The Caldicott principles help health and social care organisations protect confidential information while ensuring it can still be used and shared appropriately. They provide practical guidance for anyone handling sensitive information about patients or service users.
Quick Overview
The Caldicott Principles provide a practical framework for protecting confidential health and social care information while ensuring it can be used and shared appropriately when necessary. There are eight principles, covering purpose, necessity, data minimisation, access, staff responsibilities, legal compliance, appropriate information sharing and transparency.
This guide covers:
✅ What the Caldicott Principles are
✅ The 8 Caldicott Principles and their purpose
✅ Confidential and patient-identifiable information
✅ Who the principles apply to
✅ The role of a Caldicott Guardian
✅ Appropriate information sharing and confidentiality
✅ The relationship betwe
en the Caldicott Principles, UK GDPR and data protection law
There are currently eight Caldicott principles, which explain how confidential information should be handled responsibly. This simple guide explains what the principles mean, why they were introduced, how they work alongside data protection law, and how they can be applied in everyday health and social care.
Understanding the Caldicott Principles
A simple Caldicott principles definition is that they are good-practice principles for deciding how confidential health and social care information should be used, accessed and shared.
The purpose of Caldicott principles is not simply to prevent disclosure. They aim to balance privacy with responsible information sharing. In some circumstances, sharing relevant information is essential for providing safe and effective care.
In practical terms, what do the eight Caldicott principles achieve? They encourage organisations to justify why information is needed, minimise the amount of information they use, control access, comply with the law, and explain clearly to patients and service users how their information is used.
What Is Patient-Identifiable and Confidential Information?
Confidential information may include a person’s name, address, diagnosis, symptoms, treatment, medicines, care needs or other information obtained through health or social care.
A person can also sometimes be identified without their name. Several details, when combined, may reveal who they are.
This is why the Caldicott principles and confidentiality involve considering whether information identifies someone directly or indirectly, and whether they would reasonably expect it to remain private.
The History and Development of the Caldicott Principles
The history of the Caldicott principles began with a review chaired by Dame Fiona Caldicott into the handling of patient-identifiable information within the NHS.
So, why were the Caldicott principles introduced? The 1997 review examined concerns about how patient information was being used and transferred. It resulted in six original principles.
A seventh principle was added following a further review in 2013. It emphasised that appropriate information sharing for individual care can be as important as protecting confidentiality.
An eighth principle was introduced in 2020, focusing on informing patients and service users about how their confidential information is used.
Therefore, if you are wondering how many Caldicott principles there are, the current answer is eight.
The 8 Caldicott Principles Explained
The Caldicott Principles provide guidance on how confidential information should be handled within health and social care. They help organisations balance the need to protect people’s privacy with the need to use and share information appropriately for individual care and other legitimate purposes.
Understanding Caldicott principles confidentiality is essential for anyone who handles confidential information. The principles also form an important part of Caldicott principles information governance, helping organisations establish appropriate policies, procedures and safeguards.
Principle 1: Justify the Purpose(s) for Using Confidential Information
There should be a clear and legitimate reason for using or sharing confidential information. Organisations should define the purpose, consider whether it is justified and review ongoing uses periodically.
Information should not continue to be collected, accessed or shared simply because it has always been done that way. Organisations should regularly consider whether the use of confidential information remains necessary and appropriate.
Principle 2: Use Confidential Information Only When Necessary
Before using identifiable confidential information, consider whether the purpose could be achieved in another way.
For example, anonymised or appropriately de-identified information may sometimes be sufficient for analysis, research or planning. If identifying an individual serves no genuine purpose, their confidential information should not be unnecessarily included.
Principle 3: Use the Minimum Necessary Confidential Information
When confidential information is necessary, only the minimum amount required for the specific purpose should be used.
For example, a professional who needs one relevant part of a person’s record may not need access to the entire record. This principle is closely connected with the concept of data minimisation and supports good Caldicott principles confidentiality practices.
Principle 4: Access Confidential Information on a Strict Need-to-Know Basis
Only people who genuinely need confidential information to carry out their work should have access to it.
Being employed by an NHS or social care organisation does not give someone an automatic right to view every record. Appropriate access controls should restrict information according to people’s roles, responsibilities and legitimate requirements.
Principle 5: Everyone with Access to Confidential Information Must Understand Their Responsibilities
Anyone who handles confidential information should understand their responsibilities and duties.
This includes knowing when information can be accessed or shared, how it should be stored and what to do if a confidentiality or information security problem occurs.
Effective Caldicott principles information governance therefore depends on staff awareness, clear organisational policies and appropriate technical and organisational security measures.
Principle 6: Comply with the Law
Confidential information must be handled in accordance with applicable laws and regulations.
The Caldicott principles data protection framework works alongside legislation such as the UK GDPR and the Data Protection Act 2018, rather than replacing it. Other legal, regulatory and professional confidentiality requirements may also apply, depending on the circumstances.
Principle 7: The Duty to Share Information for Individual Care Is as Important as the Duty to Protect Patient Confidentiality
Protecting confidentiality should not become a reason for withholding information that genuinely needs to be shared to support someone’s care.
For example, relevant information may need to be passed from a hospital team to another healthcare or social care professional who will continue the person’s treatment or support.
The principle encourages proportionate information sharing: not too much information, but not too little when someone’s care depends on it.
Principle 8: Inform Patients and Service Users How Their Confidential Information Is Used
People should receive appropriate information about how organisations use their confidential information.
They should not be subject to unexpected uses of their information where those uses could reasonably have been explained beforehand. Clear privacy information and effective communication can help patients and service users understand what happens to their information, why it is used and, where appropriate, who it may be shared with.
A Brief History of the Caldicott Principles
Understanding the Caldicott principles history helps explain why these principles were developed. They originated from a review led by Dame Fiona Caldicott, which examined the use and handling of patient-identifiable information within the NHS.
The review recognised the need to balance the protection of patient confidentiality with the appropriate use and sharing of information. The original principles were introduced to provide a practical framework for organisations and professionals handling confidential patient information.
Why Were the Caldicott Principles Introduced?
Why were the Caldicott principles introduced? They were introduced to help ensure that confidential information is used appropriately while protecting people’s privacy.
The principles provide a framework for deciding when confidential information should be used or shared, what information is necessary, who should have access to it and how organisations should protect it. They also recognise that information sharing can be essential for providing safe and effective individual care.
Who Do the Caldicott Principles Apply To?
The Caldicott Principles apply to organisations and individuals who handle confidential information in health and social care.
Caldicott Principles in Health and Social Care
The Caldicott principles health and social care framework is relevant to organisations and individuals who handle confidential patient or service-user information.
Although the principles originated in the NHS, their application now extends more widely across health and social care. Searches for Caldicott principles NHS guidance should therefore not be interpreted as meaning that the framework applies only to NHS employees or organisations.
The principles should be considered alongside relevant legislation, professional duties and organisational policies. Specific legal and organisational requirements may differ across England, Scotland, Wales and Northern Ireland.
What Are the 8 Caldicott Principles?
A common question is what are the 8 Caldicott principles? The principles provide guidance on how confidential information should be used, accessed and shared appropriately while protecting people’s privacy.
The 8 Caldicott principles cover areas including having a clear purpose for using confidential information, using information only when necessary, limiting access to the minimum information required, restricting access on a need-to-know basis, ensuring staff understand their responsibilities, complying with the law, sharing relevant information when it is necessary for individual care, and informing patients and service users about how their information is used.
Do the Caldicott Principles Apply to the Deceased?
A common question is: do Caldicott principles apply to the deceased?
The UK GDPR protects personal data relating to identifiable living individuals. Information relating solely to someone who has died is therefore not personal data under the UK GDPR.
However, information about a deceased person should not automatically be treated as freely available. Duties of confidentiality and other legal or professional considerations may continue to apply. In addition, a deceased person’s records may contain information that identifies living individuals and may therefore include personal data relating to them.
What Information Is Covered by the Caldicott Principles?
The principles cover confidential information collected or used in connection with health and social care where an individual can be identified and would reasonably expect the information to remain private.
This may include clinical records, assessments, referrals, treatment details, social care information and communications between health and social care professionals.
The principles are intended to support a balance between protecting confidentiality and making appropriate use of information when it is necessary for individual care, service planning or other legitimate purposes.
What Is a Caldicott Guardian?
A Caldicott Guardian is a senior person who helps an organisation use health and care information responsibly and appropriately.
The Guardian considers the ethical, legal and confidentiality aspects of information sharing and can provide advice when a decision about confidential information is difficult, sensitive or unusual.
What Does a Caldicott Guardian Do?
Typical responsibilities include advising on information-sharing decisions, promoting confidentiality, helping organisations apply the Caldicott Principles and contributing to policies concerning the use of confidential and sensitive information.
A Caldicott Guardian does not remove responsibility from other staff. Everyone who handles confidential information must still follow appropriate procedures, professional duties and legal requirements.
Who Needs a Caldicott Guardian?
In England, National Data Guardian statutory guidance requires specified public bodies in health, adult social care and adult carer support that handle confidential patient or service-user information to have appropriate Caldicott Guardian arrangements.
Certain organisations contracted to deliver publicly funded health or adult social care services may also fall within the scope of the guidance. Organisations should consider the applicable requirements and seek appropriate advice where necessary.
How Are the Caldicott Principles Applied in Practice?
The Caldicott Principles are applied in practice by ensuring confidential information is used and shared appropriately, securely and only when necessary.
Examples of Applying the Caldicott Principles
Suppose a patient leaves hospital and requires community care. Relevant information about their medication and ongoing treatment may need to be shared with the professionals continuing their care.
The team should establish why the information is needed, share only the relevant details and limit access to the people who genuinely need the information to provide care.
For a statistical report, however, identifiable information may not be necessary at all. Properly anonymised information might achieve the same objective while reducing the risk to people’s privacy.
When Can Confidential Information Be Shared?
Confidential information can sometimes be shared when there is an appropriate justification and applicable legal basis. Consent is important in many situations, but it is not the only possible basis for every form of health and care information sharing.
Staff should follow their organisation’s procedures and seek appropriate advice when a decision is uncertain or particularly sensitive.
A related question is do Caldicott principles apply to the deceased? The UK GDPR protects personal data relating to identifiable living individuals, so information relating solely to a person who has died is not personal data under the UK GDPR.
However, this does not mean that Caldicott principles deceased information can be treated as freely available. Confidentiality duties and other legal or professional considerations may continue to apply after a person’s death. In addition, records relating to a deceased person may contain information about living individuals, which could be protected as personal data.
Organisations should therefore consider the circumstances carefully and seek appropriate advice before disclosing information relating to a deceased person.
Caldicott Principles and Data Protection Law
The Caldicott Principles work alongside UK data protection law to ensure confidential health and care information is used and shared lawfully and responsibly.
How Do the Caldicott Principles Relate to UK GDPR?
The Caldicott principles and GDPR complement each other and should be considered together when handling confidential health and care information.
The UK GDPR establishes legal requirements for processing personal data, including principles relating to lawfulness, transparency, purpose limitation, data minimisation and security.
The Caldicott framework provides additional guidance for health and social care organisations on the responsible use and sharing of confidential information. The Caldicott principles data protection framework therefore works alongside data protection law rather than replacing it. Following one framework does not remove the need to comply with the other.
What Does the Data Protection Act 2018 Require?
The Caldicott principles and Data Protection Act should also be considered together when organisations use or share confidential information.
The Data Protection Act 2018 supplements the UK GDPR and contains additional provisions governing the processing of personal data. Health information will commonly be treated as particularly sensitive information and may require additional safeguards.
The current legal framework has also been amended by the Data (Use and Access) Act 2025. Organisations should therefore refer to current data protection legislation and guidance rather than relying solely on older summaries of the Data Protection Act 2018.
Overall, the Caldicott principles and data protection act framework helps organisations balance the need to protect confidentiality with the need to use and share information lawfully, appropriately and responsibly.
Frequently Asked Questions About the Caldicott Principles
Why Are the Caldicott Principles Important?
The Caldicott Principles help organisations protect confidentiality while allowing relevant information to be used and shared appropriately for health and social care.
Are the Caldicott Principles Legally Binding?
The Caldicott Principles are not a standalone data protection statute. However, they operate alongside legal and professional duties. In England, National Data Guardian statutory guidance also creates separate obligations for organisations that fall within its scope.
Who Is Responsible for Following the Caldicott Principles?
Everyone who handles relevant confidential health or social care information has responsibilities appropriate to their role. Compliance is not solely the responsibility of the Caldicott Guardian. Organisations should ensure that staff understand their responsibilities and follow appropriate policies and procedures.
What Is the Difference Between the Caldicott Principles and GDPR?
The Caldicott Principles focus specifically on the appropriate handling and sharing of confidential health and social care information. The UK GDPR forms part of the wider legal framework governing the processing of personal data.
The Caldicott principles data protection framework therefore works alongside the UK GDPR. Organisations may need to consider both when deciding how confidential information should be collected, accessed, used or shared.
What Are the 8 Caldicott Principles?
The 8 Caldicott principles address purpose, necessity, data minimisation, need-to-know access, individual responsibility, legal compliance, appropriate information sharing for individual care, and transparency with patients and service users.
How Many Caldicott Principles Are There?
There are eight Caldicott Principles. Six originated from the initial 1997 review, the seventh was introduced following the 2013 review, and the eighth was introduced in 2020.
Can Patient Information Ever Be Shared Without Consent?
Yes, in some circumstances. Whether information can be shared without consent depends on confidentiality obligations, the purpose for sharing, applicable legislation and the specific circumstances.
Staff should follow their organisation’s information-sharing procedures and seek appropriate advice when they are unsure whether information can be disclosed.
Are the Caldicott Principles Only for the NHS?
No. Although the principles originated from an NHS review, the Caldicott principles are now used more broadly across health and social care.
Key Takeaways
Understanding what are the 8 Caldicott principles is ultimately about understanding how to use and share confidential information responsibly. Organisations should have a clear reason for using confidential information, use no more than is necessary, restrict access appropriately, comply with legal requirements and remain transparent with patients and service users.
The principles also make an important point that can sometimes be overlooked: protecting information does not mean refusing to share it in every situation. Appropriate information sharing may be essential to providing safe and effective care.
The Caldicott principles and data protection act should also be considered together. The Caldicott Principles provide a framework for handling confidential information, while the Data Protection Act 2018 works alongside the UK GDPR as part of the wider legal framework for personal data.
For learners exploring health and social care roles through resources such as Jobsonline, understanding the Caldicott Principles provides a useful foundation for recognising how confidentiality, information governance and data protection work together.
Conclusion
The Caldicott principles provide a clear framework for handling confidential health and social care information responsibly. The eight principles cover why information is needed, how much should be used, who should have access, when appropriate sharing is necessary and how patients and service users should be informed.
The principles should always be understood alongside current confidentiality and data protection requirements. Applying them thoughtfully helps organisations protect people’s privacy without preventing information from reaching those who genuinely need it to provide effective care.