The Caldicott Principles: What They Mean in a Care Service

The Caldicott principles are eight rules for handling confidential information about the people you care for. They are not data protection law. They sit alongside it, and they answer a question the law leaves open: when should you share, not just when may you.

There are eight principles. The eighth was added in the version published on 8 December 2020.

The eight Caldicott principles, one by one

1. Justify the purpose. Every proposed use or transfer of confidential information should be clearly defined, scrutinised and documented. If you cannot say why, do not do it.

2. Use it only when necessary. Confidential information should not be included unless it is necessary for the purpose.

3. Use the minimum necessary. Where using confidential information is necessary, each item must be justified on its own.

4. Strict need-to-know access. Only those who need access to confidential information should have it.

5. Everyone must know their responsibilities. Anyone handling confidential information must understand what is expected of them.

6. Comply with the law. Every use of confidential information must be lawful.

7. For someone's own care, sharing matters as much as protecting. The official wording is that the duty to share information for individual care is as important as the duty to protect patient confidentiality. Staff should share in the person's best interests, with confidence.

8. No surprises. Tell people how their confidential information is used.

Principle 7 is the one that changes behaviour. Most services train staff to be careful. Fewer train them that holding information back can be the failure. A safeguarding concern that nobody passed on is the classic example.

Who needs a Caldicott Guardian

A Caldicott Guardian is a named senior person responsible for protecting the confidentiality of people's information and for enabling appropriate sharing.

Government has recommended since 2002 that local authorities with social services responsibilities appoint one, and since 1999 for NHS trusts. The National Data Guardian, the government adviser on how health and care data is used, then widened things in guidance issued in 2021.

Two groups have a statutory duty to have regard to that guidance. First, public bodies in health, adult social care or adult carer support in England that handle confidential information about patients or service users. Second, anyone the NHS or a council pays to deliver that care, including private and charity providers.

If you are in the second group, the duty covers your publicly funded work only.

The guidance adds two practical points. The function can be outsourced. And where appointing your own staff member is not proportionate or feasible, you should arrange for the function to be provided another way.

So, concretely:

• You take council or NHS funded placements. The duty applies to that work. You should have a Caldicott Guardian.

• Every resident is self-funding and you hold no public contract. The statutory duty does not reach you. The guidance says plainly that nothing stops you appointing one anyway, and it names purely private care providers as an example.

• Either way, two things can still require one: completing the Data Security and Protection Toolkit, or a contract that says you must have one.

Most homes are mixed. That is why the guidance suggests the Guardian covers all your confidential information, not only the publicly funded part.

Where services slip

The principles are simple to agree with and easy to break. None of the slips below come from official guidance; they are the ones we see most in adult social care:

• The handover book. Full names and conditions, left on an open desk. That fails principle 4.

• The group chat. Staff sharing updates on a personal messaging app. That fails principles 4 and 6 at once.

• The full file. Sending an entire care plan when the district nurse asked about one wound. That fails principles 2 and 3.

• The silence. Not passing on a safeguarding concern because "it is confidential". That fails principle 7.

• The unexplained. Nobody has told the person or their family how their information is used. That fails principle 8.

One worked example

The district nurse rings about a pressure sore on Mrs A's heel. You send the wound care section and the current dressing plan, not the whole care plan. You note in the daily record what you sent, to whom, and why.

That is principles 2, 3 and 7 in a single phone call. Share what is needed for her care, and nothing beyond it.

What your confidentiality and information sharing policy must say

A policy that lists the eight principles and stops there gives staff nothing to act on. Make yours answer these:

1. Name your Caldicott Guardian, or state how the function is provided if it is arranged another way.

2. Say who may see what. Set out access by role, not by seniority.

3. Say who decides. Name who judges whether information should be shared, and who to ask out of hours.

4. Spell out principle 7. Include one worked example where sharing was the right call.

5. Name the approved channels. State which systems and apps may carry confidential information, and which may not.

6. Say what you tell people. Where your privacy information lives and when it is given, which covers principle 8.

7. Cover requests from families, police and the local authority, with the checks staff must make first.

8. Link the breach route. What staff do in the first hour if information goes astray.

Our guide to care home policies and procedures sets out the structure your policies need, and CQC statutory notifications covers the events you must tell CQC about, which sometimes follow an information incident.

How this looks in an inspection

CQC publishes no Caldicott checklist, so what follows is our view, not guidance. An inspector is more likely to watch than to ask. Can a care worker say who their Caldicott Guardian is? Is the handover sheet face down? Did the safeguarding referral include what the social worker needed on the first call? The policy is your evidence that you taught this. What staff do on shift is the evidence that it landed.

Where HeroDocs fits

HeroDocs keeps your confidentiality and information sharing policy in one place, with its owner, version and review date. You can send it to your team for sign-off and keep a timestamped record of who has read it, which is exactly the evidence principle 5 asks for.

Sources

• National Data Guardian, The Caldicott Principles, published 8 December 2020.

• National Data Guardian, Guidance on the appointment of Caldicott Guardians, their role and responsibilities.

• UK Caldicott Guardian Council, guidance FAQs.

Last checked: 26 September 2026.

---