The Caldicott principles provide a practical framework for protecting confidential information in health and social care while allowing it to be used and shared appropriately. They are particularly important because professionals often need access to sensitive information to provide safe, coordinated care, yet patients and service users reasonably expect that information about them will remain private.
Quick Overview
The Caldicott Principles help health and social care organisations protect confidential information while ensuring it is used and shared appropriately.
This guide covers:
✅ What the Caldicott Principles are
✅ The 8 Caldicott Principles and their purpose
✅ Confidential and patient-identifiable information
✅ Who the principles apply to
✅ The role of a Caldicott Guardian
✅ Appropriate information sharing and confidentiality
✅ The relationship between the Caldicott Principles, UK GDPR and data protection law
There are currently 8 Caldicott principles. Together, they help organisations decide why confidential information is required, whether identifying an individual is necessary, how much information should be used, who needs access and when sharing is appropriate.
Understanding the Caldicott Principles
A useful Caldicott principles definition is that they are eight good-practice principles for the responsible use, protection and sharing of confidential health and social care information.
The purpose of Caldicott principles is not simply to stop information from being disclosed. Health and social care frequently depends on appropriate communication between professionals. The principles are designed to prevent unnecessary or excessive use of confidential information while avoiding unreasonable barriers to sharing information that is genuinely needed.
This balance is central to Caldicott principles confidentiality. It is also an important part of Caldicott principles information governance, which covers how information is collected, accessed, used, shared, secured and explained to the people it concerns.
What Is Patient-Identifiable and Confidential Information?
Confidential information may directly identify a person or make them identifiable when combined with other information.
Examples can include:
- a name, address or NHS number;
- diagnoses and medical history;
- prescriptions and treatment details;
- laboratory or test results;
- mental health information;
- care plans and social care assessments;
- information about disabilities or support needs; and
- identifiable photographs, recordings or correspondence.
Removing a patient’s name does not necessarily make information anonymous. A combination of details such as age, location, medical condition and treatment provider may still identify the person.
Pseudonymised information is also different from truly anonymised information. Pseudonymisation can reduce direct identification, but an individual may still be identifiable if the additional information required to reconnect the data is available.
These distinctions matter because organisations should consider whether identifiable information is genuinely necessary before using it.
The History and Development of the Caldicott Principles
The Caldicott principles history began in the 1990s as information technology made it easier for patient information to be stored, accessed and transferred throughout the NHS.
Dame Fiona Caldicott chaired a review into the use of patient-identifiable information. Six principles emerged from that review in 1997.
So, why were the Caldicott principles introduced? The central concern was that confidential information should not be used merely because it was available. Organisations needed clearer safeguards requiring them to justify why identifiable information was needed and to restrict unnecessary use and access.
A further Information Governance Review led to Principle 7 in 2013. This addressed another problem: some professionals had become so cautious about confidentiality that necessary information sharing could be obstructed.
In 2020, the principles were revised again and an eighth principle was introduced, placing greater emphasis on transparency with patients and service users.
For anyone wondering how many Caldicott principles are there, the current answer is eight.
The 8 Caldicott Principles Explained
So, what do the eight Caldicott principles achieve? They provide a sequence of checks for deciding whether confidential information should be used and, if so, how that should happen responsibly.
Principle 1: Justify the Purpose(s) for Using Confidential Information
Every proposed use or transfer of confidential information should have a clearly identified purpose.
An organisation should be able to explain why information is required, what it will be used for and whether that purpose justifies using confidential information.
For example, a hospital may need to send information to a specialist service because a patient has been referred for treatment. That is a clear purpose. Using the same identifiable information for an unrelated project would need separate justification.
Existing information flows should also be reviewed periodically rather than continuing indefinitely simply because they have always existed.
Principle 2: Use Confidential Information Only When Necessary
After identifying the purpose, the next question is whether confidential information is actually necessary.
Sometimes an organisation needs information but does not need to know who the individuals are.
For example, managers reviewing how many patients used a service during a particular period may be able to work with anonymous or aggregated figures instead of identifiable records.
This principle encourages organisations to consider less intrusive alternatives wherever they can achieve the same objective.
Principle 3: Use the Minimum Necessary Confidential Information
If confidential information must be used, only the minimum amount required for the particular purpose should be included.
Imagine that a professional needs to confirm a patient’s current medication before providing care. That does not automatically justify giving them access to every historical diagnosis, consultation and treatment recorded about that individual.
The organisation should therefore consider which specific information is actually necessary.
This approach protects privacy and reduces the amount of sensitive information that could be exposed if an error or security incident occurs.
Principle 4: Access Confidential Information on a Strict Need-to-Know Basis
Only people who genuinely need confidential information for their work should have access to it.
A GP, pharmacist, care worker, receptionist and finance employee may all work within health or care services, but they are unlikely to need identical access to the same information.
Organisations can support this principle through role-based permissions, secure authentication, access logs and other controls.
The principle also applies to individual behaviour. A worker should not open the health record of a relative, friend, colleague or public figure simply because they are curious.
Technical access does not create a legitimate need to know.
Principle 5: Everyone with Access to Confidential Information Must Understand Their Responsibilities
Everyone who handles confidential information should understand how it must be protected.
This applies not only to doctors or information-governance teams but also to nurses, social workers, care workers, receptionists, administrators, contractors, managers and other authorised personnel.
Staff responsibilities can include checking recipients before sending information, protecting login credentials, storing documents securely, avoiding confidential conversations in unsuitable locations and reporting suspected information incidents.
Training can support understanding, but it should work alongside clear workplace procedures, appropriate supervision and secure systems.
Principle 6: Comply with the Law
Every use of confidential information must be lawful.
Depending on the circumstances, relevant requirements can include UK GDPR, the Data Protection Act 2018 as amended, the common law duty of confidentiality and other laws governing particular health and social care activities.
Health information is generally special-category personal data. Organisations processing it will commonly need an appropriate lawful basis under Article 6 of UK GDPR and a relevant condition under Article 9, together with applicable requirements under the Data Protection Act 2018.
The Caldicott framework therefore does not replace data-protection or confidentiality law. Instead, it operates alongside those requirements.
Principle 7: The Duty to Share Information for Individual Care Is as Important as the Duty to Protect Patient Confidentiality
Principle 7 makes an important point: confidentiality does not mean that information should never be shared.
Modern care often involves several professionals. A patient may receive treatment or support from a GP, hospital team, pharmacist, community nurse and social care service.
These professionals may need relevant information to provide coordinated and safe care.
Unnecessarily withholding information can therefore create risks just as inappropriate disclosure can.
Principle 7 encourages professionals to share information confidently where it is genuinely required for individual care. The other principles still apply: the sharing must be justified, necessary, proportionate, lawful and limited to appropriate recipients.
Principle 8: Inform Patients and Service Users How Their Confidential Information Is Used
Patients and service users should understand how confidential information about them is normally used.
Organisations should provide accessible information explaining why data is collected, how it may be shared and what relevant choices people may have.
This may be communicated through privacy information, written notices, websites or direct discussions where appropriate.
The aim is to prevent unnecessary surprises.
Principle 8 does not mean that explicit consent must be obtained for every use or disclosure. Consent, confidentiality and lawful processing are related concepts, but they are not identical.
Who Do the Caldicott Principles Apply To?
The Caldicott Principles apply to organisations and professionals who handle confidential health and social care information, helping them protect privacy and share information responsibly.
Caldicott Principles in Health and Social Care
The Caldicott principles health and social care framework primarily concerns confidential information collected for health and social care services where patients or service users can be identified and would expect privacy.
The principles can therefore be relevant to NHS organisations, healthcare professionals, social care providers and other organisations handling confidential health or care information.
The phrase Caldicott principles NHS is common because the framework originated within the NHS. However, its application has expanded more broadly into health and social care.
Specific governance arrangements differ across England, Scotland, Wales and Northern Ireland. Organisations should therefore follow the legal and organisational requirements relevant to their own jurisdiction rather than assuming every English requirement applies throughout the UK.
Do the Caldicott Principles Apply to the Deceased?
A frequently searched question is: do Caldicott principles apply to the deceased?
Confidentiality does not automatically disappear when somebody dies. Health and care records relating to deceased people can remain subject to a duty of confidentiality.
The Caldicott principles deceased position differs from ordinary UK GDPR protection. UK GDPR applies to living individuals, so information concerning a deceased person does not fall within it in exactly the same way.
However, separate confidentiality requirements remain important. Requests to access records after somebody’s death must therefore be considered carefully.
For health records in England and Wales, the Access to Health Records Act 1990 can provide specified people with rights of access in certain circumstances and subject to restrictions.
Family members should not assume that a person’s entire record automatically becomes available after death.
What Information Is Covered by the Caldicott Principles?
The principles can apply to confidential information in many formats.
This includes electronic health records, paper documents, referrals, care assessments, emails, photographs, recordings, messages and verbal conversations.
The key question is not whether information is digital or on paper. It is whether an identifiable person would reasonably expect that information to remain confidential.
What Is a Caldicott Guardian?
A Caldicott Guardian is a senior person who helps an organisation protect confidential health and care information and use it appropriately.
The Guardian considers ethical and legal aspects of information sharing and can be particularly valuable where an organisation faces a novel, sensitive or difficult decision.
What Does a Caldicott Guardian Do?
A Caldicott Guardian may advise on matters such as:
- complex requests for disclosure;
- new information-sharing arrangements;
- organisational confidentiality policies;
- proposed new uses of confidential information;
- application of the Caldicott principles; and
- difficult ethical questions about sharing and privacy.
The Guardian should have sufficient authority to challenge inappropriate practices where necessary.
However, responsibility for confidentiality does not belong only to the Guardian. Everyone handling confidential information continues to have their own responsibilities.
A Caldicott Guardian is also not automatically the same as a Data Protection Officer. The roles may work closely together, but they serve different functions.
Who Needs a Caldicott Guardian?
In England, National Data Guardian statutory guidance applies to public bodies within the health service, adult social care and adult carer-support sectors that handle confidential information about patients or service users.
It also includes certain organisations contracted by those public bodies to deliver health or adult social care services while handling such information.
This does not mean every organisation connected with health or care throughout the UK is subject to exactly the same appointment requirement.
Organisations should check the specific rules applying to their activities, sector and jurisdiction.
How Are the Caldicott Principles Applied in Practice?
The Caldicott Principles are applied in practice by helping health and social care professionals make responsible decisions about using, accessing and sharing confidential information.
Examples of Applying the Caldicott Principles
Consider a person who is moving from hospital treatment to support from a community rehabilitation team.
The hospital has a clear reason for sharing relevant information: continuity of care. Some identifiable information is essential because the community team needs to know who the individual is.
However, the team does not necessarily need the patient’s entire hospital history. Information should be limited to what is relevant to the continuing care requirement and made available only to authorised professionals.
Now consider an organisation reviewing whether missed appointments have increased during the year. It may need statistics about dates and attendance but not necessarily names, diagnoses or complete clinical records.
Anonymous or aggregated information could therefore be more appropriate.
These examples illustrate how the principles encourage proportionate decisions rather than automatically sharing everything or automatically withholding everything.
When Can Confidential Information Be Shared?
Confidential information may be shared in appropriate circumstances, including for individual care, safeguarding, statutory requirements or other properly justified purposes.
Explicit consent is not the only possible basis for every disclosure.
Professionals should consider why information is being shared, whether identifying the person is necessary, how much information is required, whether the recipient needs to know it, whether sharing is lawful and whether the information will be transferred securely.
Where the circumstances are unusual or difficult, staff should follow organisational procedures and obtain appropriate information-governance or Caldicott Guardian advice.
Caldicott Principles and Data Protection Law
The Caldicott Principles work alongside data protection law to help health and social care organisations protect confidential information and ensure it is used and shared lawfully and appropriately.
How Do the Caldicott Principles Relate to UK GDPR?
The relationship between Caldicott principles and GDPR is complementary rather than interchangeable.
UK GDPR forms part of the legal framework governing personal information. The Caldicott principles provide health and social care organisations with practical good-practice guidance on confidential information.
There is substantial overlap. For example, Principle 3 supports the idea of data minimisation, while Principle 8 complements data-protection requirements concerning transparency.
However, complying with the Caldicott principles does not automatically establish UK GDPR compliance.
A responsible Caldicott principles data protection approach therefore requires organisations to consider both the Caldicott framework and applicable data-protection legislation.
What Does the Data Protection Act 2018 Require?
The relationship between Caldicott principles and data protection act requirements is particularly important where health information is processed.
Health information generally falls within special-category personal data. An organisation will normally need an Article 6 lawful basis and an Article 9 condition. Some Article 9 conditions also require additional safeguards or conditions under the Data Protection Act 2018.
The legal framework has also developed since 2018.
The Data (Use and Access) Act 2025 amended parts of UK data-protection law, and all of its data-protection provisions were in force by June 2026.
Organisations should therefore use current ICO guidance and legislation rather than relying entirely on older training materials that describe the original 2018 framework.
Frequently Asked Questions About the Caldicott Principles
Why Are the Caldicott Principles Important?
They help organisations protect sensitive information without unnecessarily preventing legitimate information sharing. They provide a practical method for considering purpose, necessity, proportionality and access.
Are the Caldicott Principles Legally Binding?
The eight principles are good-practice principles rather than eight separate statutory rules. However, they operate alongside legal obligations, and specified organisations in England must give due regard to statutory National Data Guardian guidance concerning Caldicott Guardians.
Who Is Responsible for Following the Caldicott Principles?
Everyone handling relevant confidential information has responsibilities. This can include clinical staff, social care professionals, administrators, managers, contractors and other authorised people.
What Is the Difference Between the Caldicott Principles and GDPR?
UK GDPR is data-protection legislation applying broadly to personal-data processing. The Caldicott principles are specifically focused on responsible use and sharing of confidential health and social care information. An organisation may need to comply with both.
Are There Six, Seven or Eight Caldicott Principles?
There are currently eight. Six were introduced following the original 1997 review, Principle 7 was added in 2013 and Principle 8 was introduced in 2020.
Do the Caldicott Principles Prevent Information Sharing?
No. Principle 7 specifically recognises that appropriate information sharing for individual care can be as important as protecting confidentiality.
Does Removing a Patient’s Name Make Information Anonymous?
Not necessarily. Other details may still allow the individual to be identified. Organisations need to consider whether information has genuinely been anonymised.
Is a Caldicott Guardian the Same as a Data Protection Officer?
No. Although the roles can work together, their functions are different. A Caldicott Guardian focuses particularly on the ethical and appropriate use of confidential health and care information, while a Data Protection Officer has specific responsibilities under data-protection legislation where that role is required.
Key Takeaways
The caldicott principles provide a practical framework for protecting confidential health and social care information while enabling appropriate use and sharing.
There are eight principles. They require organisations and staff to justify the purpose for using confidential information, avoid using it where unnecessary, minimise the information involved, restrict access to people with a genuine need to know, understand their responsibilities, comply with the law, recognise the importance of appropriate information sharing for individual care and inform patients and service users about how information concerning them is used.
Understanding what are the 8 Caldicott principles is therefore more valuable than simply memorising eight statements. Their real importance lies in applying them to everyday decisions about records, access, communication and information sharing.
The principles must also be understood alongside current legislation. Caldicott principles data protection responsibilities interact with UK GDPR, the Data Protection Act 2018 as amended and the common law duty of confidentiality, but these frameworks are not identical.
Training Arena currently provides online learning across a wide range of subject areas. Training can help people build awareness of professional responsibilities and information-handling issues, but learners should check the exact course content, assessment and recognition of individual programmes. A course certificate should not automatically be treated as a regulated qualification, professional licence or proof of competence to make complex health and social care information-governance decisions.
Ultimately, the Caldicott principles promote a balanced approach: protect confidential information carefully, use no more than is genuinely needed, share appropriately where individual care requires it and make sure patients and service users understand how information about them is being handled.