the amount of information involved and possible alternatives all matter. Staff should escalate difficult cases unless urgent action is necessary.

Who should make a difficult disclosure decision?

Responsibility depends on the organisation, role and circumstances. Staff should follow local procedures and seek support from the Caldicott Guardian, DPO, information governance team, safeguarding lead or legal adviser as appropriate. Escalation is especially important when the facts are disputed, the purpose is unusual or the potential impact is serious.

Conclusion

The Caldicott Principles support a balanced approach to confidential health and social care information. They require organisations to define the purpose, establish necessity, minimise information, control access, train staff, comply with the law, enable appropriate sharing for individual care and remain transparent with people.

They do not provide automatic answers to every disclosure request. Sound decisions combine the eight principles with the UK GDPR and Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, the common law duty of confidentiality, professional guidance, local policy and documented judgement. Where the answer is uncertain, obtaining appropriate advice before disclosure is an important safeguard.

This guide is published by the Lead Academy editorial team as an educational summary based on current primary guidance. It does not imply professional review and should not be used as a substitute for organisation-specific information governance or legal advice.

What to Read Next:

• How to Become a Mental Health Support Worker in the UK
• How to Become a Social Worker in the UK: Routes, Registration and Skills
• Why Do You Want to Be a Carer? 20 Interview Questions and Answers
• What Is the Most Difficult Part of Care Work? 20 Common Challenges
• What Is the Most Enjoyable Part of Care Work?
• Environmental Factors That Affect Child Development
• Child Development Theorists Cheat Sheet – Everything you Need to Know